topic Re: How to show true keyword and green tick on publish of any events in Dashboards & Visualizations

How to show true keyword and green tick on publish of any events

aditsss — Sun, 27 Aug 2023 05:34:38 GMT

Hi Team,

I have below query:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"

I want a true keyword and a green tick every time I receive this "ReadFileImpl - ebnc event balanced successfully"

Something like this:

"ReadFileImpl - ebnc event balanced successfully" true tick mark

If this appears "ReadFileImpl - ebnc event balanced successfully" 8 times in a day I want each statement separate with a true keyword and green tick.

Can someone guide me here.

Re: How to show true keyword and green tick on publish of any events

gcusello — Sun, 27 Aug 2023 08:31:58 GMT

Hi @aditsss,

to add the "True" keyword it's easy, you have only to use the eval command with the option "searchmatch" (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/ConditionalFunctions#searchmatch.28.26lt.3Bsearch_str.26gt.3B.29), in this way:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully","True","")

Even if, putting the string "ReadFileImpl - ebnc event balanced successfully" in the main search, al the events you have as results are "true" by definition and you don' have events without the true keyword.

For the green tick is less easy because you have to use a JS and a CSS, you should see in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603) where you can find the "Table Icon Set (Rangemap)" dashboard example that has this feature and gives you the JS and the CSS.

Ciao.

Giuseppe

Re: How to show true keyword and green tick on publish of any events

aditsss — Sun, 27 Aug 2023 17:46:39 GMT

@gcusello

I am getting below error by using below query:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully","True","")

Error in 'EvalCommand': The arguments to the 'searchmatch' function are invalid.

Could you please guide.

Re: How to show true keyword and green tick on publish of any events

PickleRick — Sun, 27 Aug 2023 19:03:31 GMT

That sounds kinda pointless. You're searching for this text so it's only natural that you find this text. There is no way for your search to match events which do not have this text.

What is the purpose of this exercise then?

Re: How to show true keyword and green tick on publish of any events

aditsss — Sun, 27 Aug 2023 20:20:09 GMT

@PickleRick

This is requirement that when ebnc event balanced come there should be TRUE keyword to make it sure this happen.

Could you please guide regarding query.

Re: How to show true keyword and green tick on publish of any events

PickleRick — Sun, 27 Aug 2023 21:54:11 GMT

Ok, but if there is no such event, you will not have anything in your results. So just adding a static "true" to every returned row of results seems silly. The events don't change as such.

Re: How to show true keyword and green tick on publish of any events

aditsss — Sun, 27 Aug 2023 22:01:37 GMT

@PickleRick

This is only requirement

@PickleRick @gcusello could you please guide me with the query I post.

I want like this

Ebnc events successfully balanced. True

Whenever this "ebnc events successfully balanced" there should be true keyword.

Re: How to show true keyword and green tick on publish of any events

gcusello — Mon, 28 Aug 2023 07:27:05 GMT

Hi @aditsss.

sorry I forgot a parenthesis:

Ciao.

Giuseppe

Re: How to show true keyword and green tick on publish of any events

aditsss — Mon, 28 Aug 2023 08:03:25 GMT

@gcusello

How can I make below query as statistics

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","")

Like this :

ebnc event balanced successfully True

Re: How to show true keyword and green tick on publish of any events

gcusello — Mon, 28 Aug 2023 08:19:53 GMT

Hi @aditsss,

when you found th events, you can use the stats command:

but, as I said, if you put the keyword in the main search, all the results are true, so you need only the count of events, so you could semplify your search:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | stats count

It's different if you want to count the occurrences of the string and also the other events, but you have to modify the main search:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" | eval keyword=if(searchmatch("ReadFileImpl - ebnc event balanced successfully"),"True","False") | stats count BY keyword

Ciao.

Giuseppe

Re: How to show true keyword and green tick on publish of any events

aditsss — Mon, 28 Aug 2023 08:24:15 GMT

@gcusello

I dont want count

I want like this:

ebnc event balanced successfully True

means whenever "ebnc event balanced successfully" occur TRUE keyword should be there.

Re: How to show true keyword and green tick on publish of any events

gcusello — Mon, 28 Aug 2023 08:30:34 GMT

Hi @aditsss,

let me understand: you want a table where each row contains only: "ebnc event balanced successfully! and "True"?

in this case, you can use:

then, if you want, you could add other fields to the table command (e.g. _time).

Ciao.

Giuseppe

Re: How to show true keyword and green tick on publish of any events

gcusello — Mon, 28 Aug 2023 10:19:54 GMT

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉