I have data with two fields that share a static range of 10 values.  I'd like to show a column chart with the buckets on the X axis and two bars in each bucket, one for field A, the other for field B. This doesn't work: index=foo message="bar" | stats count as "Field A" by A | append [ search index=foo message="bar" | stats count as "Field B" by B ]  I'm sure I'm missing something obvious ... To reiterate, fields A and B are present in all events returned and share the same "buckets".  Call them strings like "Group 1", "Group 2", etc.  So A="Group 3" and B="Group 6" could be in the same event and in the chart I should have a count added for Groups 3 for the Field A column and Group 6 for the Field B column. Thanks! ... View more

I've been asked to show how many events are over the p99 (for example) value for a search.  I'm hopefully just missing something obvious, but I've not figured out how, or if, this is possible. Thx ... View more

In a Classic dashboard, I can add    <option name="drilldown">row</option>   and it highlights the entire row.  My drilldown is not cell-specific, so this is what I want in my Dashboard Studio dashboard.  I've tried:   "viz_Yy6FIxmM": { "type": "splunk.table", "options": { "tableFormat": { "align": "> table |pick(alignment)" }, "drilldown": "row", ...   with no change.  Thx! ... View more

Here's a part of my query, ignoring where the data is coming from:   | eval bucket=case(dur < 30, "Less than 30sec", dur <= 60, "30sec - 60sec", dur <= 120, "1min - 2min", dur <= 240, "2min - 4min", dur > 240, "More than 4min") | eval sort_field=case(bucket="Less than 30sec", 1, bucket="30sec - 60sec", 2, bucket="1min - 2min", 3, bucket="2min - 4min", 4, bucket="More than 4min", 5) | sort sort_field | stats count as "Number of Queries" by bucket   The problem I have is that the results are ordered alphabetically by the name of each bucket.  I'd prefer to have the order always be from quickest to slowest: <30s, 30-60s, 1-2m, 2-4m, >4m What I get:   1min - 2min | <value> 2min - 4min | <value> 30sec - 60sec | <value> Less than 30sec | <value> More than 4min | <value>   What I want:   Less than 30sec | <value> 30sec - 60sec | <value> 1min - 2min | <value> 2min - 4min | <value> More than 4min | <value>   I've tried a number of different approaches, none seeming to do anything.  Is this possible? ... View more

I'm trying to create what is effectively a "server" dropdown in a dashboard, where I want to allow people to filter on one or more servers from a lookup.  By default, I want the visualization to show for all servers.  I have the lookup pulling values, but I'm stuck trying to figure out how to make it so that they don't have to unselect a default "*" value.  Ideally, the input is empty by default (or it can show some value like "*" or "all") but once they start selecting individual servers that "all" option is removed.  Conversely, if they remove all servers from the filter, it should once again act like "*". Here's a stripped-down version of what I'm trying to do:     <form version="1.1" theme="dark"> <label>My dashboard</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-5m</earliest> <latest>now</latest> </default> </input> <input type="multiselect" token="server" searchWhenChanged="true"> <label>server</label> <search> <query>| inputlookup server_lookup.csv</query> </search> <fieldForLabel>server</fieldForLabel> <fieldForValue>server</fieldForValue> <delimiter>, </delimiter> <default>*</default> </input> </fieldset> <row> <panel> <title>Some panel</title> <chart> <search> <query>index=* server_used IN ($server$) | stats median(some_value)</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">radialGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.rangeValues">[0,10,30,100]</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.gaugeColors">["0x118832","0xcba700","0xd41f1f"]</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </form>     ... View more