Dashboards & Visualizations

How to limit the instance for the fields according to drop down

aditsss
Motivator

Hi Team,

I am using below query:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True

when I selecting last 7 days its showing multiple columns .

I want the value to be displayed according to drop down selected like last 7 days last 30 days.

Can someone please guide me here

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Unless you are running your search at exactly midnight, the last 7 days will be spread over 8 days. You need to use the relative option in the time picker and align to the start and end of days to get exactly 7 days worth of events

ITWhisperer_0-1698329648362.png

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your search restrict the output to just two columns regardless of the timeframe. Please provide an example of your expected output.

0 Karma

aditsss
Motivator

@ITWhisperer 

I want two columns only but currently when I am selecting last 7 days its coming more that 7.

If I used dedup command its showing only 1

I want when I select last 7 days it should show only last 7 days

I am selecting last 7 days its showing 60 statistics .

query

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True

 

PFA attached screenshot.Capture.PNG 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I think you are mixing up rows and columns - you have 60 rows and 2 columns

What result are you expecting?

0 Karma

aditsss
Motivator

@ITWhisperer 

I have 60 events but I want when I select last 7 days from date drop down It should display only 7 results

If I select last 30 days it should display only 30 results.

current query

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True

@ITWhisperer  can you please guide

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Which  event do you want to use from each day, the first, the last, only those where searchmatch("ebnc event balanced successfully") is true, what do you want to do if none of the events from a particular day have searchmatch("ebnc event balanced successfully") equating to true?

This has been said many times before, you need to be clear what you are trying to achieve.

0 Karma

aditsss
Motivator

@ITWhisperer 

I don't want to do anything  if none of the events from a particular day have searchmatch

yes , I just want the events where searchmatch("ebnc event balanced successfully") is true.

But I want when I am selecting last 7 days it should show last 7 events only

1 event per day I want.

So if it would be last 7 days it will look something like this:(only 7 events)

EBNCStatus                                                                        true

ebnc event balanced successfully                      ✔

ebnc event balanced successfully                     ✔

ebnc event balanced successfully                     ✔

ebnc event balanced successfully                    ✔

ebnc event balanced successfully                      ✔

ebnc event balanced successfully                    ✔

ebnc event balanced successfully                   ✔

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given the initial search has the same criteria as the searchmatch, True will always be a tick, so you just need to dedup the days

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True="✔"
| bin _time span=1d
| dedup _time
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True
0 Karma

aditsss
Motivator

@ITWhisperer 

I tried below query

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True="✔"
| bin _time span=1d
| dedup _time
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True

When I am selecting last 7 days its showing 8 events instead of 7

aditsss_0-1698328392782.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Unless you are running your search at exactly midnight, the last 7 days will be spread over 8 days. You need to use the relative option in the time picker and align to the start and end of days to get exactly 7 days worth of events

ITWhisperer_0-1698329648362.png

 

0 Karma

aditsss
Motivator

Thanks @ITWhisperer  for this help

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...