Morning, Splunkers! I've been running a dashboard that monitors the performance of the various systems my customer uses, and I recently switched all of my timechart line graphs over to the Downsampled Line Chart because it allows a user to zoom in on a specific time/date range that is already displayed (most of my customer's users aren't Splunk-savy in the slightest). My customer has users literally all over the country, so our Splunk is set for all times to be shown as UTC by default for every account. The problem is the Downsampled Line Chart insists on showing everything in local time, regardless of what our account configurations are set to, and I can't find any documentation on how to get it to stop (I'm not an admin, so I can't just go into settings and start editing configuration files). Does anybody have any idea on how to get it to stop? I'd hate to have to give up the functionality of the chart because it won't show the same times for people on opposite sides of the country, but I'm out of options, here.   ... View more

Morning, Splunkers! I've got a fun one today. I need to find the most resource efficient way (i.e., fastest way that won't have my IT guys calling me up and wanting to know why their ports are smoking) to return the unique values in one field that only have unique values in another field. For example, in the following table my search result needs to only return Value B; Values A and C will be thrown out, because they don't have a unique value in Field B. Field A Field B Value A Value A1 Value A Value A2 Value B Value B1 Value C Value C1 Value C Value C2 Value C Value C3   The big problem here is Field B can be any number of different values, so I can't query specifically on what those values may be. I have a solution for this, and it works, but it doesn't work "at scale" because I'm looking through literally billions of records to pull this information.  Here's what I'm already doing:   | tstats count where index=myindex by Field A Field B | stats values(Field B) as Field B by Field A | where mvcount(Field B)=1     This takes a few minutes if I'm pulling, say, over 15 minutes, and I need to pull 90 days, and I really don't want to have to do it 15 minutes at a time and stitch everything together afterward. I will if I have to, but there's got to be a better way to do what I'm trying to do that won't make the system flip me the bird and call it a day. Suggestions? ... View more

Morning, Splunkers. I've got a dashboard that gets some of it's input from an external link. The input that comes in determines which system is being displayed by the dashboard with different settings through a <change> line in each, then shows the necessary information in a line graph. That part is working perfectly, but what I'm trying to do is set the color of the line graph based on the system chosen, and I'm trying to keep is simple for future edits. I've set the colors I'm currently using in the <init> section as follows:   <init> <set token="red">0xFF3333</set> <set token="purple">0x8833FF</set> <set token="green">0x00FF00</set> </init>   The system selection looks like this:   <input token="system" depends="$NotDisplayed$"> <change> <condition value="System-A"> <set token="index_filter">index_A</set> <set token="display_name">System-A</set> <set token="color">$purple$</set> </condition> <condition value="System-B"> <set token="index_filter">index_B</set> <set token="display_name">System-B</set> <set token="color">$green$</set> </condition> <condition value="System-C"> <set token="index_filter">index_C</set> <set token="display_name">System-C</set> <set token="color">$red$</set> </condition> </change> </input>     I now have a single query window putting up a line graph with the necessary information brought in from the eternal link. Like I said above, that part works perfectly, but what DOESN'T work is the color. Here's what my option field currently looks like:   <option name="charting.fieldColors">{"MyField":$color$}</option>     The idea here is if I add future systems, I don't have to keep punching in hex codes for colors, I just enter a color name token. Unfortunately, what ends up happening is the line graph color is black, no matter what color I use. If I take the $color$ token out of the code and put in the hex code directly it works fine. It also works if I put the hex code directly in the system selection instead of the color name token. Is there a trick to having a token reference another token in a dashboard? Or is this one of those "quit being fancy and do it the hard way" type of things? Any help will be appreciated. Running Splunk 8.2.4, in case it matters. ... View more