Files
parsedmarc/dashboards/splunk
6acacd01d1 Address post-merge Copilot findings from #834 (#836)
- Raise the compliance table's TSVB pivot_rows from 1000 to 10000,
  matching the 10k terms size of the agg-based table it replaced, so
  large installations don't lose per-domain rows.
- Guard the Splunk compliance column's division explicitly:
  if(Messages>0, round(...), null()). SPL already returns NULL on
  division by zero, and null (not 0.0%) matches the PostgreSQL panel's
  NULLIF behavior for zero-message domains, so this makes the intended
  semantics explicit without changing results.

Both verified against the dashboard dev stack: the guarded SPL returns
identical values on seeded data, and the ndjson was round-tripped
through OSD (global tenant) and re-imports 26/26 into both OSD and
Kibana 8.19.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-21 19:29:28 -04:00
..