topic Re: How to question mark fields in Knowledge Management

How to question mark fields

harishyhrk — Tue, 23 Jan 2018 17:06:24 GMT

How to mark the fields with a question.

Re: How to question mark fields

somesoni2 — Tue, 23 Jan 2018 19:31:16 GMT

Try with column chart with stacked option (no Trellies)

Re: How to question mark fields

somesoni2 — Wed, 24 Jan 2018 17:45:45 GMT

Actually I wanted to say non-stacked option (sorry about that). I create a runanywhere search to generate sample data as yours and use basic column chart for visualization and got this. Does it match what you need?

Search:

| gentimes start=-1 | eval temp="openpremisis#10.1111#8.2222#2.33333 openshift#12.4444#8.55555#2.66666" | table temp  | makemv temp | mvexpand temp | rename temp as _raw | rex "(?<Environment>.+)#(?<Total>.+)#(?<Average>.+)#(?<Minimum>.+)"  | table Environment Total Average Minimum

Output chart:

Re: How to question mark fields

niketn — Wed, 24 Jan 2018 22:03:01 GMT

@harishyhrk, if your current query is giving your Total_Time, Average and Minimum Columns for two Environments and you need it to be inversed, you should use the transpose command as the final pipe in your current query i.e.

  <YourCurrentSearch>
  | transpose header_field="Environment" column_name="Environment"

Following is a run anywhere search based on Splunk's _internal index. (PS: All data/stats is cooked up to generate some chart as per what you currently have).

index=_internal sourcetype=splunkd component!="ConfContentsCache" (log_level="WARN" OR log_level="ERROR")
| stats sum(date_second) as Total_Time avg(date_second) as Average min(date_second) as Minimum by log_level
| replace "ERROR" with "OpenShift" in log_level
| replace "WARN" with "Onpremises" in log_level
| rename log_level as Environment
| transpose header_field=Environment column_name=Environment

Re: How to question mark fields

niketn — Fri, 26 Jan 2018 04:45:47 GMT

@harishyhrk, I am not sure if this was intentional, seems like you have wiped off your question with a new one but with only partial information. Requesting you to retain your original question here since answers have been provided with respect to the same. If the issue has been resolved, requesting you to accept the same as well.

Also, for a question on different lines, requesting you to post a new question.