Thanks for pinging me.  @joemcmahon I haven't had many reasons to touch this app for quite  a while, but I'll try to assess how much work the upgrade would be to keep the app current.  No promises I can get to it this week, but I'll try soon.  Splunk is not really part of my regular work or hobby life anymore, so not something I put much focus on these days. ... View more

99% confident nothing like `mvcount` is going to give you that directly. Likely have to use custom JS, or write a hidden search that will determine that and runs every time the selection for your input has changed.  I'd suggest posting this as its own question. That will get more attention than putting it in the thread of answered question. ... View more

It probably depends on what the token represents. In the original answer, the example was asking for `mvcount` against a known field name. So, if the token you are passing is a field name and not a value of a field, then it would work. You'd have to give more specific data about your requests to get a more confident answer, but even then, I haven't been an active Splunk dev for quite some time. So everything I say might be off. ... View more

Splunk has decided to rework most of the JS / CSS setup in Splunk 7.2, and they broke both of the answers above in the process. Based on my cursory glance at things in 7.2 (which is a brief glance since I don't use Splunk often these days), my guess is you will have to make the CSS adjustment in JS. Look at the Splunk Dashboards Examples app (https://splunkbase.splunk.com/app/1603/). Open the source files and look at the dashboard custom_layout_width.xml and its accompanying JS file custom_layout_width.js . That serves as a simple example of how to adjust the width of panels. The gist is you have to find the dashboard-cell element that belongs to your panel, and then set the width setting for it. ... View more

So, of course, Splunk changed thins. The CSS you want is something like this (top line changed) #resize_input > .splunk-dropdown > div:nth-child(1) { width: 400px !important; max-width: 400px !important; min-width: 400px !important; } #resize_input { width: 400px !important; } Unfortunately, it appears you can't use this inline in the XML as you are currently trying. You will have to put the settings in a CSS file in the app and load that CSS file into the panel. See https://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/UseCSS ... View more

Can you post the XML for the dropdown input? It looks like the ids might be different resize_input versus resized_input . ... View more

They might have changed something that makes my old solution fail. Try this instead. Comes from something I posted here: https://gist.github.com/thibodux/408a685dc1a46af5f4f73f7c2922e47e <style> .input-dropdown > .splunk-dropdown > div { width: 100% !important; max-width: 100% !important; min-width: 100% !important; } #resized_input { width: 500% !important; } </style> You can also look at the Layer8Insight App for Splunk. I used to maintain that and change CSS widths all over it. ... View more

My answer above works for particular charts. ... View more

I feel your pain. Sadly, this is not the first nor will it likely be the last time breaking changes happen to app/UI related items for Splunk. Semantic versioning seems to only apply to under-the-hood indexing and search related things. Le sigh ... I wouldn't bet on it changing back. ... View more

Thank you. ... View more

what is the name of the column that contains the label "Total"? ... View more

The answer I can think of is it depends. In my mind, you would need to have a column that can label the horizontal row you want to exclude, e.g., exclude anything that belongs to the last row that has a label "Totals". Do you have any way of labeling the values you want to exclude? Or is it always the last value in the column? ... View more

I make it work using the methods I posted in the answer. If you are doing a Splunk search like timechart or chart that produces a hidden row called _span , then you can use the SimpleXML method I posted in the second part of my answer. You can also download my app (Layer8Insight App for Splunk, https://splunkbase.splunk.com/app/3171/) and see the many places in XML where I use this method, such as the example below. The first condition triggers when the user clicks a series in the chart (not legend) and not labelled "OTHER'. The second condition is triggered if the user clicks "OTHER" in the chart (not legend), and the final empty <condition> that does nothing will be hit if the user clicks on the legend. This app works on 6.4 and newer, so it does work for current versions of Splunk. <drilldown> <condition match="isnotnull('row._span') AND 'click.name2' != &quot;OTHER&quot;"> <eval token="form.dd_time.earliest">$earliest$ - 2*$row._span$</eval> <set token="form.dd_time.latest">$latest$</set> <set token="form.dd_filter_target_value">$click.name2$</set> <set token="set_dd_enabled">true</set> </condition> <condition match="isnotnull('row._span')"> <eval token="form.dd_time.earliest">$earliest$ - 2*$row._span$</eval> <set token="form.dd_time.latest">$latest$</set> <set token="form.dd_filter_target_value">*</set> <set token="set_dd_enabled">true</set> </condition> <condition></condition> </drilldown> ... View more

I am not sure what you are seeing or where you are putting your conig settings because I am not seeing what you see. First, let's define working. In your version of splunk, what time range do you get by default when you are on the Pivot creation screen that has the url path app/launcher/pivot ? This is the page the original question is referring to where it always seems to default to "All Time". Now, I just took your config settings and put them in user-prefs.conf under <SPLUNK_ROOT>/etc/system/local/ and in <SPLUNK_ROOT>/etc/users/admin/user-prefs/local on 6.4, 6.5, and 7.0 and there was no effect on the default search period of the Pivot creation page. In all cases I made the config changes, and then rebooted Splunk. No change to the Pivot creation page was observed. ... View more

Any more news or developments on this effort? ... View more

No, it doesn't appear to work. I am sorry but I am going to downvote the next answer that appears to be untested by the poster. These config changes are easily tested by the people suggesting them. Please save me the trouble of testing it or show proof that your suggestion does work for you and I must be doing something wrong. ... View more

Does not work for me. I put that stanza in <SPLUNK_ROOT>/etc/system/local/user-prefs.conf on Splunk 7.0.2, and still get All Time as the default search time for Pivot page. ... View more

Can you clarify what doesn't work or share more details about your search? My token example works fine for me. index= _internal earliest=-30d | fields _time | bucket _time span=1d | stats count as total by _time | streamstats avg(total) | sort -_time | eval day=strftime(_time,"%b %d, %y") | table day total avg(total) day| total | avg(total) Mar 05, 18|3349|85247.33333333333 Mar 03, 18|4107|101627 Feb 18, 18|66397|126007 Feb 17, 18|227887|145877 Feb 16, 18|171441|104872 Feb 15, 18|38303|38303 ... View more

I would agree with your findings. There is nothing in documentation that explicitly says it, but I deduce that prestatss=t only works when the data you are after is already in a TSIDX file, i.e., raw index or accelerated DM. If confirmed. That note should be made explicit in the docs. ... View more

You have to clear out the whole index ( bin\splunk clean eventdata ... ), or, more unsafely, delete the buckets/directories from the file system containing the bad data. As of now, there is no supporting of the delete command. See my rantings here: https://answers.splunk.com/answers/579720/should-metrics-indexes-support-overwriting-events-1.html ... View more

What you are seeing is a side-effect of what I posted here: https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html Basically, any token changes inside of the <change> block are immediate regardless of how you set searchWhenChanged . There is no built-in workaround in SimpleXML that doesn't require you changing how you do inputs. The only other option is implement the logic in JavaScript, which is probably overkill. ... View more

No, you cannot. You have to do some kind of workaround like I posted (e.g., the intermediary search) or write custom JavaScript. ... View more

Unforunately, there is no straightforward way to do what you want in SimpleXML. This is largely an issue because you cannot use the change element of the form inputs on the default token model (see my post here: https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html) There is a work-around you can do to accomplish what you want. It requires using a hidden search in the XML to set a token whenever the submit occurs. First, add a hidden search in your XML. You can put the search just before the fieldset element. What this search does is set a custom token search_start whenever both of your tokens are set and the submit button is clicked. Note, you need to use your specific token names. I assumed a token name for the region to just be region so update accordingly. Also, I assumed your timepicker does has a token name of time . Update this example reflect to your custom name if different. <search> <query>| gentimes start=-1 | eval token1 = $region|s$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <done> <set token="search_start">true</set> </done> </search> Now, you need to add a change handler to both the timepicker and the region inputs. The code is the same for both. It should look like this. Just copy and paste that into the definition of both input elements. This will reset the searh_start token any time either input is changed. <change> <unset token="search_start"/> </change> Lastly, use depends="$search_start$" on the panel elements you want to hide until the submit button is clicked. ... View more