Hi niketnltay ,  anyone else.  Clearing my browser (Google Chrome)  catch leaves this working with my different dash board.   The pretty printing is very nice.  I cannot give a large exmple because of sensetive data but here is a small one.  Curious why you use the theme_utils from simple_xml_examples ...   Is that necessary ? Thanks!  ... View more

Hi niketnltay ,  Hoping you are back from Holiday and can give me some guidance.   See my just prior comment.  I'm getting error messages and doesn't do Pretty Print.    Text Error messages are below.   Jim  ======================================================= Error message in Chrome from answer board code: VM578:1903 GET http://padv06gf06ski01.npac.ics.iconectiv.com:8000/en-US/vendor/splunk/etc/app/simple_xml_examples/theme_utils.js net::ERR_ABORTED 404 (Not Found) req.load @ VM578:1903 load @ VM578:1647 load @ VM578:828 fetch @ VM578:818 check @ VM578:848 enable @ VM578:1151 enable @ VM578:1519 eval @ VM578:1136 eval @ VM578:132 each @ VM578:57 enable @ VM578:1098 init @ VM578:782 eval @ VM578:1424 setTimeout (async) req.nextTick @ VM578:1763 localRequire @ VM578:1413 requirejs @ VM578:1745 shimmedRequirejsRequire @ dashboard.js:1335 eval @ VM615:15 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 done @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 load (async) send @ dashboard.js:1308 ajax @ dashboard.js:1308 _getScript @ dashboard.js:1335 _loadScript @ dashboard.js:1335 _loadExtension @ dashboard.js:1335 loadScriptExtension @ dashboard.js:1335 loadDefaultExtensions @ dashboard.js:1335 applyCustomExtension @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1397 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 createVisualization @ dashboard.js:1397 later @ dashboard.js:1335 setTimeout (async) (anonymous) @ dashboard.js:1335 render @ dashboard.js:1397 (anonymous) @ dashboard.js:1397 render @ dashboard.js:1397 (anonymous) @ dashboard.js:1397 _addElement @ dashboard.js:1397 addChild @ dashboard.js:1397 addChildToContainer @ dashboard.js:1335 materializeComponent @ dashboard.js:1335 materializeComponentFn @ dashboard.js:1335 (anonymous) @ dashboard.js:1335 _.map._.collect @ dashboard.js:1335 _.<computed> @ dashboard.js:1335 materializeComponents @ dashboard.js:1335 materialize @ dashboard.js:1335 applyDashboardStructure @ dashboard.js:1335 later @ dashboard.js:1335 setTimeout (async) (anonymous) @ dashboard.js:1335 triggerEvents @ dashboard.js:840 trigger @ dashboard.js:840 set @ dashboard.js:840 parseDashboardXML @ dashboard.js:1335 enter @ dashboard.js:1335 _handleModeChange @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 handleModeChange @ dashboard.js:1335 triggerEvents @ dashboard.js:840 trigger @ dashboard.js:840 set @ dashboard.js:840 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:840 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:840 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 (anonymous) @ dashboard.js:840 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 done @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 load (async) send @ dashboard.js:1308 ajax @ dashboard.js:1308 Backbone.ajax @ dashboard.js:840 Backbone.sync @ dashboard.js:840 sync @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 (anonymous) @ dashboard.js:1335 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 options.success @ dashboard.js:840 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 done @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 load (async) send @ dashboard.js:1308 ajax @ dashboard.js:1308 Backbone.ajax @ dashboard.js:840 Backbone.sync @ dashboard.js:840 sync @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 bootstrapAppLocals @ dashboard.js:1335 $whenPageViewDependencies @ dashboard.js:1335 $whenPageViewDependencies @ dashboard.js:1335 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 page @ dashboard.js:1335 view @ dashboard.js:1335 execute @ dashboard.js:840 (anonymous) @ dashboard.js:840 (anonymous) @ dashboard.js:840 _.some._.any @ dashboard.js:1335 loadUrl @ dashboard.js:840 start @ dashboard.js:840 exports.start_backbone_history @ dashboard.js:1397 (anonymous) @ dashboard.js:263 418 @ dashboard.js:263 __webpack_require__ @ dashboard.js:1 (anonymous) @ dashboard.js:1 (anonymous) @ dashboard.js:1 Show 121 more frames VM578:166 Uncaught Error: Script error for: theme_utils http://requirejs.org/docs/errors.html#scripterror at makeError (eval at module.exports (dashboard.js:685), <anonymous>:166:17) at HTMLScriptElement.onScriptError (eval at module.exports (dashboard.js:685), <anonymous>:1689:36)   ... View more

niketnltay : I am trying to adapt the xml pretty print for an application and am having issues.   One head note, he line from your post: | eval xmlData="<Call><splunk>201</splunk><Time>4547554</Time></Call>;<Call><script>201</script><callId>IND00900</callId></Call>" Will not go in for me in that for because the  xml tags in it get taken as Simple XML tags, and I get an error message that <query>  can't have children.  I was able to fix this by changing "<" and ">" to html tags like: | eval xmlData="&lt;Call&gt;&lt;splunk&gt;201&lt;/splunk&gt;&lt;Time&gt;4547554&lt;/Time&gt;&lt;/Call&gt;:&lt;Call&gt;&lt;script&gt;201&lt;/script&gt;&lt;callId&gt;IND00900&lt;/callId&gt;&lt;/Call&gt;" This works for getting the XML in, but then I don't get the pretty printing and see errors in google chrome's  developer tools.    I see very similar java script working for other Simple XML dashboards examples.  using the theme utils for example:   In the Table Cell Highlighting Example require.config({ paths: { theme_utils: '../app/simple_xml_examples/theme_utils' } }); I am wondering  if this is happening because of a change in Splunk version or simple XML examples  version.  Both Splunk Versions and Splunk Dashboard Example are version 8.2.0 .  I'm getting very similar errors on a simple XML script that pulls log data into xmlData Field .    _Your help greatly appreciated ! _    Jim Deich Text Version of those errors: VM578:1903 GET http://padv06gf06ski01.npac.ics.iconectiv.com:8000/en-US/vendor/splunk/etc/app/simple_xml_examples/theme_utils.js net::ERR_ABORTED 404 (Not Found) req.load @ VM578:1903 load @ VM578:1647 load @ VM578:828 fetch @ VM578:818 check @ VM578:848 enable @ VM578:1151 enable @ VM578:1519 eval @ VM578:1136 eval @ VM578:132 each @ VM578:57 enable @ VM578:1098 init @ VM578:782 eval @ VM578:1424 setTimeout (async) req.nextTick @ VM578:1763 localRequire @ VM578:1413 requirejs @ VM578:1745 shimmedRequirejsRequire @ dashboard.js:1335 eval @ VM615:15 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 done @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 load (async) send @ dashboard.js:1308 ajax @ dashboard.js:1308 _getScript @ dashboard.js:1335 _loadScript @ dashboard.js:1335 _loadExtension @ dashboard.js:1335 loadScriptExtension @ dashboard.js:1335 loadDefaultExtensions @ dashboard.js:1335 applyCustomExtension @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1397 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 createVisualization @ dashboard.js:1397 later @ dashboard.js:1335 setTimeout (async) (anonymous) @ dashboard.js:1335 render @ dashboard.js:1397 (anonymous) @ dashboard.js:1397 render @ dashboard.js:1397 (anonymous) @ dashboard.js:1397 _addElement @ dashboard.js:1397 addChild @ dashboard.js:1397 addChildToContainer @ dashboard.js:1335 materializeComponent @ dashboard.js:1335 materializeComponentFn @ dashboard.js:1335 (anonymous) @ dashboard.js:1335 _.map._.collect @ dashboard.js:1335 _.<computed> @ dashboard.js:1335 materializeComponents @ dashboard.js:1335 materialize @ dashboard.js:1335 applyDashboardStructure @ dashboard.js:1335 later @ dashboard.js:1335 setTimeout (async) (anonymous) @ dashboard.js:1335 triggerEvents @ dashboard.js:840 trigger @ dashboard.js:840 set @ dashboard.js:840 parseDashboardXML @ dashboard.js:1335 enter @ dashboard.js:1335 _handleModeChange @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 handleModeChange @ dashboard.js:1335 triggerEvents @ dashboard.js:840 trigger @ dashboard.js:840 set @ dashboard.js:840 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:840 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:840 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 (anonymous) @ dashboard.js:840 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 done @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 load (async) send @ dashboard.js:1308 ajax @ dashboard.js:1308 Backbone.ajax @ dashboard.js:840 Backbone.sync @ dashboard.js:840 sync @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 (anonymous) @ dashboard.js:1335 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 Deferred.jQuery.each.deferred.<computed> @ dashboard.js:1308 (anonymous) @ dashboard.js:1335 options.success @ dashboard.js:840 fire @ dashboard.js:1308 fireWith @ dashboard.js:1308 done @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 load (async) send @ dashboard.js:1308 ajax @ dashboard.js:1308 Backbone.ajax @ dashboard.js:840 Backbone.sync @ dashboard.js:840 sync @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 fetch @ dashboard.js:840 bootstrapAppLocals @ dashboard.js:1335 $whenPageViewDependencies @ dashboard.js:1335 $whenPageViewDependencies @ dashboard.js:1335 (anonymous) @ dashboard.js:1335 (anonymous) @ dashboard.js:1308 fire @ dashboard.js:1308 add @ dashboard.js:1308 (anonymous) @ dashboard.js:1308 each @ dashboard.js:1297 (anonymous) @ dashboard.js:1308 Deferred @ dashboard.js:1308 then @ dashboard.js:1308 page @ dashboard.js:1335 view @ dashboard.js:1335 execute @ dashboard.js:840 (anonymous) @ dashboard.js:840 (anonymous) @ dashboard.js:840 _.some._.any @ dashboard.js:1335 loadUrl @ dashboard.js:840 start @ dashboard.js:840 exports.start_backbone_history @ dashboard.js:1397 (anonymous) @ dashboard.js:263 418 @ dashboard.js:263 __webpack_require__ @ dashboard.js:1 (anonymous) @ dashboard.js:1 (anonymous) @ dashboard.js:1 Show 121 more frames VM578:166 Uncaught Error: Script error for: theme_utils http://requirejs.org/docs/errors.html#scripterror at makeError (eval at module.exports (dashboard.js:685), <anonymous>:166:17) at HTMLScriptElement.onScriptError (eval at module.exports (dashboard.js:685), <anonymous>:1689:36)         ... View more

Thanks for the thought.  A possible solution.  I'll update.   I had hoped I could just get strptime to skip around the stuff between the secs part of the epoch time and the ms part, TIME_FORMAT = %s,\"timestamp_ms\":%6N,  but that did not work -- You can put slashes colon and other punctuation in there but I guess no strings.  I also tried fixing the time stamp to a pure seconds and ms part doing a rewrite with SEDCMD, that worked to re-write the record,  but did not fix the time stamp which is determined before.  ... View more

I don't think I have previously had a post up for this long and gotten no answers.   PLEASE !  ... View more

Please help !   I normall get help after posting.  This is an important issue for us.  ... View more

hos_2 , I have used time_stamp recognition before, but never in a case where there were intermixed formats like this, one with millisec and one without. Did you specify a single Format in your case? Does just showing a format with .%q force all to have millisecs. I will try it. Thanks for the reply ! ... View more

Thanks, will be looking it over later today. ... View more

This is helpful but we are still not quite in alignment on the basic problem. The table field I am concerned with already has newline characters similar to the _raw you created. The issue is that the table renderer in creating a web view of the table temporarily removes or ignores these new lines so the JSON looses it's pretty print formatting. example as the cell might look in the table: { "header" : { "initiatorSuppression" : false, "Id" : 311048, "messageType" : "REPLY", "originationId" : "vxx", "originationTs" : "2017-10-30T03:30:06.828Z", "originationType" : "XML", "primaryCust" : "XHP3", "receivedTs" : "2017-10-30T03:30:06.886Z" }, "Reply" : { "Type" : "ObjectAttributeValueChange", "xmlBasicCode" : "success" } } just wrapped, not pretty printed. The answer you referenced adds some space before the cell, cool, but not my main issue. I want this change is for readability. Too many different fields in the JSONS to code for how to specifically handle them. Short term, I do not need to go from JSON field to Splunk field by using spath. Sorry I would have send screen shots, but some stuff is proprietary. Basically, I just need the dispaly to honor formatting already there. Thanks again. ... View more

Niket, anyone, Here is sample data with the json pretty print: "{ ""header"" : { ""messageCategory"" : ""request"", ""messageType"" : ""MESSAGE_RESEND"", ""originationId"" : ""nightly-resend"", ""originationType"" : ""ADMIN"", ""receivedTs"" : ""2017-10-30T03:30:01.025Z"" }, ""requestCP"" : { ""ObjId"" : 1770418, ""targetList"" : [ { ""serviceId"" : ""cap5"" } ] } }" There are some extra quotes there due to csv export. So in this case, I would want to see the JSON this way in a table cell. The data export to csv files this way. So the formatting via crlf is still in the table data, just supressed. The code for the table just flattens this into a long unpretty line that is folded and that's what I need to fix. I don't want to remove any content, just to have the cr/lf that give the JSON formatting its structure maintained in table display. Probably with html/css / java script modification. The data is from a simple XML dashboard. Just looking for help, or possibly someone that has already done this. Thanks! Jim ... View more

Thanks much! I am in process of trying this. I have a similar case with some JSONs. I also was able to get pretty printing via using fairly ugly sedcmds to turn the whole log into a single XML expression. ... View more

I would like to be able to do the same sort of thing. Replicate data within a cluster only for some indexes. So some indexes get copies only within sites, and some between sites. I am hoping this may have changed since the post. There is a indexes.conf parameter that allow you to specify the number of replicated copies, but not where. this is repFactor . An example is below. [npac_misc] coldPath = $SPLUNK_DB/npac_misc/colddb homePath = $SPLUNK_DB/npac_misc/db thawedPath = $SPLUNK_DB/npac_misc/thaweddb repFactor = auto ... View more

I like this approach and am implementing it, but I have noticed one wrinkle/issue. The times delivered in the XML form will be client times (usually laptop) and will be offset by the time zone of the client (not the server time, not Splunk Time for the user). The strftime function makes it possible to find the offset of the client time zone (in my current case -400, EDT vs UTC), but not easily do the math to convert to UTC. I have a developing work-around I will post but wonder if anyone has run into this and has something neat. (adding twice so comment goes to brunton2 ) ... View more

This also makes no sense to me. When the manual says "DB Connect 3 does not support scheduled inputs and outputs in a search head cluster deployment. Splunk recommends that you run scheduled inputs and outputs from a heavy forwarder." . Does that mean that you cannot run reports using dbxquery from a search head cluster on a scheduled basis? I can understand that you might not be able to run a cron there that pushes data into splunk, but just running a query that connect the db make little sense. Neither does moving that function to a Heavy Forwarder. Heavy forwarder typically send data to indexers, and are not used for reporting. The manual needs to be clearer on this. ... View more

This looks very promising, but I can't find the relevent section of flashtimeline.xml in the "default" dir. My guess is they have changed how this is done. This is versin 6.5 . ... View more

I have had just the indexing test work well. Not the full test. ... View more