Splunk Search

Search command. -

jaibalaraman
Path Finder

Hi 

I am not sure about this value risk score. 

How do i create dashboard tile for this fields

jaibalaraman_0-1712703374369.png

 

0 Karma

jaibalaraman
Path Finder

Hi 
How do i change the max column, in readable format like 40 mins , 30 mins or 1 hrs 

 

jaibalaraman_0-1712711384079.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Instead of dealing with the messiness of a natural language, it might be better to use standard notation of duration, like

| fieldformat max(event.Properties.duration) = tostring('max(event.Properties.duration)', "duration")

Instead of 40 mins , 30 mins or 1 hrs, you get 00:40:00, 00:30:00, 01:00:00, and so on.

Tags (1)
0 Karma

jaibalaraman
Path Finder

Yes i trying to find out max duration and the endpoint which is associated with 

event.Properties.endpoint

event.Properties.duration.

0 Karma

yuanliu
SplunkTrust
SplunkTrust
| chart max('event.Properties.duration') by event.Properties.endpoint

Something like this?

0 Karma

jaibalaraman
Path Finder

I tried the search, but not getting the max number 

jaibalaraman_0-1712711067486.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

max(), avg() and stdev() are all aggregation functions which you can include on a stats command in your search

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Aggregatefunctions

 

0 Karma

jaibalaraman
Path Finder

Hi Thanks for the responce 

yes, i have gone through aggregate function, could you please help how to implement in the code 

Exp 1 -  chart eval(avg(size)/max(delay)) AS ratio BY host user 

 OR      timechart eval(round(avg(cpu_seconds),2)) BY processor

 

 

jaibalaraman_0-1712704159039.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

That'll depends on what you want to show for your risk score.  Do you want to show max?  Do you want to show avg?  Is there a groupby field you want to use?

Note the excerpted examples from the document are very specific to the problem the examples are trying to illustrate.  It is not a substitute for you to describe your desired output.  If you don't tell people, volunteers would have no way to read your mind.

In the simplest form, you can experiment with something like

 

| chart avg('event.Properties.riskScore')
  max('event.Properties.riskScore')
  min('event.Properties.riskScore')
  stdev('event.Properties.riskScore')

 

But you already did this.  So, what is your desired output?  Alternatively, what is the use case you are trying to apply?  What is the business problem you are trying to solve/illustrate using this dashboard?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...