Knowledge Management

bizarre multivalue/mvexpand question

sideview
SplunkTrust
SplunkTrust

In complex reporting views I often use the FlashTimeline module near the top, to allow the user to regenerate the FlashCharts and other reports for just the timerange that they click or drag on the FlashTimeline.

Unfortunately when the reports on such a view get converted to pull data from a summary index, the y-axis scale on the FlashTimeline becomes confusing, because of course each individual 'event' in the summary data is actually representing N events, but nobody tells the FlashTimeline this.

One approach I've taken elsewhere is to strip the FlashTimeline down so that it has no y-axis, and so the bars are all the same height and it becomes effectively a big 'navigation strip'.

However I feel like there's maybe some cruel and unusual search language that can turn my summary rows with count=5 back into 5 rows.

if I could get count=5 turned into count=5,5,5,5,5, then I could split and then mvexpand the rows, and if I did the foo NOT foo | append [] trick, I could theoretically get FlashTimeline's y-axis correct again.

Probably with all the duct tape I'm throwing around here, this isnt a great idea, but if anyone could point me in the right direction I'd like to at least evaluate it.

0 Karma

ziegfried
Influencer

The only option I can think of is to write a custom search command which duplicates those events for you based on the count value.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...