Hello Community, I need your help to understand why if I use twice a "lookup" command on the same table lookup (out-of-the-box "geo_attr_countries"), I don't get the results I expect, since it looks like the second one is ignored, but it does work if I replace both the "lookup" commands with equivalent "join" commands. I am using Splunk Cloud 8.1 and I would prefer the double "lookup" due to better search performance on my dataset, where events may have the country code or the country name in the same field and I need both of them. Below 2 examples you can run in your Splunk (in bold the only lines changed): Double "lookup" not working: | makeresults | eval countryCodeOrName="Spain" | append [| makeresults | eval countryCodeOrName="IT"] | append [| makeresults | eval countryCodeOrName="France"] | append [| makeresults | eval countryCodeOrName="DE"] | table countryCodeOrName | eval country=if(len(countryCodeOrName)>2,countryCodeOrName,"-") | eval iso2=if((len(countryCodeOrName) == 2),countryCodeOrName,"-") | lookup geo_attr_countries country OUTPUT iso2 as countryCode | lookup geo_attr_countries iso2 OUTPUT country as countryName | table countryCodeOrName countryCode countryName Double "join" working: | makeresults | eval countryCodeOrName="Spain" | append [| makeresults | eval countryCodeOrName="IT"] | append [| makeresults | eval countryCodeOrName="France"] | append [| makeresults | eval countryCodeOrName="DE"] | table countryCodeOrName | eval country=if(len(countryCodeOrName)>2,countryCodeOrName,"-") | eval iso2=if((len(countryCodeOrName) == 2),countryCodeOrName,"-") | join type=left country [| inputlookup geo_attr_countries | table country iso2 | rename iso2 as countryCode ] | join type=left iso2 [| inputlookup geo_attr_countries | table country iso2 | rename country as countryName ] | table countryCodeOrName countryCode countryName I would appreciate your suggestions! Thanks, G.P. ... View more

Hi Community, I am trying to set a token based on a search in an ITSI glass table, but I cannot find any way to do it "dynamically", even by changing the JSON code of the glass table. My final goal is using the token value to set the color of an icon based on the value returned by the related search. According to what I found, the only option to colorize an icon with a value changing dynamically is by using a token (and this works, with a static token set via text input with an hex value corresponding to a color, e.g. "#FFFFFF"). The only reference documentation I can find is https://docs.splunk.com/Documentation/ITSI/4.8.0/SI/Inputs#How_inputs_connect_to_visualizations Below, the code of the icon, with its color set to a token named "vizcolor": {     "type": "viz.singlevalueicon",     "options": {         "showValue": false,         "icon": "splunk-enterprise-kvstore://6001e599aea29f5df6382024",         "color": "$vizcolor$"     },     "dataSources": {         "primary": "ds_XXXXXX"     } }   In conclusion, I would like to know if any one of you can suggest me how to set a token from a search result on a glass table (examples are appreciated). Thanks, G.P. ... View more

Hi Community, I am trying to set a token based on a search in an ITSI glass table, but I cannot find any way to do it "dynamically", even by changing the JSON code of the glass table. My final goal is using the token value to set the color of an icon based on the value returned by the related search. According to what I found, the only option to colorize an icon with a value changing dynamically is by using a token (and this works, with a static token set via text input with an hex value corresponding to a color, e.g. "#FFFFFF"). The only reference documentation I can find is https://docs.splunk.com/Documentation/ITSI/4.8.0/SI/Inputs#How_inputs_connect_to_visualizations Below, the code of the icon, with its color set to a token named "vizcolor": {     "type": "viz.singlevalueicon",     "options": {         "showValue": false,         "icon": "splunk-enterprise-kvstore://6001e599aea29f5df6382024",         "color": "$vizcolor$"     },     "dataSources": {         "primary": "ds_XXXXXX"     } }   In conclusion, I would like to know if any one of you can suggest me how to set a token from a search result on a glass table (examples are appreciated). Thanks, G.P. ... View more

Hi all, I wrote a SPL query to generate the table to be used as data source for a world choropleth map within my glass table on Splunk Cloud with the ITSI app. The query is defined as follows: index=test | rename country as iso2 | stats count by iso2 | lookup geo_attr_countries iso2 OUTPUT country | fields - iso2 | geom geo_countries featureIdField="country" It runs well in the search interface (both on a Splunk Cloud instance without ITSI and with ITSI) and in a world choropleth map on a "traditional" Splunk dashboard: the country are always colored as expected. However, when I add this query in the data configuration section of a new world choropleth map on a new glass table in the ITSI app, I get only a message of "Cannot get geoJson data.". I supposed the glass table cannot find the data, but if I use the same query in another visualization type (e.g. table), the data are displayed as expected. Data are correct and the query works well even if I click on "open in search" near the empty widget of the map while in visualization mode. Could you please support me in resolving this issue? I couldn't find any suggestion or example online for choropleth maps in glass tables. Thanks, G.P. ... View more

Hello All, I encountered a visualization issue in the Single Value tile on Splunk Enterprise 7 when the current value is greater than zero and the compared old value is zero: the displayed percentage change is displayed as "N/A" due to the division by 0 in the percentage ratio calculation (x/0 * 100). Even if the result is mathematically correct, displaying "N/A" makes the user think that something is not working as expected in Splunk or that some data are corrupted. The only workaround I found till now is replacing the 0 values with a little higher value between 0 and 0.1 (e.g. 0.001 or 0.999), but the displayed percentage is obviously ugly (e.g. 500000 for current value 5, when using 0,001 instead of 0). The query is just a count of some events, so, after the base search, it ends with "| timechart span=1h count by key". Have anyone a solution or a better workaround? Thanks, G.P. ... View more