Splunk platform includes, for example: Splunk Enterprise, Splunk Cloud, etc.  Splunk apps include, for example: Splunk Enterprise Security, Splunk IT Service Intelligence, etc.  ... View more

There is no good way to do this and it really is backwards to general splunk philosophy of Show everybody everything . Your PS engineers during installation should have had a very serious conversation about index values and roles because these 2 things are the only tools that you have to limit access. PCI should not be in Splunk anyway, so nobody should care if anybody is poking around anywhere, unless he is ignoring his "real job". ... View more

I don't have a Splunk license so far. I think that it would be better if Splunk can have some way to receive potential bug report even without a Splunk license. ... View more

@johnvr, I just tried with your above examples and it works for me | makeresults |eval data="argc=2 a0=df a1=-iP,argc=3 a0=sh a1=-c a2=rpm -qp --queryformat '%{NAME} %{VERSION}-%{RELEASE}\012' /tmp/prod-lti-number.x86_64.rpm" |makemv data delim=","|mvexpand data |rex field=data "argc=\d+\s+(?<total_argument>.+)$"|rex field=total_argument mode=sed "s/a\d+=//g" ... View more

@johnvr, you can set a token during drilldown to value block , which can be applied to colorMode Simple XML option. The tokens for other Single Value panels can be set to none . I have used <init> section to default the tokens to none . Following is a run anywhere dashboard based on Splunk's _internal index. It has three Single Value Panels for Info, Warn and Error. Single Value colorBy option is set to trend for simplicity. Clicking on a Single Value panel sends the token to timechart which splits the count by Splunk components. <dashboard> <label>Single Value Block color on Drilldown</label> <init> <set token="infoColorMode">none</set> <set token="warnColorMode">none</set> <set token="errorColorMode">none</set> </init> <row> <panel> <single> <search> <query>index=_internal sourcetype=splunkd log_level="INFO" | timechart count</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">trend</option> <option name="colorMode">$infoColorMode$</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">Info</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="tokLogLevel">INFO</set> <set token="infoColorMode">block</set> <set token="warnColorMode">none</set> <set token="errorColorMode">none</set> </drilldown> </single> </panel> <panel> <single> <search> <query>index=_internal sourcetype=splunkd log_level="WARN" | timechart count</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">trend</option> <option name="colorMode">$warnColorMode$</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">inverse</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">Warning</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="tokLogLevel">WARN</set> <set token="infoColorMode">none</set> <set token="warnColorMode">block</set> <set token="errorColorMode">none</set> </drilldown> </single> </panel> <panel> <single> <search> <query>index=_internal sourcetype=splunkd log_level="ERROR" | timechart count</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">trend</option> <option name="colorMode">$errorColorMode$</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">inverse</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">Error</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="tokLogLevel">ERROR</set> <set token="infoColorMode">none</set> <set token="warnColorMode">none</set> <set token="errorColorMode">block</set> </drilldown> </single> </panel> </row> <row depends="$tokLogLevel$"> <panel> <title>Count of $tokLogLevel$ Log Level by Component</title> <chart> <search> <query>index=_internal sourcetype=splunkd log_level="$tokLogLevel$" | timechart count by component useother=f usenull=f limit=10 </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> </chart> </panel> </row> </dashboard> ... View more