Hi @thaara, i tried to reproduce your problem. I created an index with the name "wine" and filled it with this data. I created the following dashboard: <form> <label>Pie Chart</label> <fieldset submitButton="false"> <input type="multiselect" token="tok_quality" searchWhenChanged="true"> <label>quality</label> <choice value="5">5</choice> <choice value="6">6</choice> <choice value="7">7</choice> <initialValue>5,6,7</initialValue> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>quality=</valuePrefix> <delimiter> OR </delimiter> <default>5,6,7</default> </input> </fieldset> <row> <panel> <chart> <search> <query>index=wine $tok_quality$ | stats count by quality</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="charting.legend.labels">[5,6,7]</option> <option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option> </chart> </panel> </row> </form> Everything is working as expected. You might compare your dashboard to this one and see what you've done different. I hope this helps. If it doesn't help, you shall give more details about your problem like your complete dashboard code for example. And i don't know what "Also please help to get the color codes data as well." is supposed to mean. ... View more

Hello @techiesid, thank you for your time and work! First of all, i tried to use your dashboard and what i see is only regarding the _internal index, which is not quite what i am looking for. You changed my base query, which is probably not a good idea. You should look at my data and my search query a little bit more carefully. I am using data with fields called inputsource and dest_index. I renamed them for my dashboard, but i do not need to rename them. Like i said dest_index and inputsource are determined by btool. Which means that there is not necessarily an existing input. Because there could be trouble with read access or there might be no file in that directory on the forwarder. I suppose index=_internal only mentions existing inputs. The second thing is i do not know in which location i am supposed to put your script into. And i have almost no clue how your script works. I want to provide some more information which might helps you: I am using a script with the name btool_inputs with the following content. /opt/splunkforwarder/bin/splunk btool inputs list | grep -e '^\[\|^index' My props.conf is: [inputsconf] DATETIME_CONFIG = CURRENT LINE_BREAKER = ([\r\n]+)\[ SHOULD_LINEMERGE = false TRANSFORMS-throwaway = garbage EXTRACT-source = \[monitor:\/\/(?[^\]]*)] EXTRACT-index = index = (?.*)$ My transforms.conf is: [garbage] REGEX = ^(?!.*(\[monitor)).* DEST_KEY = queue FORMAT = nullQueue And my inputs.conf is: [script://$SPLUNK_HOME/etc/apps/input_monitor/bin/btool_inputs] sourcetype = inputsconf index = inputmonitor interval = 60 I hope you might be able to adapt your work this configuration and to tell my how to use the script correctly. Sincerely @dpeukert ... View more

Hello, it seems like you want to use a sparkline in a single value visualization. The second link gives the most important information about it, namely that you need to use the timechart command to be able to get your desired visualization. (You've been using table instead.) ... View more

The answer is simple and tricky at the same time. You just need to add limit=3 after stats. It seem's simple, but limit doesn't get highlighted as you might be used to. And limit is not mentioned in https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Stats . This is what you need in more detail: | sort -elapseJobTime | stats limit=3 list(JOBNAME) as JOBNAME list(JOBID) as JOBID list(elapseJobTime) as elapseJobTime by desc ... View more

First of all, "disabled" is not a key mentioned in props.conf.spec. So you don't need it. Second, you've used LINE_BREAKER = ([\r\n]+) and this is already the default. So you don't need to set this either. I tried to parse your data in my standalone instance and the following stanza was sufficient. [answersxml] TRUNCATE = 0 SHOULD_LINEMERGE = false KV_MODE = xml I added the "SHOULD_LINEMERGE = false" key-value-pair. I also deleted "CHARSET = UTF-8", because it is default in Linux machines. The way, how you could have solved this on your own, was to try to input your data in Splunk Web. When you choose "Event Breaks" > Regex your events break correctly immediately. And you see a comment on the changes Splunk made. ... View more

You are using the following line: token.0.replacementType = timestamp Instead you should use: token.0.replacementType = replaytimestamp This should fix your problem. Tip: The replaytimestamp is based on the difference of the timestamps in your sample file. So you might want to increase the difference in your sample. ... View more