Hi Splunk Developers, we are currently investigating whether we can improve the UI and UX of our splunk classic dashboards. Therefore we are looking for UI/UX frameworks or tools that we could integrate in splunk.  Unfortunately we are struggling to include anything other than simple javascript, html and css.  What we are trying to include: lit (https://lit.dev) but splunk completely ignores custom created html tags. they simply dont appear in the dashboard, eventhough splunk doesnt mark them as "red"/wrong. Question: Do any of you use any other UI/UX frameworks or tools for your splunk dashboards to make them more "state of the art", "responsive" and "appealing" to imporve the User Experience? If yes, what are you using? + Were you able to make use of lit.dev? ... View more

Hi I have the use case that i need to find some direct links between different events of the same index and sourcetype. The result should show me three different bars: bar 1: count of the existing links (incl. filter criteria matching) bar 2: count of the existing links where filter criteria dont match bar 3: count of the events where there is no existing link at all I came so far to make use of the "left join" to not loose the "not matching" events but now I dont know how to differiance them into a bar diagram or with an if condition to count them. It needs to be counted weekly. Can you help me please? This is my current query state: index=A | rename Name as TargetName | join type=left max=0 TargetName    [ search index=A    | fields TargetName ID Status] | join type=left SourceID    [ search index=A    | fields SourceID, type] | join type=left TargetID    [ search index=A    | fields TargetID] | bin span=1w@w0 _time | eval state=if(match(status,"Done") OR match(status,"Pending"), "Link + State is there", if (NOT match(status,"Done") OR NOT match(status,"Pending"), "State is missing", "No Link")) | dedup ID _time sortby -state | timechart span=1w@w0 count by state Somehow I can not make it work to get all "non matching" aka. the "No Link" events. Is the "if" the right way to get what I need? Do i need to add another "eval" within each join? And if yes, how to do that? Thank you for every help! This should be my result (see screenshot). ... View more

Hello all, I have following use case: We have a dropdown filter which reads out the values you can choose from a lookup. Now we would like to implement a simple button that is "hidden" by default but should appear once the specific value "Alaska" is selected in the dropdown filter. How can I implement this? Somehow I cant make it work. I would appreciate every help. Thank you in advance! ... View more

Hello all, since we can set the setting "srchDiskQuota" for each role in the authorize.conf I would like to know if there is a way to find out how much of the provided disk size has been really used by a specific role or user?  I want to make sure to not reach the srchDiskQuota limit soon. Until now I couldnt find anything like this within the monitoring console. Thanks for a short feedback would be really appreciated. ... View more

We currently have an issue with our "nobody" user in splunk whom we assign all our scheduled reports to. we are reaching daily the disk quota limit and  a lot of searches are getting skipped. Message: "The maximum disk usage quota for this user has been reached." Now I want to increase the "srchDiskQuota" in the authorize.conf.  But having two questions: 1. Is it correct that if we want to assign anything to the "nobody" user we need to do this for [default] since the "nobody" user isnt assigned to any role? Or is the user actually part of the role "splunk-system-role"? 2. How can I find out what would be my maximum setting for the "srchDiskQuota" to not brake my system? Thanks for a short feedback. ... View more