Another option is to use my Chrome Extension - https://github.com/rcastley/splunk-blue-dot-remover ... View more

For anyone stumbling on this thread and wondering about axis labels. Splunk has replied here: https://splunk.my.site.com/customer/s/article/Display-values-on-x-axis Splunk ideas link: https://ideas.splunk.com/ideas/EID-I-1833   I'm not connected in any way other than also wanting labels to be handled more elegantly than just ignoring them if there are too many. ... View more

Hi @dataisbeautiful , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Not seeing the fields will stop your filter from working, but why is the question. ... View more

Looks like you have some elements which are only partically removed from the code. Elements are defined in one array and the layout is in another array. You'll need to remove the erroneous references to continue. This error isn't about the refresh, but the dashboard code not being valid. Clone the dashboard, or make a back up Note down the element IDs Open code view Use Find (CTRL-F, or your browser/OS shortcut) and enter each ID Remove all instances of the ID, careful not to delete other bits of code Post again when you've cleared out the errrored elements. ... View more

Hi @splunk_user_99  You can get network/log data from Team Red/Blue exercises "Boss of the SOC" found at https://github.com/splunk/securitydatasets These come in Splunk ready format for you to add into your instance and work on. ... View more

Hi @harishsplunk7  I can't see that as an option so I don't think so. You could add an action to email you if the search fails so you can investigate. ... View more

Thank you for the replay ... View more

@dataisbeautiful  You should be able to control this by adding this line: display.visualizations.charting.chart = line to the following .conf file(s): Global: $SPLUNK_HOME/etc/system/local/ui-prefs.conf Per User: $SPLUNK_HOME/etc/users/<username>/system/local/ui-prefs.conf For more information see: https://docs.splunk.com/Documentation/Splunk/9.3.1/admin/Ui-prefsconf ... View more

Hi @dataisbeautiful , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Thanks @bowesmana @ITWhisperer  ... View more

50k is the limit on subsearch when used with join command. The "normal" subsearch limit is much lower - it's 10k results. ... View more

At the very basic level you are producing a timechart with a span=1h and you want a time chart with a daily set of numbers, so that's wrong. However, it's impossible to say what is going on here, you have so much going on in the search. You have to go back to basics, which means start with the basic data and at EACH step of your SPL make sure the data is giving you what you expect. So, take a very small sample set of data and run the SPL line by line, check the output after each line. When you are happy that the data is giving you the correct output from 1 line of SPL, add in the next line.   ... View more

Hi, dataisbeautiful , this worked. Thanks ... View more

Thank you @gcusello, that worked ... View more

Ideas votes are a precious resource. As @isoutamo suggested, try bugging the PM periodically through Slack. Hopefully, they'll pick it up without the minimum number of required votes. ... View more

Hi @dataisbeautiful, never use All Time! choose a correct time range and use it, Ciao. Giuseppe ... View more