The "splunk_analysis_workspace/default/app.conf" file is misconfigured: [ui] is_visible = 0 Once I made the app visible, I felt the powah! 😛 ... View more

Hi Ninjas, I have a search which produces a bar chart comparing four different fields week over week: index=foo conversion_source=Online OR conversion_source=Offline | bin span=1w _time | chart sum(ABC) AS ABC sum(DEF) AS DEF sum(GHI) AS GHI sum(JKL) AS JKL over _time by conversion_source | transpose | search column!=_* | rename "row 1" AS "Current Week" "row 2" AS "Past Week" column AS "Conversion Source" Here is the bar chart: It is ok but the customer wants something a little fancier, like a Bubble Chart or a Punchcard, e.g. To use the Punchard viz, I need to re-format the output from the following: Conversion Source Current Week Past Week ABC: Offline 40262 37334 ABC: Online 36997 36233 DEF: Offline 253865 216674 DEF: Online 561871 572597 GHI: Offline 356971 398079 GHI: Online 243909 226444 JKL: Offline 1275880 1284603 JKL: Online 1225050 1165302 to this: date type count Current Week ABC: Offline 40262 Current Week ABC: Online 36997 Current Week DEF: Offline 253865 Current Week DEF: Online 561871 Current Week GHI: Offline 356971 Current Week GHI: Online 243909 Current Week JKL: Offline 1275880 Current Week JKL: Online 1225050 Past Week ABC: Offline 37334 Past Week ABC: Online 36233 Past Week DEF: Offline 216674 Past Week DEF: Online 572597 Past Week GHI: Offline 398079 Past Week GHI: Online 226444 Past Week JKL: Offline 1284603 Past Week JKL: Online 1165302 I would greatly appreciate any tips on how to achieve this new tabular output. Thanks in advance, Luke. ... View more

Hi 🙂 I am really impressed by this app but some larger lookup files don't load at all whereas some smaller lookup files do load ok. It gets stuck on "Loading lookup file..." FYI: We are running Lookup File Editor 1.0 on Splunk 6.0.2 Any help would be greatly appreciated 🙂 Luke. P.S. The lookup files do load ok in Sideview Utils Lookup Updater but your interface is cooler 😄 ... View more

Hi 🙂 We have a lookup table with 20+ columns and our users have noticed a problem when they use the "Add New Row" feature in "The Lookup Updater" in Sideview Utils 3.2.3 (on Splunk 6.0.2). The paging sets the number of rows to 10 per page by default, but when a user fills out the fields and clicks between the 3 pages, any previous fields they entered are emptied. I tried setting the count for the Pager module and/or the Table module to 30 but it seems to be overridden by results.count which is upstream. I understand this is expected behavior, however I would like to force it to be greater than 10 to allow the users to fill out all fields in one page, could you please advise where is the best place in the xml to do so? Thanks in advance, Luke 🙂 ... View more