Hi @anthonyi Are you using an on-premise or Splunk Cloud environment? If you're using Splunk Cloud:  In the Splunk UI, go to Settings -> sourcetypes. Find/click the sourcetype you want to restrict the length of, then click the "Advanced" tab. If there is already a "TRUNCATE" value then update this to 2000 and hit save. If there isnt then click "New Setting" at the bottom and then enter TRUNCATE for the name and 2000 for the value. If you are running on-premise then its unlikely you'll be able to make the changes in this way unless you are using a all-in-one instance, which generally wouldnt be used for production. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Apologies @robertlynch2020  - I overlooked this - even we extracted it! Lets try again:     | windbag | head 1 | eval _raw="{\"resourceSpans\":[{\"resource\":{\"attributes\":[{\"key\":\"service.name\",\"value\":{\"stringValue\":\"trade-blotter\"}},{\"key\":\"service.namespace\",\"value\":{\"stringValue\":\"trade-blotter-public\"}}]},\"scopeSpans\":[{\"spans\":[{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"abc123\",\"name\":\"referenceDataBuildClient\",\"startTimeUnixNano\":\"1746628424928265438\",\"endTimeUnixNano\":\"1746628424928267680\"},{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"def456\",\"name\":\"readLiveQuery\",\"startTimeUnixNano\":\"1746628424928290524\",\"endTimeUnixNano\":\"1746628424928301728\"}]}]}]}" ``` main section of query below ``` | spath resourceSpans{}.resource.attributes{} output=resourceAttributes | eval service_name=mvfilter(match(resourceAttributes,".*service.name\"")) | eval service_namespace=mvfilter(match(resourceAttributes,".*service.namespace")) | foreach service_name* [| eval <<FIELD>>=json_extract(json_extract(<<FIELD>>,"value"),"stringValue") ] | spath resourceSpans{}.scopeSpans{}.spans{} output=scopeSpans | stats count by scopeSpans, service_namespace | spath input=scopeSpans | rename startTimeUnixNano as start | rename endTimeUnixNano as end | eval _time=start/pow(10,9) | eval duration = end -start | eval duration= duration/1000000 | eval duration = round(duration,0) | eval parentSpanId =if(parentSpanId="" ,"0", $parentSpanId$) | rename name as SPAN_TYPE | search traceId = 61df555eabf3b66cd8933809f00e409f | table _time SPAN_TYPE spanId service_namespace duration | sort _time 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Tafadzwa  I'm pleased to be of help. Please consider marking my previous post as the accepted answer and adding Karma so other users finding this issue can see the solution. Thanks ... View more

Hi @kevinj  This app is managed by Akamai - you would need to reach out to their support team via support@akamai.com to request this as they may not be monitoring this forum. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @koshyk  I did a PoC with a customer around this a few months ago and we had great success using the regular saved/search endpoint to create searches from a custom app created with contentctl.  We used a custom app which we uploaded the searches into, this way we are following the same pattern as creating a custom app from contentctl which would be uploaded.  ES rules are essentially scheduled searches, with modular alerts, they just show in ES because of some of the settings in them, from memory these might be action.correlationsearch.* and action.notable.param.* settings.  I think the main gotcha that caught is out is that in the savedsearches.conf we use "enabledSched = 1" to schedule a search, however the API expects "is_scheduled =1" (WHY?!?) Check my response below to the following post which has a sample python code to upload a savedsearch if it helps - https://community.splunk.com/t5/All-Apps-and-Add-ons/Custom-app-in-cloud/m-p/745079 @livehybrid wrote: Hi @hazardoom  If you arent wanting to go down the app route then another thing you could look at it is using the REST API.  Ive used this with clients in the past, here is an example to get your started if this is something you wanted to explore: import configparser import requests from urllib.parse import quote # ======= USER CONFIGURATION ========= SPLUNK_HOST = 'https://yoursplunkhost:8089' # e.g., https://localhost:8089 SPLUNK_TOKEN = 'your-token-here' # just the token string, no 'Splunk ' prefix APP = 'search' # target app for the saved searches CONF_FILE = 'savedsearches.conf' # path to your savedsearches.conf file VERIFY_SSL = True # set to False if using self-signed certs USERNAME = 'yourUsername' # API requires this as a path component # ==================================== # Map conf fields to REST API fields def convert_field_name(field, value): """Map .conf fields to API fields and perform value translations.""" if field == "enableSched": return "is_scheduled", "1" if value.strip().lower() in ("1", "true", "yes", "on") else "0" return field, value def load_savedsearches(conf_path): cp = configparser.ConfigParser(strict=False, delimiters=['=']) cp.optionxform = str # preserve case and case sensitivity cp.read(conf_path) return cp def upload_savedsearches(cp): headers = {'Authorization': f'Splunk {SPLUNK_TOKEN}'} base_url = f"{SPLUNK_HOST}/servicesNS/{USERNAME}/{APP}/saved/searches" for savedsearch_name in cp.sections(): data = {'name': savedsearch_name} for field, value in cp[savedsearch_name].items(): api_field, api_value = convert_field_name(field, value) data[api_field] = api_value search_url = f"{base_url}/{quote(savedsearch_name)}" # Check if the saved search exists (GET request) check = requests.get(search_url, headers=headers, verify=VERIFY_SSL) if check.status_code == 200: print(f"Updating existing savedsearch: {savedsearch_name}") r = requests.post(search_url, data=data, headers=headers, verify=VERIFY_SSL) else: print(f"Creating new savedsearch: {savedsearch_name}") r = requests.post(base_url, data=data, headers=headers, verify=VERIFY_SSL) if r.status_code not in (200, 201): print(f"Failed for {savedsearch_name}: {r.status_code} {r.text}") else: print(f"Success: {savedsearch_name}") def main(): cp = load_savedsearches(CONF_FILE) upload_savedsearches(cp) if __name__ == "__main__": main() We use this approach to upload file direct from Git pipelines which is especially useful if you arent an admin on the platform so cannot upload an app - however may also work well for your usecase. Note: you could use the Splunk Python SDK too, which basically does the same thing. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing     ... View more

Hi @robertlynch2020  I think the following might work?   Full SPL with sample data below: | windbag | head 1 | eval _raw="{\"resourceSpans\":[{\"resource\":{\"attributes\":[{\"key\":\"service.name\",\"value\":{\"stringValue\":\"trade-blotter\"}},{\"key\":\"service.namespace\",\"value\":{\"stringValue\":\"trade-blotter-public\"}}]},\"scopeSpans\":[{\"spans\":[{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"abc123\",\"name\":\"referenceDataBuildClient\",\"startTimeUnixNano\":\"1746628424928265438\",\"endTimeUnixNano\":\"1746628424928267680\"},{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"def456\",\"name\":\"readLiveQuery\",\"startTimeUnixNano\":\"1746628424928290524\",\"endTimeUnixNano\":\"1746628424928301728\"}]}]}]}" | spath resourceSpans{}.resource.attributes{} output=resourceAttributes | eval service_name=mvfilter(match(resourceAttributes,".*service.name\"")) | eval service_namespace=mvfilter(match(resourceAttributes,".*service.namespace")) | foreach service_name* [| eval <<FIELD>>=json_extract(json_extract(<<FIELD>>,"value"),"stringValue") ] | spath resourceSpans{}.scopeSpans{}.spans{} output=scopeSpans | stats count by scopeSpans | spath input=scopeSpans | rename startTimeUnixNano as start | rename endTimeUnixNano as end | eval _time=start/pow(10,9) | eval duration = end -start | eval duration= duration/1000000 | eval duration = round(duration,0) | eval parentSpanId =if(parentSpanId="" ,"0", $parentSpanId$) | rename name as SPAN_TYPE | search traceId = 61df555eabf3b66cd8933809f00e409f | table _time SPAN_TYPE spanId duration | sort _time 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Tafadzwa  If you download the "Splunk App for Content Packs" and then once installed, from the ITSI main menu, click Configuration > Data Integrations. Select Add content packs or Add structure to your data depending on your version of ITSI. From here you should see the AppDynamics Content Pack. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @ArunkumarKarmeg  Sorry missed the last reply but I'm pleased you got it working!  Ye - in terms of APIs it doesnt make a lot of sense to have to query all users - If you have lots of users then this would be a lot of API calls just to get the groups. You'd think you would be able to get the role from a user list, or the user list from a role! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @bill  If you're looking to see if the user is a Workflows Administrator then the following should work: | eval isAdmin=IF(typeof(mvfind('target{}.displayName', "Workflows Administrator"))=="Number","Yes","No") 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @dflynn235  Were you able to try the search I provided?  Im happy to help work through this if theres an issue with this approach. @livehybrid wrote: Hi @dflynn235  Does the following do what you are looking for?  | eval status=case(searchmatch("has gone down"),"Down",searchmatch("is up"),"Up",true(),"Unknown") | rex "on interface (?<iface>[a-zA-Z0-9]+)" | stats range(_time) as downTime latest(status) as latestStatus by iface | where downTime>60 Here is a working example with sample data, just add the | where to limit as required. | makeresults count=1 | eval _raw="2025-05-07T07:20:40.482713-04:00 \"switch_name\" : 2025 May 7 07:20:40 EDT: %BFD-5-SESSION_STATE_DOWN: BFD session 1124073489 to neighbor \"IP Address\" on interface Vlan43 has gone down. Reason: Administratively Down." | eval host="switch_name" | append [| makeresults count=1 | eval _raw="2025-05-07T07:20:41.482771-04:00 \"switch_name\" : 2025 May 7 07:20:41 EDT: %BFD-5-SESSION_STATE_UP: BFD session 1124073489 to neighbor \"IP Address\" on interface Vlan43 is up." | eval host="switch_name"] | rex "^(?<timeStr>[^\s]+)" | eval _time=strptime(timeStr,"%Y-%m-%dT%H:%M:%S.%6N%Z") | eval status=case(searchmatch("has gone down"),"Down",searchmatch("is up"),"Up",true(),"Unknown") | rex "on interface (?<iface>[a-zA-Z0-9]+)" | stats range(_time) as downTime latest(status) as latestStatus by iface 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing       ... View more

Hi @ishan_kumra  I believe you have to wait 24 hours after verifying your email address for your Splunk.com account before it allows you to redeem courses. Has it been 24 hours since creating you account?  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @u_m1580  I would look at using a tstats search as this will be more performant when there is data in the index. Something simple such as: |tstats count where index=<yourIndex> Then you can alert where count=0, or add a | where count>0 and alert when there are no results. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

HI @tech_g706  Im not sure why data from last week would be going to archive, this might be something you need to speak to Splunk support about, however regarding the retrieval of the archive data then if this is in DDAA then you can temporarily restore it but I dont think its possible to keep it restored. I would speak to Splunk Support - if there has been an issue which has caused the data to archive prematurely then they may be able to have it restored for you, but it isnt something that you'd be able to do yourself. If you update the Max size via the GUI it will replicate the configuration to the relevant components within the Splunk Cloud stack - you do not need to worry so much about how/where it goes 🙂 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Numb78  Im not sure this config will take effect, because SC4S uses the /event endpoint (unless you have overwritten this?) This blog article from Splunk  states "We want to ensure this is properly parsed before it gets to Splunk, as timestamp processing is bypassed (by default) with the /event HEC endpoint used by SC4S." I think there must be a configuration on the SC4S that needs applying which is different between the TCP and UDP ingestion.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @msatish  It looks like you need to "Rebuild Forwarder Assets". This can be done by going to Cloud Monitoring Console > Forwarders > Forwarder Monitoring Setup. and clicking on the "Rebuild Forwarder Assets" button. I'd also recommend checking out the Review the Forwarder Monitoring Setup page docs which has more info about this and how to view/manage your forwarders via the CMC. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Here are the download links which may also help: 8.0.10: https://download.splunk.com/products/universalforwarder/releases/8.0.10/linux/splunkforwarder-8.0.10-9f06f1f5a2e9-Linux-x86_64.tgz https://download.splunk.com/products/universalforwarder/releases/8.0.10/linux/splunkforwarder-8.0.10-9f06f1f5a2e9-linux-2.6-x86_64.rpm https://download.splunk.com/products/universalforwarder/releases/8.0.10/linux/splunkforwarder-8.0.10-9f06f1f5a2e9-linux-2.6-amd64.deb  7.3.9: https://download.splunk.com/products/universalforwarder/releases/7.3.9/linux/splunkforwarder-7.3.9-39a78bf1bc5b-linux-2.6-x86_64.rpm https://download.splunk.com/products/universalforwarder/releases/7.3.9/linux/splunkforwarder-7.3.9-39a78bf1bc5b-linux-2.6-amd64.deb https://download.splunk.com/products/universalforwarder/releases/7.3.9/linux/splunkforwarder-7.3.9-39a78bf1bc5b-Linux-x86_64.tgz 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @AsmaF2025  Yes those documents are labelled Splunk Enterprise however the upgrade paths for UF and full enterprise install are the same due to shared components which require updating such as fishbucket and config migration etc. There is a lot more in common between UF and full enterprise install than people often think. The main obvious difference is that Enterprise includes Python and Mongo DB.  Nevertheless the upgrade paths are the same.      🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @AsmaF2025  According to the documentation we must install 7.1.x before upgrading to 8.0.x - See https://docs.splunk.com/Documentation/Splunk/8.0.10/Installation/HowtoupgradeSplunk#:~:text=and%20release%20notes.-,Upgrade%20paths%20to%20version%208.0,-The%20following%20table Personally I have achieved this upgrade directly previously however it has been discussed on here before that there are a bunch of different things such as fishbucket etc which get upgraded along the way and therefore you should follow the documented upgrade path. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @shawngsharp  Further to my last post, you could also use: |foreach * [eval field_matches = mvappend(field_matches, if(match(<<FIELD>>, "(?i)widget"), "<<FIELD>>", null()))] | eval field_matches=mvfilter(NOT match(field_matches,"my_field_42")) | where field_matches!="" Where your string match is inside the match statement, this works by looking in each field and then creating a multi-value field of all the fields which match, then removing my_field_42 and searching where there is one or more fields that match.   |makeresults format=csv data="my_field1, my_field_2, my_field_23, my_field_42 \"hello world\",\"AwesomeWidget69\",\"\",\"your mom\" \"hello world\",\"\",\"Widgets are cool\",\"Look, a widget!\" \"hello world\",\"\",\"Some value here\",\"your widget\"" |foreach * [eval field_matches = mvappend(field_matches, if(match(<<FIELD>>, "(?i)widget"), "<<FIELD>>", null()))] | eval field_matches=mvfilter(NOT match(field_matches,"my_field_42")) | where field_matches!="" 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @shawngsharp  So I think I know what you're looking for - you dont want it to match if *only* my_field_42 contains the string? So it must be in one of the other fields? You could try this - Im not sure how performant it will be at scale but working for me: index=YourIndex *widget* | tojson | eval orig_field_42=json_extract(_raw,"my_field_42") | eval _raw=json_delete(_raw,"my_field_42") | search *widget* | eval _raw=json_set(_raw,"my_field_42",orig_field_42) This works by temporarily removing the my_field_42 from the results before applying a secondary search - Ive gone with "tojson" which converts all the fields into json object in _raw.  Below is a sample query if it helps: |makeresults format=csv data="my_field1, my_field_2, my_field_23, my_field_42 \"hello world\",\"AwesomeWidget69\",\"\",\"your mom\" \"hello world\",\"\",\"Widgets are cool\",\"Look, a widget!\" \"hello world\",\"\",\"Some value here\",\"your widget\"" | tojson | eval orig_field_42=json_extract(_raw,"my_field_42") | eval _raw=json_delete(_raw,"my_field_42") | search *widget* 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Glasses2  Im glad you managed to fix your mongo issue - Not the first time SSL expiry has caught people out! There is an app "SSL Certificate Checker" on Splunkbase at https://splunkbase.splunk.com/app/3172 which looks to solve this. You configure it with the path of the certificates you wish to monitor on a Splunk host and it reports the expiry into Splunk for you to create an alert for. Setting up for /opt/splunk/etc/auth/ should capture most things unless you have other custom certs in use. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @dflynn235  Does the following do what you are looking for?  | eval status=case(searchmatch("has gone down"),"Down",searchmatch("is up"),"Up",true(),"Unknown") | rex "on interface (?<iface>[a-zA-Z0-9]+)" | stats range(_time) as downTime latest(status) as latestStatus by iface | where downTime>60 Here is a working example with sample data, just add the | where to limit as required. | makeresults count=1 | eval _raw="2025-05-07T07:20:40.482713-04:00 \"switch_name\" : 2025 May 7 07:20:40 EDT: %BFD-5-SESSION_STATE_DOWN: BFD session 1124073489 to neighbor \"IP Address\" on interface Vlan43 has gone down. Reason: Administratively Down." | eval host="switch_name" | append [| makeresults count=1 | eval _raw="2025-05-07T07:20:41.482771-04:00 \"switch_name\" : 2025 May 7 07:20:41 EDT: %BFD-5-SESSION_STATE_UP: BFD session 1124073489 to neighbor \"IP Address\" on interface Vlan43 is up." | eval host="switch_name"] | rex "^(?<timeStr>[^\s]+)" | eval _time=strptime(timeStr,"%Y-%m-%dT%H:%M:%S.%6N%Z") | eval status=case(searchmatch("has gone down"),"Down",searchmatch("is up"),"Up",true(),"Unknown") | rex "on interface (?<iface>[a-zA-Z0-9]+)" | stats range(_time) as downTime latest(status) as latestStatus by iface 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing     ... View more

Hi @abhishekP  This is an interesting one. When selecting a relative time window the earliest/latest are values like "-1d@d" which are valid for the earliest/latest field in a search - however when you select specific dates/between dates etc then it returns the full date string such as "2025-05-07T18:47:22.565Z" Such a value is not supported by the earliest/latest field in a Splunk search, to get around this I have put together a table off the side of the display with a search which converts dates into epoch where required. you can then use "$timetoken:result.earliest_epoch$" and "$timetoken:result.latest_epoch$" as tokens in your other searches like this:   Below is the full JSON of the dashboard so you can have a play around with it - hopefully this helps! { "title": "testing", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_2FDRkepv": { "dataSources": { "primary": "ds_IPGx8Y5Y" }, "options": {}, "type": "splunk.events" }, "viz_V1oldcrB": { "options": { "markdown": "earliest: $global_time.earliest$ \nlatest: $global_time.latest$ \nearliest_epoch: $timetoken:result.earliest_epoch$ \nlatest_epoch:$timetoken:result.latest_epoch$" }, "type": "splunk.markdown" }, "viz_bhZcZ5Cz": { "containerOptions": {}, "context": {}, "dataSources": { "primary": "ds_KXR2SF6V" }, "options": {}, "showLastUpdated": false, "showProgressBar": false, "type": "splunk.table" } }, "dataSources": { "ds_IPGx8Y5Y": { "name": "timetoken", "options": { "enableSmartSources": true, "query": "| makeresults \n| eval earliest=$global_time.earliest|s$, latest=$global_time.latest|s$\n| eval earliest_epoch = IF(match(earliest,\"[0-9]T[0-9]\"),strptime(earliest, \"%Y-%m-%dT%H:%M:%S.%3N%Z\"),earliest), latest_epoch = IF(match(latest,\"[0-9]T[0-9]\"),strptime(latest, \"%Y-%m-%dT%H:%M:%S.%3N%Z\"),latest)" }, "type": "ds.search" }, "ds_KXR2SF6V": { "name": "Search_1", "options": { "query": "index=_internal earliest=$timetoken:result.earliest_epoch$ latest=$timetoken:result.latest_epoch$\n| stats count by host" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_V1oldcrB", "position": { "h": 80, "w": 310, "x": 20, "y": 20 }, "type": "block" }, { "item": "viz_2FDRkepv", "position": { "h": 260, "w": 460, "x": 1500, "y": 20 }, "type": "block" }, { "item": "viz_bhZcZ5Cz", "position": { "h": 380, "w": 1420, "x": 10, "y": 140 }, "type": "block" } ], "type": "absolute" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } } 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more