About niketn

niketn · ‎10-14-2020

@FaewUpV first off your SPL seems poorly written as you are pull all data from index and then filtering to what you need. Try with this as your base search where only results with required Subject text are filtered. You may have to add wildcard if this is pattern match and not exact match. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization index=_internal source="D:\\Example\\Splunk\\var\\log\\splunk\\python.log" sourcetype=splunk_python TERM(email) subject="Name\sSIEM\sReport:\sFirewall" For the drilldown please let us know what you have tried, community may not be able to assist you with "...I don't know how to use tokens for this...". Have you checked out Splunk Docs for setting drilldown tokens or even better Splunk Dashboard Examples App from Splunkbase which has several examples on drilldown?

niketn · ‎10-14-2020

Thanks @bowesmana one of my recently published examples app for our upcoming Splunk .Conf20 session Itsy Bitsy App for Splunk shows two CSS overrides (on similar lines to create Tabs using Dashboard Names Navigation menu and Links within dashboard. Do check out the SplunkTrust track talk TRU1276C: Splunk dashboard journey: Past, Present and Future with amazing @cmerriman

niketn · ‎10-11-2020

Also you might not have access to Internal index (i.e. _internal) so try changing to an index which you may have access to.

niketn · ‎10-11-2020

@akarivaratharaj try the other debug steps I have mentioned. Hope that will help at-least figuring out where the issue is.

niketn · ‎10-11-2020

@akarivaratharaj which version of Splunk are you using? Also when you open Browser Inspector do you seen any Console Log Errors? Hope you have tried bump, refresh, restart of Splunk in your Dev environment and also internet browser history cleanup. In order to test JS being picked up you can try changing the Browser URL to the JS file. For example since we are using JS searchcontrolsevents.js file, you can try the following (http or https depending on your Dev environment setup). PS: App folder name is case-sensitive hope MyApp is spelled with correct casing). If it opens the JS then it implies JS is in the right path. You should verify the code as well. In the JS code block you can add console.log("My Custom Search UI"); as first piece of JS code before declaring submitted and default token model. This can help you debug further or atleast confirm whether JS is loading and has not syntax errors. http(s)://<yourSplunkURL:port>/en-US/static/app/MyApp/searchcontrolsevents.js While my previous answer was from 2017, I just tested in version 8.0.5 and it works as expected. (Latest screenshot attached for reference).

niketn · ‎10-11-2020

@bowesmana based on above JS code provided, I dont understand why you would need JS to apply width. You can use CSS nth-child(1) and nth-child(2) to get the same effect. If you really want JS approach (which I think would be an overkill for your CSS use case), you would need to apply CSS override for token change event handler depending on which the row is displayed or hidden. <form> <label>Dynamic Row width Adjustment</label> <fieldset submitButton="false"> <input type="checkbox" token="chkHideThis" searchWhenChanged="true"> <label></label> <choice value="hidethis">Hide This?</choice> <change> <condition value="hidethis"> <set token="hideThis">true</set> </condition> <condition> <unset token="hideThis"></unset> </condition> </change> </input> </fieldset> <row depends="$alwaysHiddenCSS$"> <panel> <html> <style> #score_row .dashboard-cell:nth-child(1){ width:20% !important; } #score_row .dashboard-cell:nth-child(2){ width:80% !important; } </style> </html> </panel> </row> <row depends="$hideThis$" id="score_row"> <panel> <title>1</title> </panel> <panel> <title>2</title> </panel> </row> </form>

niketn · ‎10-11-2020

@yshen Simple XML JS extension should work as the issue you have listed is unrelated to dashboard. Have you added id="multi1" for the multi-select input you have created in the UI? If so please share Simple XML snippet for multi-select as well. Also while debugging JS it is good practice to add console.log like console.log("Inside my multi-select JS script") as first executable JS line so that you can debug into issues through Browser console. In your example you are having console log inside multiselect change handler which may not execute if mulitselect with ID multi1 does not exists in SimpleXML. Also you may have to bump, refresh, restart Splunk, followed by internet Browser history cleanup depending on your Dev environment configuration for static files like JS, CSS, images to work. Following is bare-minimal code which I tried and worked (shows output in Browser Inspector Console). <form script="multiselect.js"> <label>Multiselect through JS</label> <fieldset submitButton="false"> <input id="multi1" type="multiselect" token="multi1" searchWhenChanged="true"> <label>Multiselect 1</label> <choice value="a">Apple</choice> <choice value="b">Beta</choice> <choice value="c">Charlie</choice> </input> </fieldset> </form> Following is required JS but do not know its actual purpose and catch watch whole video tutorial to understand what is your use case. Just want to let you know that most Multi-Select output can be handled in Simple XML as well (following answer explains similar use case but with check-box instead of multi-select: https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-hide-unhide-specific-text-boxes-using-a-single-checkbox/m-p/413895). require([ 'jquery', 'underscore', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function ($, _, mvc) { console.log("Inside Multiselect JS"); var multi1 = mvc.Components.get("multi1") multi1.on("change", function () { current_val = multi1.val() console.log("Current Vals: " + current_val) var first_choice_value = multi1.options.choices[0].value; if (current_val.length > 1 && current_val.indexOf(first_choice_value) == 0) { multi1.val(_.without(current_val, first_choice_value)); } if (current_val.length > 1 && current_val.indexOf(first_choice_value) > 0) { multi1.val([first_choice_value]); } }); });

niketn · ‎10-11-2020

@sbhatnagar88 for issue 1 you need a developer with JavaScript/jQuery knowledge (This is not a Splunk related issue). What have you tried to get Stars displayed in front-end? What has not worked? For issue 2, writing to CSV is incorrect approach, ideally you should be writing to KVStore for this kind of use case not CSV. Nevertheless, you can get the logged in Splunk User name by two approach: Option 1. Use environment token $env:user$ in Simple XML to set a token using Independent search. The following example explains the approach with an independent search to set the token loggedInUser through SimpleXML and accesses token loggedInUser in JS using default or submitted token model. (you can find several examples for accessing tokens from change event handler of default and submitted token models in Splunk Dev or Splunk Answers. https://dev.splunk.com/enterprise/docs/developapps/visualizedata/binddatausingtokens/transformandvalidate/)  <search> <query>| makeresults | fields - _time | eval loggedInUser="$env:user$" </query> <earliest>-1s</earliest> <latest>now</latest> <done> <set token="loggedInUser">$result.loggedInUser$</set> </done> </search> Option 2: Use splunk.config library to access User Name from object SplunkConfig['USERNAME'] require([ ... ... 'splunk.config' ], function(..., SplunkConfig) { ... // Set the currently logged in user from Splunk Configuration to Token var username = SplunkConfig['USERNAME']; ... });

niketn · ‎10-11-2020

@hollybross1219 you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative). Try the following run anywhere example: <form> <label>Text Box Filter</label> <fieldset submitButton="false"> <input type="text" token="filter" searchWhenChanged="true"> <label>Filter</label> <default>Bank Of America</default> </input> </fieldset>  <search> <query>| makeresults | fields - _time | eval updatedFilter=replace("$filter$","\s","") </query> <done> <set token="updatedFilter">$result.updatedFilter$</set> </done> </search> <row> <panel> <html> <div>filter: $filter$</div> <div>updatedFilter: $updatedFilter$</div> </html> </panel> </row> </form>

niketn · ‎10-11-2020

@vvemula Actual answer will depend on your current SPL and how you are coming to the Time field, what is its use case? Why it can't be YYYY-mm-dd format. One of the options would be to use fieldformat to format Time instead of eval. So that original time remains epoch. | table _time | fieldformat _time=strftime(_time,"%d-%b-%y") | sort _time Following is a run anywhere example: | makeresults | fields - _time | eval data="27-Aug-20,17-jul-20,4-sep-20,30-jul-20,16-jul-20" | makemv data delim="," | mvexpand data | eval _time=strptime(data,"%d-%b-%y") | table _time | fieldformat _time=strftime(_time,"%d-%b-%y") | sort _time

niketn · ‎10-11-2020

@BernardEAI this is a known issue with 7.3.3 with some workaround documented in the following answer: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-include-CSS-in-Dashboards-with-the-latest-Splunk-version/m-p/465917 Also, ideally after testing CSS Style you should try to migrate the same from XML to a CSS static file.

niketn · ‎10-11-2020

@ARaman77 just add the following two SPL pipes to your existing search. Current you have only one series with numerical data. So only one series color gets applied. | eval {RAG}=errCount | fields - RAG errCount

niketn · ‎10-11-2020

@alonsocaio you can use Simple XML JS Extension for POST. Refer to KV Store implementation (you may not need to convert dashboard to HTML, this can be done through Simple XML JS extension directly). https://dev.splunk.com/enterprise/tutorials/tutorialusekv/addarecord

niketn · ‎10-11-2020

@spicynuggs try one of following answer of mine: https://community.splunk.com/t5/Dashboards-Visualizations/XML-to-display-in-a-proper-format-with-tag/m-p/464895

niketn · ‎10-09-2020

@sjbriggs you can use Link Input from Splunk as Submit button with some CSS override and Token handling 🙂 Heck, you can have multiple Submit buttons as well. Refer to one of my older answers on similar lines: https://community.splunk.com/t5/Dashboards-Visualizations/Each-Dashboard-Panel-should-able-to-run-query-on-submit/m-p/502663

niketn · ‎10-09-2020

@AlexV which version of Splunk? May be reach out to Dashboard Team dashboards-beta@splunk.com with issue details like errors in UI, console, splunkd logs etc.

niketn · ‎10-09-2020

@akarivaratharaj try one of my older answers on similar lines: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-app-banner-css-when-open-search-in-search-bar/m-p/336388 If it does not work post details on error/issue like screenshot from UI or Console error.

niketn · ‎10-06-2020

@Digvijay You may have to check Splunk Dashboard App (Beta) for pixel perfect PDF or PNG download option. Refer to the following blog: https://www.splunk.com/en_us/blog/tips-and-tricks/dashboards-beta-v0-7-export-dashboard-to-png-pdf-and-self-service-install-for-splunk-cloud.html

niketn · ‎10-06-2020

@danielgp89 as suggested even browser history needs to be cleaned up. If you are in your dev instance you can remove caching features for faster static file changes (not for production environments). Refer to Splunk Documentation for web.conf config: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial Do accept/up vote the answer if it helped!

niketn · ‎10-06-2020

@jason_hotchkiss that would be because you are running version 7.3.3 which had this as an issue. PS. Once tested you should move the CSS style to a stylesheet so that it is re-usable. Once you do so </p> workaround will not be required. Following is an old answer for reference: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-include-CSS-in-Dashboards-with-the-latest-Splunk-version/m-p/465917

niketn · ‎10-05-2020

@jason_hotchkiss try adding following CSS where id of check box needs to be set as id="checkBoxClear" <row depends="$alwaysHideCSSPanel$"> <panel> <html> <style> #checkBoxClear[data-view="views/dashboard/form/Input"]{ width: 100px !important; } </style> </html> </panel> </row> By default input fieldset width is 220px, this override reduces by half. Once this works you can move the configuration to a static CSS file under the appserver/static folder of your Splunk app. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#dashboard_or_form You can also refer to Clarafication blog by @cmerriman in case you want to pick up on learning about CSS Extensions in Splunk Simple XML dashboards: https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html

niketn · ‎10-04-2020

@rangarbus you may have two options to do this. Option 1: Populate Count an Perc suffixed to the existing dropdown value did and use <eval> to set required tokens. Option 2: Run an independent search which processes the value of did and sets required tokens count and percentage. In either case first improve the performance of your Dropdown by running an optimized search. As of now you may not see the issue in case you have less rows and columns but your performance issues for Dropdown loading and overall dashboard will aggravate as records increase. Following is a run anywhere example showcasing both example using a dummy search to mimic inputlookup data similar to your use case. Following is the required Simple XML code which you can adjust as per your actual use case/code. <form> <label>Dropdown with multiple Tokens</label> <fieldset submitButton="false"></fieldset>  <init> <set token="inputLookup_LookupFile">makeresults count=3 | fields - _time | streamstats count as sno | eval id=sno, dId="ABC-".sno, count=substr(tostring(random()),1,2) | eventstats sum(count) as Total | eval perc=round((count/Total)*100,1)</set> </init>  <search> <query>| $inputLookup_LookupFile$ | search dId="$lookup_Id2$" | fields dId count perc </query> <done> <set token="count2">$result.count$</set> <set token="perc2">$result.perc$</set> </done> </search> <row> <panel> <title>Option 1 : Using eval to set token from Dropdown change event handler</title> <input type="dropdown" token="lookup_Id1" searchWhenChanged="true"> <label>Select ID</label> <fieldForLabel>id</fieldForLabel> <fieldForValue>value</fieldForValue> <search> <query>| $inputLookup_LookupFile$ | fields id dId count perc | eval value=dId."|".count."|".perc | table id value</query> </search> <change> <eval token="dId1">mvindex(split($value$,"|"),0)</eval> <eval token="count1">mvindex(split($value$,"|"),1)</eval> <eval token="perc1">mvindex(split($value$,"|"),2)</eval> </change> </input> <html> <div> <div>lookup_Id1: $lookup_Id1$</div> <div>dId1: $dId1$</div> <div>count1: $count1$</div> <div>perc1: $perc1$</div> </div> </html> </panel> <panel> <title>Option 2 : Using independent search to set token from Dropdown value token</title> <input type="dropdown" token="lookup_Id2" searchWhenChanged="true"> <label>Select ID</label> <fieldForLabel>id</fieldForLabel> <fieldForValue>dId</fieldForValue> <search> <query>| $inputLookup_LookupFile$ | fields id dId</query> </search> </input> <html> <div> <div>lookup_Id2: $lookup_Id2$</div> <div>dId2: $lookup_Id2$</div> <div>count2: $count2$</div> <div>perc2: $perc2$</div> </div> </html> </panel> </row> </form>

niketn · ‎10-04-2020

@shocko It is the new Dashboard Framework which is going to be streamlined across all products. ITSI Beta Glass Tables also utilizes the new Dashboard Framework. The underlying configuration (source code) for these Dashboards is JSON and not XML. However, while saving the dashboard gets saved as XML with JSON wrapped inside. You are allowed to convert your existing Simple XML dashboards to the new JSON based dashboard framework but features like Custom Visualizations, advanced tokens etc, may not port correctly. Do check out Splunk Blogs which get published after each release of the New Dashboard Framework to know more. Also register for Splunk .Conf20 (free, virtual and on demand ‌😉‌ ) and check out the sessions on the new dashboard frameworks and know about product roadmap! If the Beta Dashboard in its current state solves your use case, you can reach out to dashboards-beta@splunk.com with suggestion and feedback and also submit enhancements through Splunk Ideas portal through Navigation Apps & Add-Ons > Splunk Supported > Dashboard App (Beta): ideas.splunk.com Following are the links to various resources mentioned here: https://conf.splunk.com/content/splunk-conf/learn/session-catalog.html PLA1320A - What's new in Splunk Dashboards TRU1276C - Splunk Dashboard Journey: Past Present and Future DEV1665B - Publishing entire Splunk dashboards online using the latest dashboard features https://docs.splunk.com/Documentation/DashApp/latest/DashApp/DashAppRelNotes https://www.splunk.com/en_us/blog/tips-and-tricks/dashboards-beta-app-what-s-new-in-v0-4.html https://www.splunk.com/en_us/blog/tips-and-tricks/dashboards-beta-v0-5-svg-choropleths-unleash-your-inner-picasso.html https://www.splunk.com/en_us/blog/tips-and-tricks/dashboards-beta-v0-6-o-m-g-oh-my-grid-layout.html https://www.splunk.com/en_us/blog/tips-and-tricks/dashboards-beta-v0-7-export-dashboard-to-png-pdf-and-self-service-install-for-splunk-cloud.html https://www.splunk.com/en_us/blog/tips-and-tricks/painting-with-data-choropleth-svg.html

niketn · ‎10-01-2020

@karthi25 at present I am afraid the answer is no. Since enabling iframe in dashboard exposes insecure content in your dashboard you will have to have corresponding configuration in place which are turned off by default for the obvious reasons!

niketn · ‎09-30-2020

@gs as per the example on Splunkbase you need to add radius column values for each metric you are trying to plot on Status Matrix. For example order_status and order_duration in your case need two additional columns for respective Radius to be plotted. Try following search instead: | makeresults | fields - _time | eval data="addtocart,1,1,5,2;ordered,1,1,3,2;shipped,,1,10,7,;delivered,0,1,0,2;" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval stage=mvindex(data,0),order_status=mvindex(data,1),order_duration=mvindex(data,2),order_status_radius=mvindex(data,3),order_duration_radius=mvindex(data,4) | table stage order_status order_duration order_status_radius, order_duration_radius Following is a run anywhere example for you to try out! <dashboard> <label>Status Matrix</label> <row> <panel> <viz type="cuviz_status_matrix.status_matrix"> <search> <query>| makeresults | fields - _time | eval data="addtocart,1,1,5,2;ordered,1,1,3,2;shipped,,1,10,7,;delivered,0,1,0,2;" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval stage=mvindex(data,0),order_status=mvindex(data,1),order_duration=mvindex(data,2),order_status_radius=mvindex(data,3),order_duration_radius=mvindex(data,4) | table stage order_status order_duration order_status_radius, order_duration_radius</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="cuviz_status_matrix.status_matrix.before_label">Status</option> <option name="cuviz_status_matrix.status_matrix.enable_scalable_radius">true</option> <option name="cuviz_status_matrix.status_matrix.max_radius">26</option> <option name="cuviz_status_matrix.status_matrix.min_radius">10</option> <option name="cuviz_status_matrix.status_matrix.radius">24</option> <option name="cuviz_status_matrix.status_matrix.show_flaky_metrics">false</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </viz> </panel> </row> </dashboard>

Posts	6912
Solutions	1166
Karma Given	832
Karma Received	2436
Member Since	‎03-09-2015

How to avoid un-responsive dropdown input with 100...

How to enable drilldown from the Horizon Chart vis...

How can we create Tabs using Link List in Splunk w...

Splunk Add On builder not working on Mac but on Wi...

How to enable drilldown from the Outlier Chart vis...

[BUG] Built in token $message$ for <fail> Search E...

How do you make a table that reduces in height whe...

What is the expected behavior for Submit button wh...

App Certification criteria: I need help on the 64...

Parallel Coordinates Example has been named Locati...

Re: Linking Dashboard Panel with Report Results

Re: How can we create Tabs using Link List in Splu...

Re: How to add a search bar using Java script?

Re: How to add a search bar using Java script?

Re: How to add a search bar using Java script?

Re: Reveal dependent panel changes width set by Ja...

Can I use free Splunk instance to run JavaScript c...

Re: Java script modification help needed

Re: How to transform text type token values on das...

Re: how to sort the date in chronological order by...

Re: How to add style to panel titles in my dashboa...

Re: Colour in timechart

How to implement custom POST actions on a dashboar...

Re: Formatting output of XML

Re: Can you position a text input on a dashboard b...

Re: Dashboards App (beta v0.70) starts with blank ...

Re: How to add a search bar using Java script?

Re: How to export Splunk dashboard to PDF with spe...

Re: I can't Overlay an Image Like Splunk Dashboard...

Re: Decrease Space Between Checkbox and Submit But...

Re: Decrease Space Between Checkbox and Submit But...

Re: Fetch additional Tokens in Dropdown to populat...

Re: Spunk Dashboard App Framework

Re: Load Grafana Dashboard url in splunk

Re: Status Matrix Custom Viz is not working as exp...