We installed the Grand Central 3.0.7 add-on installed in our Splunk Cloud environment and were working on configuring it for our AWS Master Account…We got through the first several steps and since we were seeing it pull in the AWS accounts, we were pretty happy that things were working….then we got to the AWS Stacksets…and it looks like AWS Organizational Units only show up if those OUs are off the root OU and also that OU contains an AWS account.  In our environment, we have OUs that are nested within other OUs and our AWS accounts reside in the child OUs.  Here is what we found: Notice in this Grand Central dialog, only the ‘Security’ and ‘Infrastructure’ OUs show up in the drop-down: See in this AWS OU screenshot, most of the OUs in AWS did not show up in the Grand Central AWS OU drop-down. The ‘Business Units’ OU is one that contains child OUs whose child AWS accounts we would want to be managed/collected via Grand Central.  Notice the OU named ‘Security-old’…it only has a “grandchild” AWS account (a child of the ‘GC-Testing01’ OU) and no AWS account is directly contained within the ‘security-old’ OU.   To test, we moved the ‘security_acct’ AWS account from the ‘Security-old / GC-Testing01’ OU to the ‘Security-old’ OU….and then after refreshing things in Grand Central, it shows up in the drop down.    Here is the OU structure that we found will work in Grand Central (Notice that the ‘security-acct’ AWS account is now in the ‘security-old’ OU (right off the root):  Notice above, the ‘security_acct’ AWS account is now contained directly within the ‘Security-old’ OU. I need to find a way to get Grand Central to work with the way we have structured our OUs and AWS accounts.  I am told we have structured our OUs generally following the recommended best practices from AWS: https://aws.amazon.com/blogs/mt/best-practices-for-organizational-units-with-aws-organizations/ I’m looking for any guidance on next steps forward for us to be able to push stacksets to all our AWS accounts as they lay in their nested OUs.  Any thoughts or ideas? Thank you, REID ... View more

I wish to take a stacked bar chart, use 'addtotals' to create a field representing the cumulative value of the stacked bars, and then overlay a prediction (using predict) of the cumulative value on the stacked bar chart.  When I try to do this, the stacked bars always revert to side-by-side in the chart.  Here is a look at what I wish to do: some SPL that generates a sample dataset:     | makeresults count=20 | streamstats count AS count | eval _time=now()+(count*43200) | eval n=(random() % 1000000) + 1 | eval load=100*count*n | eval host_name=if(count%2==0,"host1", "host2") | timechart span=1d avg(load) AS load by host_name | addtotals host* fieldname=load_total     If I create a visualization of this, stack the bars, and add the 'load_total' field as an overlay, I end up with something like this:   Now, I wish to add 'predict' to this query to get forecasted values for the cumulative 'load_total' field.  Here is the SPL for that:     | makeresults count=20 | streamstats count AS count | eval _time=now()+(count*43200) | eval n=(random() % 1000000) + 1 | eval load=100*count*n | eval host_name=if(count%2==0,"host1", "host2") | timechart span=1d avg(load) AS load by host_name | addtotals host* fieldname=load_total | predict load_total algorithm=LLT future_timespan=4     Even though the bars are set to be stacked in the format of the chart, they revert to side-by-side. Any ideas on why the behavior is like this or how I can get the stacked bars? I believe what I am trying to do is the same as in this post from @renuka , but I wanted to add a little more information. Thanks, Reid ... View more