Hi, I've assigned custom syles to certain eventtypes following this blog entry: Colorize your world... As usual I've built my app on top of the 'sample_app' template distributed with Splunk. Everything works fine when I use the 'Search views'->'Sample search' to list the events. The problem is that color styles don't work when I list same event types in another dashboard which uses dropdown list (lister) to narrow down search results. How can I force event (color) highlighting when using dropdown lists? I have the following code in my lister dashboard:
<form>
<label>Vulnerabilities by host</label>
<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index=scs | eval time=_time | search [search index=scs hostIP="$hostIP$" | stats latest(_time) as time2 | eval time=time2 | fields time]</searchTemplate>
<fieldset>
<!-- Define a simple dropdown form driven by a search -->
<input type="dropdown" token="hostIP">
<label>Select to address</label>
<choice value="*">Any</choice>
<populatingSearch fieldForValue="hostIP" fieldForLabel="hostIP"><![CDATA[index=scs | stats count by hostIP]]></populatingSearch>
</input>
</fieldset>
<row>
<!-- output the results as a 50 row events view -->
<event>
<title>Vulnerabilities for the selected host</title>
<option name="count">50</option>
</event>
</row>
Ok, I've managed to make a workaround using custom js similar to this one Advanced XML - Highlight certain values in a table
Ok, I've managed to make a workaround using custom js similar to this one Advanced XML - Highlight certain values in a table