Hello, Has anyone had issues with the color codes used in your json are not the colors appearing in your visualization?     { "type": "splunk.column", "options": { "legendDisplay": "off", "dataValuesDisplay": "all", "yAxisTitleText": "Volulme (GB)", "xAxisTitleText": "Day", "stackMode": "stacked", "seriesColorsByField": { "over_500_red": "#FF0000", "between_400_and_500_orange": "#FFA500", "between_200_and_400_green": "#008000", "under_200_blue": "#0000FF" } }, "dataSources": { "primary": "ds_search_1" }, "title": "License Usage - Last 14 Days", "showProgressBar": false, "showLastUpdated": false, "context": {} }     Green and blue are not in the chart below. Thanks and God bless, Genesius ... View more

  Hello, Has anyone experienced parsing Windows Event Logs using a KVstore for all of the generic verbiage?  For example - red text (general/static text associated with EventCode number and other values  - this will mostly be the Message/body fields) will be entered into a KVstore; green text (values within the event) will be indexed. In the below example, there are 2,150 characters, of which, 214 characters are dynamic, and need to be indexed. The red(undant) text contains over 1,930 characters.  These are just logon (4624) events. With over 11.5 million logon events per day across our environment, this is ~23 GB. If what I am asking can be/has been accomplished, we could reduce this to 2.3 GB. Thanks and God bless, Genesius   09/11/2023 12:00:00AM LogName=Security EventCode=4624 EventType=0 ComputerName=<computer name> SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=9696969696 Keywords=Audit Success TaskCategory=Logon OpCode=Info Message=An account was successfully logged on.   Subject:                 Security ID:                         NT AUTHORITY\SYSTEM                 Account Name:                 <account name>                 Account Domain:                              <account domain>                 Logon ID:                             0x000   Logon Information:                 Logon Type:                        3                 Restricted Admin Mode:               -                 Virtual Account:                No                 Elevated Token:                 Yes   Impersonation Level:                      Identification   New Logon:                 Security ID:                         <security id>                 Account Name:                 <account name>                 Account Domain:                              <account domain>                 Logon ID:                             0x0000000000                 Linked Logon ID:                               0x0                 Network Account Name:               -                 Network Account Domain:           -                 Logon GUID:                       <login guid>   Process Information:                 Process ID:                          0x000                 Process Name:                   D:\Program Files\Microsoft System Center\Operations Manager\Server\Microsoft.Mom.Sdk.ServiceHost.exe   Network Information:                 Workstation Name:         <workstation name>                 Source Network Address:             -                 Source Port:                        -   Detailed Authentication Information:                 Logon Process:                  <login process>                 Authentication Package: <authentication package>                 Transited Services:           -                 Package Name (NTLM only):        -                 Key Length:                         0   This event is generated when a logon session is created. It is generated on the computer that was accessed.   The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.   The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).   The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.   The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.   The impersonation level field indicates the extent to which a process in the logon session can impersonate.   The authentication information fields provide detailed information about this specific logon request.                 - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.                 - Transited services indicate which intermediate services have participated in this logon request.                 - Package name indicates which sub-protocol was used among the NTLM protocols.                 - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. ... View more

Hello, I downloaded and installed Splunk Enterprise 9.x on my laptop. I am creating a Studio Dashboard and experiencing an issue with images. I am using a token in the image path to change the image based on a dropdown input. Therefore, the images can't be held in the kvstore. They must remain local to my PC. In my production environment at work, RedHat, this works. The image path - within the DS Configuration Pane - is  /en-US/static/app/search/images Although the path on the Linux server is really etc/apps/search/appserver/static/images Splunk manipulates the path name in some strange way. apps becomes app, static is placed before the search (the app name).   I am using Windows on my laptop, and I can't figure out the correct path for the image URL. The Windows path for these images is C:\Program Files\Splunk\etc\apps\search\appserver\static\images What is Dashboard Studio Splunk-Speak for this path in Windows? Thanks in advance for your help. God bless, Genesius       ... View more

Hello, Is it possible to create indexed fields on log files uploaded from my PC? The log file is tens of thousands of records. I need to index two of the fields in order to run tstats against them. Running a normal search and extracting these two fields (and others) at search time is not efficient. If these two fields were indexed I could run searches with tstats much, much faster. Thanks in advance and God bless, Genesius ... View more

Hello, Our use case is to add a viz which is a URL for an interactive map. New Jersey County Map  This map should be displayed on the dashboard at all times. When a user clicks on any County, a data table will open in the lower left of the window/panel/viz. Tried inserting it as an image, and changed the domain for images in the web.conf. dashboards_csp_allowed_domains = *.njogis-newjersey.opendata.arcgis.com But since it is not really an image, but an image rendered on a webpage, this didn't work - received this error. With Classic DB we used I-Frame on occasion. But this was kludgy at best. We haven't worked with REST API. But could that be a possible solution? Thanks in advance and God bless, Genesius ... View more

Hello, The Subject pretty much says what I am looking for. I am new, 3 weeks in, to Dashboard Studio. One of the (many) functionalities(?) missing is the ability to show and hide visualizations. Has anyone figured out a workaround or band-aid in the JSON, or some other override? Thanks in advance and God bless, Genesius ... View more

Hello,, I have installed the Hyper-V TA on our search head and our heavy forwarders. There was a Splunkbase app called Splunk for Server Virtualization, but it was retired. What have Splunkers used for creating visualizations of this data?  Thanks and God bless, Genesius ... View more

Hello, We are using Splunk v8.2.5 (Build:77015bc7a462 if this helps). Since we upgraded we no longer receive errors or warnings when stats, eventstats, or streamstats is not returning the correct values. We have a lookup csv of nearly 3 million records containing several fields that need to be counted and compared: prize code, address, email, etc. The eventstats command fails and there is no error or warning. However, the stats command works. This would be okay if we had only one field to be counted. We have 4-8 fields that must be counted and compared. Using the stats command quickly becomes a nightmare because every field that is not being counted in relation to the particular field in the by clause would need to be added using values(FIELDNAME). The eventstats command would be cleaner. Or would it?       | bin _time span=1d | eventstats count(prize_code) as count_prize_code by _time, address | dedup address, count_prize_code, _time | eventstats count(_time) as count_prize_code_dates, sum(count_prize_code) as sum_count_prize_code by address | dedup address, count_prize_code_dates, sum_count_prize_code | table address, count_prize_code_dates, sum_count_prize_code       Thanks and God bless, Genesius ... View more