Perfect!!!!!! Works how it used to. Thanks so much. Much appreciated. ... View more

That seems to work, but I'm missing the dates. I see the "Date" text at the bottom, I don't see the horizontal days listed on the charts like I see on my other charts. I do see the vertical numbers on the side of the chart ok. Also I'm not sure how the old chart worked with version 5. Maybe they were more forgiving with my poor splunk searches. ... View more

Well I might have it working, but I'm not quite sure why. I tried this: sourcetype="search1" host=host1 | eventstats last(retrans) AS FBS | eval "TCP Retransmissions" = 'retrans' - FBS |timechart span=1m avg("TCP Retransmissions") This seems to display the chart correctly, but I'm not sure why I have to move the timechart to the end. Any ideas? also does this search do the same thing as my original? ... View more

I created the old dashboard with simple xml. After the upgrade all of my charts worked except a few on one dashboard. Below is one of the broken charts. <chart> <searchTemplate> sourcetype="search1" host=$desktop$ | timechart avg(retrans) as "TCP Retransmissions" | eventstats first("TCP Retransmissions") AS FBS | eval "TCP Retransmissions" = 'TCP Retransmissions' - FBS | fields "TCP Retransmissions" </searchTemplate> <title>TCP Retransmissions Totals</title> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleY.text">TCP Retransmissions)</option> <option name="charting.chart">column</option> <option name="charting.primaryAxisTitle.text"/> <option name="count"><![CDATA[addinfo | eval diff = info_max_time - _time | eval bucket = case(diff <= 86400, "1 day", 86400 < diff AND diff <= 172800, "2 days", 172800 < diff AND diff <= 604800, "1 week", 604800 < diff AND diff <= 1209600, "2 weeks", 1209600 < diff AND diff <= 2628000, "1 month") | chart count by bucket]]> </option> <option name="displayRowNumbers">true</option> </chart> And this is a chart that works fine, but similar. <chart> <searchTemplate>sourcetype="search1" host=$desktop$ | timechart avg(internal_time) as "Ping Time"</searchTemplate> <title>Internal Ping Time</title> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleY.text">Ping Time (ms)</option> <option name="charting.chart">column</option> <option name="charting.primaryAxisTitle.text"/> <option name="count"><![CDATA[addinfo | eval diff = info_max_time - _time | eval bucket = case(diff <= 86400, "1 day", 86400 < diff AND diff <= 172800, "2 days", 172800 < diff AND diff <= 604800, "1 week", 604800 < diff AND diff <= 1209600, "2 weeks", 1209600 < diff AND diff <= 2628000, "1 month") | chart count by bucket]]> </option> <option name="displayRowNumbers">true</option> </chart> <chart> ... View more

The bold lines should not have a 0 and should show 400 ... View more

It seems I can make the changes and fill in the null values. I just can't get my eval to read those values to form the "Powered Off" field. It just shows all 0's. It's like it won't read the null values I have filled. Internal Ping Time External Ping Time Offline Powered Off _time md md 500 0 2016-07-07T12:00:00.000-0500 md md 500 0 2016-07-07T12:01:00.000-0500 md md 500 0 2016-07-07T12:02:00.000-0500 md md md 0 2016-07-07T12:03:00.000-0500 md md md 0 2016-07-07T12:04:00.000-0500 md 48 md 0 2016-07-07T12:05:00.000-0500 md 73 md 0 2016-07-07T12:06:00.000-0500 ... View more

So I have this: sourcetype=search1 host=host1 | eval Offline=if(internal_time="NA" AND careers_time="NA",500,"NA") | timechart span=1m avg(internal_time) as "Internal Ping Time" avg(careers_time) as "External Ping Time" avg(Offline) as Offline | fillnull value="md" "Internal Ping Time" "External Ping Time" Offline | eval "Powered Off"=if("Internal Ping Time"="md" AND "External Ping Time"="md" AND Offline="md",400,0) | fields "Internal Ping Time" "External Ping Time" Offline "Powered Off" I get output that looks like: 1 7/7/16 12:00:00.000 PM md md 500.000000 0 2 7/7/16 12:01:00.000 PM md md 500.000000 0 3 7/7/16 12:02:00.000 PM md md 500.000000 0 4 7/7/16 12:03:00.000 PM md md md 0 Here is where I think I should see 250 5 7/7/16 12:04:00.000 PM md md md 0 Here is where I think I should see 250 6 7/7/16 12:05:00.000 PM md 48.000000 md 0 7 7/7/16 12:06:00.000 PM md 73.000000 md 0 8 7/7/16 12:07:00.000 PM md 48.000000 md 0 9 7/7/16 12:08:00.000 PM md 80.000000 md 0 10 7/7/16 12:09:00.000 PM 78.000000 md md 0 11 7/7/16 12:10:00.000 PM md md md 0 ... View more

Thanks for that! I think I'm close. I think I have the fillnull working now. I then use that data to try to create my "Power Off" field. It's only showing 0's. I can see the "Internal Ping Time" and "External Ping Time" both = "md" sourcetype="search1" host=host1 | eval Offline=if(internal_time="NA" AND careers_time="NA",500,"NA") | timechart span=1m avg(internal_time) as "Internal Ping Time" avg(careers_time) as "External Ping Time" avg(Offline) as Offline | fillnull value="md" "Internal Ping Time" "External Ping Time" | eval "Powered Off"=if("Internal Ping Time"="md" AND "External Ping Time"="md",250,0) | fields "Internal Ping Time" "External Ping Time" Offline "Powered Off" ... View more

the foreach comes up with an unknown search command error. The other search gives an error for the compares unless I put the 0 in quotes. It will do the search, but I still don't have a value for the missing data ... View more

This looked like the right format, but still not seeing data. sourcetype="search1" host=host1 | eval Offline=if(internal_time="NA" AND careers_time="NA",500,NA) | fillnull value="nodata" internal_time careers_time | eval NoPower=if(internal_time="nodata" AND careers_time="nodata",250,NA) |timechart avg(internal_time) as "Internal Ping Time" avg(careers_time) as "External Ping Time" avg(Offline) as Offline avg(NoPower) as NoPower ... View more

Sorry, here is my entire search. sourcetype="search1" host=host1 | eval Offline=if(internal_time="NA" AND careers_time="NA",500,NA) | timechart avg(internal_time) as "Internal Ping Time" avg(careers_time) as "External Ping Time" avg(Offline) I still cant get the sections with no data to fill ... View more

Thanks guys, but that is not working. So I might not have given you guys all the info. When I said null, I mean there is no event. My Splunk data is grabbed from a csv file that is updated every min. While a machine is powered down or rebooting that log does not get updated. When I chart info it just show's blanks on a bar. In this case I want to show a value of 100 when that happens. ... View more

Perfect! thanks! ... View more

Currently I don't. I just see a bar chart with "Ping Time". If the value is not a number and is "NA" it shows up at 0 on my chart. I would like that so how up in red and have a value of 1000 instead of "NA" ... View more

I still get the same error, but we plan to upgrade to a newer version by the end of next month. I'll give it a try then. Thanks for the help. Chad ... View more

Thanks and I tried that, but I get this error: XML Syntax Error: Cannot find object mapper for panel type: panel I'm using version 5 of Splunk. ... View more

Very cool, I understand it now. I never even thought about making the chart like this, but I really like the idea. It seems to be easy to read and find the spikes fast. ... View more

Perfect! got it working. Thanks for all the help. ... View more

I see the chart is showing values for both Bytes Sent and FBS. How do I remove the FBS from my chart? ... View more

I tried that, but it did not show the correct numbers I was expecting. I double checked and my data is correct and all the number increase. It should chart a line that continues to go up. This chart showed numbers going up and down. ... View more