Hello, I've installed Splunk MCP Server in a distributed environment on a Search Head. When executing the get_indexes it only returns the list of default indexes not all indexes in the environment. As far as I can tell there is no difference between this environment and other working environments than the Splunk version 10.2 - not working, 10.6 working. I can't update yet.  I've done the basic checks, permissions, testing the endpoint manually. All looks good. Any idea where to start troubleshooting?  Kind Regards Andre ... View more

is it possible to customise the tool tip? We consider using this as a "Change Calendar" and would need some event specific details in the tool tip which won't fit into a simple text field. Also, some fields like the colour code or the unix stamps are too much for our audience. Something like tootip="<markdown>" or tooltip="<html>" as a complete overwrite for the default tooltip? Kind Regards, Andre  ... View more

Hi, does anyone know how to assign a colour to a category in the new timeline chart in dashboard studio 10.4? I have events: _time, resource, duration, category_name, category_integer when I try to use enable dynamic colouring and set the data field to category_integer, this field will also be used for duration. { "title": "timeline", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } }, "ds.spl2": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } }, "visualizations": { "global": { "showProgressBar": true } } }, "visualizations": { "viz_e1Pyphac": { "containerOptions": {}, "context": { "dataColorConfig": [ { "to": 25, "value": "#00FF00" }, { "from": 25, "to": 75, "value": "#FFFF00" }, { "from": 75, "value": "#FF0000" } ] }, "dataSources": { "primary": "ds_RuvYozgr" }, "options": { "additionalTooltipFields": [ "health_value", "eventcount" ], "category": "> primary | seriesByName('health_status')", "dataColors": "", "duration": "> primary | seriesByName('duration')", "legendDisplay": "bottom" }, "showLastUpdated": false, "showProgressBar": true, "type": "splunk.timeline" } }, "dataSources": { "ds_RuvYozgr": { "name": "Column chart search", "options": { "query": "| makeresults count=77\n| streamstats count\n| eval _time=relative_time(now(),\"@d\") + (count-1)*300\n| eval resource=\"server01\"\n| eval health_status=case(\n count<=75, \"ok\",\n count<=76, \"warn\",\n true(), \"crit\"\n)\n| sort - _time\n| transaction resource health_status maxpause=5m\n| eval duration=(duration+300)*1000\n| eval _time=_time\n| eval health_value=case(\n health_status=\"ok\", 100,\n health_status=\"warn\", 50,\n health_status=\"crit\", 0\n)\n| table _time resource duration health_status eventcount health_value\n| sort _time", "queryParameters": { "earliest": "-24h@h", "latest": "now", "sampleRatio": 1 } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_e1Pyphac", "position": { "h": 250, "w": 1440, "x": 0, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "options": {}, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } }, "applicationProperties": { "hideEdit": false, "hideExport": false } } ... View more

Hello, I've installed a Splunk Enterprise 10.4 into our lab to have a look at the new UI. It seems to be totally inconsistent; some apps use the new UI others the old one. Even within the main settings. "Add data" -> Old UI "Monitoring console" -> New UI "Knowledge - Catelog" -> 404 "Failed to retrieve paired tenant" "Knowledge - Search & Reports" -> New UI "Knowledge - Alert Actions" -> Old UI I've tested this with an instance upgraded from 10.2 and with a fresh install - identical results. Also some of our custom apps use New UI, some use the Old UI - I can't figure out what the difference is, are there any settings within an app you must set to get the New UI? I also installed some developed by Splunk apps from Splunkbase like IT Essentials Work and they also have mixed results. Anyone able to shed some light? Kind Regards, Andre   ... View more

Does anyone know if there’s somewhere a complete list of keyboard shortcuts cuts for the search SPL editor available? the once I came across so far are: CTRL + F CTRL + E CTRL + / ... View more