Splunk Cloud Version: 9.0.2209.4 ... View more

Btw, I have created the same search but in classic dashboard. It shows the results with this warning. "These results may be truncated. Your search generated too much data for the current visualization configuration. " and it is indeed truncating the number of results. I have been trying to change the default setting of the "charting.chart.resultTruncationLimit" and "charting.data.count" property (added them in the search query) but it does not increase the number of data. Is there anyway to make it show all the data in the classic dashboard?  https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartDisplayissues?ref=hk#Search_result_truncation   <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.resultTruncationLimit">500000</option> <option name="charting.data.count">100000</option> <option name="charting.drilldown">none</option>     ... View more

Hi as @bowesmana said you have set srchIndexesDefault srchIndexesDefault = <semicolon-separated list> * A list of indexes to search when no index is specified. * These indexes can be wild-carded ("*"), with the exception that "*" does not match internal indexes. * To match internal indexes, start with an underscore ("_"). All internal indexes are represented by "_*". * The wildcard character "*" is limited to match either all the non-internal indexes or all the internal indexes, but not both at once. * No default. Personally I always suggest that this should never set anything else than empty/null value. In long run it generates more issues for your users as they don't learn to use index=xyz if there are some indexes set here. Also when this is set by role they have totally different combination of default indexes based on which roles has granted to them. If you set this as *, then it generate performance issues quite easily if/when you have tens/hundreds of indexes. r. Ismo   ... View more

Yes, it is possible to add parameters to a Splunk URL to pre-populate the search query and make it more user-friendly. This can be helpful for sharing saved searches or dashboards with others so that they don't need to manually format the SPL search. To pre-populate a search query in a Splunk URL, you can use the search parameter. Here's the basic structure of a Splunk URL with a pre-populated search query: https://splunk_server:port/en-US/app/<APP_NAME>/search?q=<URL_ENCODED_SEARCH_QUERY> For example, if you want to pre-populate a search for "error messages," you can encode the query and create a URL like this: https://splunk_server:port/en-US/app/search/search?q=error%20messages When users click this URL, they will be taken to the Splunk search page with the "error messages" query already in the search bar. They can then execute the search or further refine it as needed. To create the <URL_ENCODED_SEARCH_QUERY> part of the Splunk URL, you need to URL-encode the actual SPL query you want to pre-populate in the URL. URL encoding is necessary to make sure that special characters or spaces in the query are correctly formatted for a URL. Here's an example: Let's say your SPL query is: index=myindex sourcetype=mylog "error messages" OR "warning messages" source="/var/log/app.log" To URL-encode this query, you would replace spaces with %20 and leave the rest of the query intact: index%3Dmyindex%20sourcetype%3Dmylog%20%22error%20messages%22%20OR%20%22warning%20messages%22%20source%3D%22%2Fvar%2Flog%2Fapp.log%22 So, your complete Splunk URL with the pre-populated URL-encoded search query would look like: https://splunk_server:port/en-US/app/search/search?q=index%3Dmyindex%20sourcetype%3Dmylog%20%22error%20messages%22%20OR%20%22warning%20messages%22%20source%3D%22%2Fvar%2Flog%2Fapp.log%22 You can use online URL-encoding tools (I am using CyberChef) to automatically encode your SPL query if it contains complex characters. Just paste your query into one of these tools, and it will generate the URL-encoded version for you. ... View more

Hi, I have the same problem here. Tried to set it to 60 days but it only shows 30 day data by using your spl. ... View more

I also was looking for this on the new Dashboard Studio. The only thing that helped was appending this to the search: ... | noop sample_ratio=10  From: https://community.splunk.com/t5/Splunk-Search/Can-sampling-for-subsearches-be-used-to-parameterize-main-search/m-p/478261/thread-id/134148 Noop Doc: https://docs.splunk.com/Documentation/Splunk/9.0.5/SearchReference/Noop ... View more

Hi @TrangCIC81  Thanks for your reply, unfortunately i didnt worked, also tired option using inspect element properties, but no luck ... View more

Good to hear it works!! Please mark my answer as the solution so someone can refer it in the future. Good day! ... View more

Thanks @ITWhisperer , It worked. ... View more

Do you want know if it's possible to display the total count of a field for each page in a Splunk table. Or in other words, if the search results span multiple pages, you want to know if there's a way to display the total count of a particular field for each page separately? ... View more

If you want to change the font color for a specific table cell without any specific condition, you can use CSS to target that cell and set its color. For ex:   <table> <row> <th>Header 1</th> <th>Header 2</th> <th>Header 3</th> </row> <row> <td style="color: red;">Cell 1</td> <td>Cell 2</td> <td>Cell 3</td> </row> <row> <td>Cell 4</td> <td>Cell 5</td> <td>Cell 6</td> </row> </table>   In this example, the style attribute is used to set the font color of the first cell in the second row to red. You can modify this code to target the specific cell that you want to change the font color for in your table. What is your current code like? I can have a look on it and adjust. ... View more

I have already provided you with the first and second searches, though. The first search is: `palo_logs(traffic)` | stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action | rename values(*) as * | rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\." and the second search is: | rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\." So, what would the join look like? ... View more

when you create a dashboard it will have a Schedule section as below Click Edit and set the fields as you want.     ... View more

  #tableColumWidth table th:nth-child(n+5), #tableColumWidth table td:nth-child(n+5) { display: none; } #tableColumWidth table th:last-child, #tableColumWidth table td:last-child { overflow-x: auto; width: auto !important; } </style> </html>   Can you replace it with the above?  This should hide all columns after the fourth column, and set a fixed width of 25% to the first four columns. The last column will have overflow-x set to auto to allow horizontal scrolling when necessary, and the width is set to auto !important to override the 25% width set earlier. This should allow the first four columns to be visible without scrolling horizontally, and allow the remaining columns to be accessed by scrolling horizontally. ... View more

The name of the series / bar being clicked on is available in $click.name2$ - you can use this in your drilldown code to set a token which is use in the search in your panel (and for the depends for the panel too) ... View more

Can you try adding the following source code to the bottom of the dashboard source?  You can adjust the font size value (12px in this example) to make the icons larger or smaller as desired.   .icon-info-sign, .icon-exclamation-sign, .icon-remove-sign { font-size: 12px; }   ... View more

Your raw event is itself in JSON, in which the log node embeds another JSON object mixed with other text.  Try extract that embedded JSON first. The following assumes that the embedded JSON is not escaped in some other ways but is already conformant: | rex field=log "LOGGER (?<LOGGER>{.*})" | spath input=LOGGER The above will not work if the LOGGER piece is escaped in some way.  Please post your sample data in raw text format if that fails ... View more

@s0k0 - I'm glad that it works!! Kindly consider accepting my answer which helped you resolve your question, so that other community members can easily see it. ... View more

we have waited for 3 days but still no result 😞 ... View more

Weird, I'm sure I tried adding double quotes at some point to the eval fields. However, the isnotnull parameter has to be in single quote. So the correct answer is, | eval group_name = case(isnotnull('parameters{}.Name'), "Name", isnotnull('parameters{}.HolderId'), "HolderId", isnotnull('parameters{}.LicenseNumber'), "LicenseNumber") | stats count by group_name Thanks for you help. ... View more

Can you try with settings in Visualization tab in Splunk Search as the screenshots?   Where series A, B are the two values in y-axis. Instead, if you can find  "Clustered Column" option in Visualization chart options in your current Splunk version, then can use it directly without settings as the above. ... View more

You can try query something like this: index=foo sourcetype=bar system_name="*_volume" | eval tstamp=strptime(local_time, "%Y-%m-%dT%H:%M:%S.%Q") | eval _time = tstamp | bucket span=1d _time | stats avg(value) as avg_value by system_name, _time | streamstats window=2 current=f global=f avg(avg_value) as yesterday_avg by system_name | where avg_value < yesterday_avg | eval value_delta = (avg_value - yesterday_avg) | table system_name, avg_value, yesterday_avg, value_delta   Kindly upvote if you find it useful!!! ... View more

Here is a runanywhere example of how you might approach this | makeresults | fields - _time | eval line.Data = split("[eventOne, eventThree];[eventOne, eventTwo]",";") | mvexpand line.Data ``` the lines above create sample events, one event per line.Data ``` | eval event=split(trim('line.Data',"[]"),", ") | stats count by event ... View more

Here is a runanywhere example showing how you could approach this. | makeresults | fields - _time | eval line.Data = split("{\"eventOne\": 4, \"eventThree\" : 2};{\"eventOne\": 2, \"eventTwo\" : 3}",";") | mvexpand line.Data ``` the lines above create sample events, one event per line.Data ``` | spath input=line.Data | untable line.Data event count | stats sum(count) as count by event ... View more