Btw, I have created the same search but in classic dashboard. It shows the results with this warning. "These results may be truncated. Your search generated too much data for the current visualization configuration. " and it is indeed truncating the number of results. I have been trying to change the default setting of the "charting.chart.resultTruncationLimit" and "charting.data.count" property (added them in the search query) but it does not increase the number of data. Is there anyway to make it show all the data in the classic dashboard?  https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartDisplayissues?ref=hk#Search_result_truncation   <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.resultTruncationLimit">500000</option> <option name="charting.data.count">100000</option> <option name="charting.drilldown">none</option>     ... View more

I just got the reason why it did not show mouse hover.  The "View" option makes it work but I had been viewing it in the edit view. Very confusing!   ... View more

Ohh I know it is weird but it did not show for the whole time until just now I tried to mouse hover again and it came out. I guess it is because of a long delay in display? Thank you by the way. ... View more

Splunk Enterprise 9.0.4 It does not show when I mouse hover  ... View more

I am looking forward to an answer too. Anyone can give an idea? ... View more

Yes, it is possible to add parameters to a Splunk URL to pre-populate the search query and make it more user-friendly. This can be helpful for sharing saved searches or dashboards with others so that they don't need to manually format the SPL search. To pre-populate a search query in a Splunk URL, you can use the search parameter. Here's the basic structure of a Splunk URL with a pre-populated search query: https://splunk_server:port/en-US/app/<APP_NAME>/search?q=<URL_ENCODED_SEARCH_QUERY> For example, if you want to pre-populate a search for "error messages," you can encode the query and create a URL like this: https://splunk_server:port/en-US/app/search/search?q=error%20messages When users click this URL, they will be taken to the Splunk search page with the "error messages" query already in the search bar. They can then execute the search or further refine it as needed. To create the <URL_ENCODED_SEARCH_QUERY> part of the Splunk URL, you need to URL-encode the actual SPL query you want to pre-populate in the URL. URL encoding is necessary to make sure that special characters or spaces in the query are correctly formatted for a URL. Here's an example: Let's say your SPL query is: index=myindex sourcetype=mylog "error messages" OR "warning messages" source="/var/log/app.log" To URL-encode this query, you would replace spaces with %20 and leave the rest of the query intact: index%3Dmyindex%20sourcetype%3Dmylog%20%22error%20messages%22%20OR%20%22warning%20messages%22%20source%3D%22%2Fvar%2Flog%2Fapp.log%22 So, your complete Splunk URL with the pre-populated URL-encoded search query would look like: https://splunk_server:port/en-US/app/search/search?q=index%3Dmyindex%20sourcetype%3Dmylog%20%22error%20messages%22%20OR%20%22warning%20messages%22%20source%3D%22%2Fvar%2Flog%2Fapp.log%22 You can use online URL-encoding tools (I am using CyberChef) to automatically encode your SPL query if it contains complex characters. Just paste your query into one of these tools, and it will generate the URL-encoded version for you. ... View more

Hi, I have the same problem here. Tried to set it to 60 days but it only shows 30 day data by using your spl. ... View more

Good to hear it works!! Please mark my answer as the solution so someone can refer it in the future. Good day! ... View more

Do you want know if it's possible to display the total count of a field for each page in a Splunk table. Or in other words, if the search results span multiple pages, you want to know if there's a way to display the total count of a particular field for each page separately? ... View more

If you want to change the font color for a specific table cell without any specific condition, you can use CSS to target that cell and set its color. For ex:   <table> <row> <th>Header 1</th> <th>Header 2</th> <th>Header 3</th> </row> <row> <td style="color: red;">Cell 1</td> <td>Cell 2</td> <td>Cell 3</td> </row> <row> <td>Cell 4</td> <td>Cell 5</td> <td>Cell 6</td> </row> </table>   In this example, the style attribute is used to set the font color of the first cell in the second row to red. You can modify this code to target the specific cell that you want to change the font color for in your table. What is your current code like? I can have a look on it and adjust. ... View more

Let me know what is your current code like so I can write the exact one but you can try something like this.   <style> .table td:nth-child(1), .table th:nth-child(1) { background-color: white !important; } .table td:nth-child(2), .table th:nth-child(2) { background-color: white !important; } .table td:nth-child(3), .table th:nth-child(3) { background-color: white !important; } </style>     You can add this code right after the <style> tags in your code. Make sure to replace the nth-child() value with the column number you want to target. In the above example, the code is targeting the first 3 columns. ... View more

Is the name of the field containing duplicates that you want to remove "src_name"? if so you can use the below <your_search> | dedup src_name ... View more

can you try something like this?     (index=<your_index> <your_first_search> | `ABC` | stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action | rename values(*) as * | rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\.") | join host_new [| <your_second_search> | rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\." | fields Device_FQDN host_new]    Using the join command to join the first search with the second search.   ... View more

when you create a dashboard it will have a Schedule section as below Click Edit and set the fields as you want.     ... View more

  #tableColumWidth table th:nth-child(n+5), #tableColumWidth table td:nth-child(n+5) { display: none; } #tableColumWidth table th:last-child, #tableColumWidth table td:last-child { overflow-x: auto; width: auto !important; } </style> </html>   Can you replace it with the above?  This should hide all columns after the fourth column, and set a fixed width of 25% to the first four columns. The last column will have overflow-x set to auto to allow horizontal scrolling when necessary, and the width is set to auto !important to override the 25% width set earlier. This should allow the first four columns to be visible without scrolling horizontally, and allow the remaining columns to be accessed by scrolling horizontally. ... View more

Can you try this and see how it works? (Add the CSS code to the html tag section in the dashboard code)   <html> <style> /* Add the below CSS code*/ #tableColumWidth table { table-layout: fixed; width: 100%; } #tableColumWidth table td, #tableColumWidth table th { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } #tableColumWidth table th:nth-child(1), #tableColumWidth table td:nth-child(1), #tableColumWidth table th:nth-child(2), #tableColumWidth table td:nth-child(2), #tableColumWidth table th:nth-child(3), #tableColumWidth table td:nth-child(3), #tableColumWidth table th:nth-child(4), #tableColumWidth table td:nth-child(4) { width: 25%; } #tableColumWidth table th:nth-child(n+5), #tableColumWidth table td:nth-child(n+5) { width: 5%; } </style> </html>   This sets a fixed width of 25% for the first four columns using the nth-child selector, and sets a percentage width of 5% for the remaining columns. You can adjust the width percentage to suit your needs. ... View more

In the dashboard source editor, can you try adding the following CSS code instead?   .dashboard-dropdown .dropdown-toggle { font-size: 16px; } ... View more

Can you try adding the following source code to the bottom of the dashboard source?  You can adjust the font size value (12px in this example) to make the icons larger or smaller as desired.   .icon-info-sign, .icon-exclamation-sign, .icon-remove-sign { font-size: 12px; }   ... View more

You may not use <panel depends="$token$" >. It requires a comma-separated list of token names but not a single token value. For example:   <module> <panel> <input type="text" token="token1" default="default_value" searchWhenChanged="true"/> <input type="text" token="token2" default="default_value" searchWhenChanged="true" depends="token1"/> <input type="text" token="token3" default="default_value" searchWhenChanged="true" depends="token1, token2"/> </panel> </module>   token2 depends on token1, and token3 depends on both token1 and token2. This means that when the value of token1 changes, it will automatically update the values of token2 and token3. ... View more

Can you try with settings in Visualization tab in Splunk Search as the screenshots?   Where series A, B are the two values in y-axis. Instead, if you can find  "Clustered Column" option in Visualization chart options in your current Splunk version, then can use it directly without settings as the above. ... View more

Ah ok. No problem.  Cheers!! ... View more

Can you verify if the values for ChannelName and Channel do not contain any special characters that might interfere with the construction of the string in the body of the request? Also try logging the values of ChannelName and Channel to the console to verify that they are being properly read. ... View more