Thanks D... No go unfortunately. | tstats summariesonly count FROM datamodel=Web.Web BY Web.url, Web.client_ip where Web.url IN ("0aqpqdju.me", "0x1f4b0.com",...) Error: Error in 'TsidxStats': Wildcards (*) are not supported in groupby fields (FYI - The wildcards are being stripped in the above query when posted here.) As to the second option it won't work. It has to contain the wildcards since the url can vary wildly. Seems like this should be a simple pattern matching search against the DM. Someone suggested using macros.conf and transforms.conf in another channel. Will give that a try. ... View more

Stand corrected. I had to close and clear out my cache on Chrome and it displayed correctly. Seems to be working as intended and I see no side effects of hiding the code in the .css. Thank you Sir!! ... View more

No joy Paul. No change at all in the page rendering after a reload. Next steps? ... View more

Here is the .css file: body,.dashboard-body,.footer,.header,.dashboard-cell { background: #333 !important; color: lightgrey; } body, .main-section-body, .footer { background-image: url('images/px_by_Gre3g_@2X.png') !important; } .dashboard-cell { background: none; } .dashboard-panel { background: #666 !important; } .dashboard-row label, .dashboard-row a { color: #fff; } a:hover { color: #fff; } .dashboard-row .dashboard-panel .refresh-time-indicator { color: #FFF; } .dashboard-header h2, p.description, .nav-footer>li>a { color: #ddd; text-shadow: none; } .dashboard-row .dashboard-panel { border: none; } .dashboard-row .dashboard-panel .panel-head h3 { color: #FFF; text-shadow: 0 2px 0 #681111; } .table-chrome > thead > tr > th a { background-image: none !important; } .table-striped > tbody > tr:nth-child(odd) > td, .table-striped > tbody > tr:nth-child(odd) > th { background-color: #414141 !important; } .table { background-color: none; } .table .table, .table-striped>tbody>tr>td { color: white; } .table .table, .table-striped>tbody>tr:nth-child(even)>td { background-color: #696969 !important; } .table-chrome > thead > tr > th, .table-chrome > thead > tr > th a { background-image: linear-gradient(to bottom, #888, #666); color: white !important; text-shadow: none; } .table-chrome .sorts a { text-decoration: none; color: #ddd; } .table-chrome .sorts:hover { background: none; background-color: #333; } svg>rect { fill: #333 !important; } svg text { fill: #fff !important; } .single-value .single-result { color: #fff; } .splunk-paginator a.selected { background: #000; } #minion { height: 100px; } h6 { color: lightgrey; } .splunk-header { display: none; } .panel-body { text-align: center; } ... View more

Apparently I need more karma to post another picture. LOL ... View more

Here is the code from that page so you have all the details when researching a fix. This is running on our Enterprise Security Splunk instance in a special overview dashboard we run on large monitors. As you can see it is running a stylesheet. It's possible something in there is causing this alignment problem. Why do I say that? Because the same globe code is running on another Splunk instance that is not using a stylesheet and it works perfectly. I have it running twice next to each other and its fine. Screenshot attached. <dashboard stylesheet="dark_no_bar.css" hideSplunkBar="true" hideFooter="true" hideEdit="true"> <label>IT SecOps: Security IoC Overview</label> <description></description> <row> <panel> <title>External Notable Security Events by Geolocation (4h)</title> <viz type="missile_map.missile_map"> <search> <query>index=notable threat_group!=sans | `missile_map(true)`</query> <earliest>-4h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>15m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="missile_map.missile_map.lineThickness">1</option> <option name="missile_map.missile_map.mapLatitude">30</option> <option name="missile_map.missile_map.mapLongitude">-5</option> <option name="missile_map.missile_map.mapZoom">2</option> <option name="missile_map.missile_map.staticColor">#FF0000</option> <option name="missile_map.missile_map.tileSet">dark_tiles</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> <panel> <title>Global Blocks by Country</title> <viz type="webgl_globe.globe"> <search> <query>| from datamodel:"Network_Traffic"."Blocked_Traffic" | search dest_ip="xxx.xxx.*.*" | stats count as count by src_ip | where count > 100 | iplocation src_ip | where Country!="United States" | geostats count by Country</query> <earliest>-24h@h</earliest> <latest>now</latest> <refresh>10m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="webgl_globe.globe.globeAnimate">true</option> <option name="webgl_globe.globe.globeAnimateSpeed">30</option> <option name="webgl_globe.globe.globeBackground">true</option> <option name="webgl_globe.globe.globeColor">color</option> <option name="webgl_globe.globe.globeControls">false</option> <option name="webgl_globe.globe.globeLegend">true</option> </viz> </panel> </row> ... View more

Linux Splunk environment... should have added that in the original note. That caveat article makes it very clear that WMI should only be used for occasional collection and not viable for enterprise wide collection. So, given that note any mature enterprise moving towards Windows 10 and Server 2016 need a stable Splunk solution for pulling Windows Update logs. Have I mentioned that without a Splunk solution to this problem both Enterprise Security and the Windows Infrastructure app won't be able to provide any results on those two OS's? Danger Will Robinson, Danger... ... View more

/opt/splunk/var/lib/kvstore/mongo/splunk.key 🙂 ... View more

This has been resolved. Somehow during the upgrade to 6.5 the permissions on splunk.key changed. The permissions on the splunk.key file had to be reset as read-only and the search head rebooted. Problem solved. Shout out to Mike Cormier @ Concanon for his assistance! Update: Typo fixed - splunk.key is the correct file name. ... View more

After upgrading to 6.5 I am getting: 1) "Failed to start KV Store process. See mongod.log and splunkd.log for details." 2) "KV Store changed status to failed. KVStore process terminated." 3) "KV Store process terminated abnormally (exit code 1, status exited with code 1)" I see nothing in Answers related to this. Help!! ... View more

It is. I left it open because I wanted to convert everything back over to syslog running a UF. I may not get to that testing until after .conf so I will mark this as answered for now. ... View more

I know this is a really old post but after banging my head on a related Splunk install problem I stumbled upon something that worked for my issue. The Windows "Software Protection" service was not starting like it should have (its set to Automatic (Delayed Start)). UF installs failed every time. When I manually started the service the UF installed normally. ... View more