Hello Splunkers In Single Value viz I know we can change text colour or background one at a time but I have a requirement to control both text and background colour in a single value visualisation for example IF result > 0       Text: #9c0006       Background: #ffc7c ELSE     Text: #006100     Background: #c6efce I'm using Splunk cloud so don't have the option to use JavaScript. Simple CSS solution is needed.     Any help will be appreciated    ... View more

Hello Splunkers I have a dropdown that calculates week_start for the last whole year. Then it has to pick "last_week" as default. I noticed that the dropdown, instead of remembering the label, adds the value to <default></default>  I've tried to calculate last_week as a token and added to <default></default>, which it picks up correctly.  But shows the epoch time in the dropdown instead of selecting the corresponding label "Last Week". Code for defining the dropdown search and initialising the token $last_week$: <fieldset submitButton="false"> <input type="dropdown" token="week"> <label>week</label> <fieldForLabel>time</fieldForLabel> <fieldForValue>start_time</fieldForValue> <search> <query>| makeresults count=52 | fields - _time | streamstats count | eval count=count-1 | eval start_time = relative_time(now(),"-".count."w@w+1d") | eval time = case(count==1, "Last week", count==0, "Current week", 1==1, strftime(start_time,"%a %d-%b-%Y")) | table time, start_time | eval start_time=round(start_time,0)</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>$last_week$</default> <initialValue>$last_week$</initialValue> </input> </fieldset> -- The token initialisation that calculates last week wrt now(): <init> <eval token="last_week">relative_time(now(),"-1w@w+1d")</eval> </init> ... View more

Hello wonderful Splunk community, I have some data where I want count to change only when status changes: Status   Count ------------------- Online      1 Online      1 Online     1 Break      2 Break       2 Online       3 Online       3 Lunch       4 Lunch        4 Lunch       4 Offline     5 Offline    5 Any help appreciated.  ... View more

I'm using Splunk Cloud so cannot upload css and js files as a self service thing.  When I use  <dashboard version="1.1" script="table_icons_inline.js" stylesheet="table_decorations.css"> from within the Dashboard Examples app (simple_xml_examples) it works fine. My question is that I want to use those js and css files from Dashboard Example apps in other apps too. I believe there should be some way to add those files providing relative paths. Like: <dashboard version="1.1" script="apps/simple_xml_examples/appserver/static/table_icons_inline.js" stylesheet="apps/simple_xml_examples/appserver/static/table_decorations.css"> Any ideas?? ... View more

Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as expected. Thanks ... View more