Knowledge Management

bizarre multivalue/mvexpand question

sideview
SplunkTrust
SplunkTrust

In complex reporting views I often use the FlashTimeline module near the top, to allow the user to regenerate the FlashCharts and other reports for just the timerange that they click or drag on the FlashTimeline.

Unfortunately when the reports on such a view get converted to pull data from a summary index, the y-axis scale on the FlashTimeline becomes confusing, because of course each individual 'event' in the summary data is actually representing N events, but nobody tells the FlashTimeline this.

One approach I've taken elsewhere is to strip the FlashTimeline down so that it has no y-axis, and so the bars are all the same height and it becomes effectively a big 'navigation strip'.

However I feel like there's maybe some cruel and unusual search language that can turn my summary rows with count=5 back into 5 rows.

if I could get count=5 turned into count=5,5,5,5,5, then I could split and then mvexpand the rows, and if I did the foo NOT foo | append [] trick, I could theoretically get FlashTimeline's y-axis correct again.

Probably with all the duct tape I'm throwing around here, this isnt a great idea, but if anyone could point me in the right direction I'd like to at least evaluate it.

0 Karma

ziegfried
Influencer

The only option I can think of is to write a custom search command which duplicates those events for you based on the count value.

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...