Hi, does anyone know how to assign a colour to a category in the new timeline chart in dashboard studio 10.4? I have events: _time, resource, duration, category_name, category_integer when I try to use enable dynamic colouring and set the data field to category_integer, this field will also be used for duration. { "title": "timeline", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } }, "ds.spl2": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } }, "visualizations": { "global": { "showProgressBar": true } } }, "visualizations": { "viz_e1Pyphac": { "containerOptions": {}, "context": { "dataColorConfig": [ { "to": 25, "value": "#00FF00" }, { "from": 25, "to": 75, "value": "#FFFF00" }, { "from": 75, "value": "#FF0000" } ] }, "dataSources": { "primary": "ds_RuvYozgr" }, "options": { "additionalTooltipFields": [ "health_value", "eventcount" ], "category": "> primary | seriesByName('health_status')", "dataColors": "", "duration": "> primary | seriesByName('duration')", "legendDisplay": "bottom" }, "showLastUpdated": false, "showProgressBar": true, "type": "splunk.timeline" } }, "dataSources": { "ds_RuvYozgr": { "name": "Column chart search", "options": { "query": "| makeresults count=77\n| streamstats count\n| eval _time=relative_time(now(),\"@d\") + (count-1)*300\n| eval resource=\"server01\"\n| eval health_status=case(\n count<=75, \"ok\",\n count<=76, \"warn\",\n true(), \"crit\"\n)\n| sort - _time\n| transaction resource health_status maxpause=5m\n| eval duration=(duration+300)*1000\n| eval _time=_time\n| eval health_value=case(\n health_status=\"ok\", 100,\n health_status=\"warn\", 50,\n health_status=\"crit\", 0\n)\n| table _time resource duration health_status eventcount health_value\n| sort _time", "queryParameters": { "earliest": "-24h@h", "latest": "now", "sampleRatio": 1 } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_e1Pyphac", "position": { "h": 250, "w": 1440, "x": 0, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "options": {}, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } }, "applicationProperties": { "hideEdit": false, "hideExport": false } } ... View more

Hello, I've installed a Splunk Enterprise 10.4 into our lab to have a look at the new UI. It seems to be totally inconsistent; some apps use the new UI others the old one. Even within the main settings. "Add data" -> Old UI "Monitoring console" -> New UI "Knowledge - Catelog" -> 404 "Failed to retrieve paired tenant" "Knowledge - Search & Reports" -> New UI "Knowledge - Alert Actions" -> Old UI I've tested this with an instance upgraded from 10.2 and with a fresh install - identical results. Also some of our custom apps use New UI, some use the Old UI - I can't figure out what the difference is, are there any settings within an app you must set to get the New UI? I also installed some developed by Splunk apps from Splunkbase like IT Essentials Work and they also have mixed results. Anyone able to shed some light? Kind Regards, Andre   ... View more

Does anyone know if there’s somewhere a complete list of keyboard shortcuts cuts for the search SPL editor available? the once I came across so far are: CTRL + F CTRL + E CTRL + / ... View more

Hello, Veeam App for Splunk  how do you install/configure the Veeam App in a distributed environment? Search Head Cluster, Index Cluster and Heavy Forwarders behind Load balancer for Syslog. Do I have to install the App on Search Head / Heavy Forwarder and Indexers? What about Syslog going through a load balancer, will that impact the props/transforms I need? Kind Regards Andre ... View more

Hello, I have a single value panel in dashboard studio and would like to set all text to a specific colour (#212121) Not all text is taking the colour. Any idea what I am missing?   the "Days", "Hours", "Minutes" should be dark grey too.... {     "containerOptions": {         "visibility": {             "hideWhenNoData": true         }     },     "dataSources": {         "primary": "ds_YtjP8WZh"     },     "options": {         "align": "left",         "sparklineDisplay": "off",         "splitByLayout": "trellis",         "trellisBackgroundColor": "transparent",         "trellisColumns": 3,         "trellisMinColumnWidth": 10,         "trellisPageCount": 3,         "trellisSplitBy": "aggregations",         "trendDisplay": "off",         "majorColor": "#212121",         "backgroundColor": "transparent"     },     "title": "",     "type": "splunk.singlevalue",     "context": {},     "showProgressBar": false,     "showLastUpdated": false } Any help appreciated Thanks Andre ... View more

Hello, is there a way in Dashboard Studio to have filters per column? Similar to Microsoft Excel? like if I have a table with host, location and organisation headers, to easily filter on each column? Including multi select of column values?   kind regards  Andre ... View more

Hello, I have Database Connect setup and it's working all fine. But I can't wrap my head around how the Alert Action works.  The Alert action "Output results to databases" has no parameters - what am I missing? I have a DB table "test_table" with columns col1, col2 and want to setup | makeresults | eval col1 = "test", col2 = "result" as an alert that pushes the results into the "test_table". I would expect the Alert action to at least need to know what DB Output to use? Any help appreciated, Kind Regards Andre  ... View more