Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gnovak
gnovak
Builder
Member since:
10-07-2010
06-05-2020
Community Statistics
| Posts | 373 |
| Solutions | 6 |
| Karma Given | 6 |
| Karma Received | 45 |
| Member Since | 10-07-2010 |
Activity Feed
- Karma Re: Splunk Disaster Recovery for chris. 06-05-2020 12:46 AM
- Karma Re: Splunk Disaster Recovery for bmacias84. 06-05-2020 12:46 AM
- Karma Re: Regex not pulling out all values for Ayn. 06-05-2020 12:46 AM
- Karma Re: Regex not pulling out all values for Ayn. 06-05-2020 12:46 AM
- Karma Re: Transforms, Regex and wrong source names OH MY! for martin_mueller. 06-05-2020 12:46 AM
- Got Karma for Re: Regex not pulling out all values. 06-05-2020 12:46 AM
- Got Karma for LDAP User Base Filter. 06-05-2020 12:46 AM
- Got Karma for LDAP User Base Filter. 06-05-2020 12:46 AM
- Got Karma for Re: Schedule search every 12 hours. 06-05-2020 12:46 AM
- Got Karma for Splunk Disaster Recovery. 06-05-2020 12:46 AM
- Got Karma for Splunk Disaster Recovery. 06-05-2020 12:46 AM
- Got Karma for Splunk Disaster Recovery. 06-05-2020 12:46 AM
- Got Karma for Splunk Disaster Recovery. 06-05-2020 12:46 AM
- Got Karma for Splunk Disaster Recovery. 06-05-2020 12:46 AM
- Got Karma for Splunk Disaster Recovery. 06-05-2020 12:46 AM
- Got Karma for Splunk 4.3 upgrade question - disable?. 06-05-2020 12:46 AM
- Got Karma for Timechart values not working. 06-05-2020 12:46 AM
- Got Karma for Splunk URL redirect. 06-05-2020 12:46 AM
- Got Karma for Re: props.conf extractions. 06-05-2020 12:46 AM
- Got Karma for single value won't turn green. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-03-2011
07:55 PM
I've been working with dashboards for a bit so figured I'd ask questions and maybe help or learn even more!
In your dashboards are you using saved searches or inline searches for the dashboard?
Can you add host=PSDKXP0* (for example) to the beginning of the search for the production dashboard and see what your results are?
Or were you looking to use splunk to filter them automatically? I assume automatically.....
... View more
12-29-2010
06:44 PM
also wondering do i have to start translating the rest of this to advanced XML perhaps?
... View more
12-29-2010
06:38 PM
OH and the space in the URL for INFO lurker is a typo! sorry
... View more
12-29-2010
06:37 PM
btw the single value search results for INFO do not show up, and only one single value shows up for asia and org. there should be 2 single values for each along with a link to a 3rd party application to view more details about the single value that was generated.
... View more
12-29-2010
06:35 PM
After I added a drop down menu to my dashboard, I started to receive this error. My second row of single values doesn't appear to be working correctly now and I'm not sure what the cause is.
Originally in this code, i started the code at the very top of the file with <dashboard> and ended the code at the very bottom with </dashboard> . However after I added the drop down menu, I removed the dashboard and now the code start at the top with <form> and ends at the bottom with </form> . I'm not sure if this is relevant but thought I would throw it in there.
either way i can't get my single value searches to work correctly any more. I'm wondering do I now have to add modules to the code? Do I need to add a value somewhere that I'm missing? Here is the code for the entire page. Once the code gets to the row grouping, i believe something is wrong. The error i receive is "found an invalid value for layoutPanel - 'panel_row2_col4'."
Any ideas? I'm still playing around with this trying to figure it out.
<form>
<label>Balance Email Summary - Last 24 Hours</label>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true" />
<default>Last 7 days</default>
</fieldset>
<row>
<chart>
<title>Total Emails For All Registries</title>
<searchTemplate><![CDATA[ sourcetype="cron_BalanceEmail" (source="*asia*" OR source="*info*" OR source="*org*") BalanceEmail sent | rex field=_raw "\[BalanceEmail\] ?(?<TotalEmailsSent>[\d]+) of (?<TotalEmailsToSend>[\d]+) of email notification sent\." | search TotalEmailsToSend="*" OR TotalEmailsSent="*" | timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent ]]></searchTemplate>
<option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
<option name="charting.chart.useAbsoluteSpacing">true</option>
<option name="charting.chart.columnSpacing">5</option>
<option name="charting.legend.placement">top</option>
<module name="TimeRangePicker">
<param name="selected">Last 7 days</param>
<param name="searchWhenChanged">True</param>
</module>
</chart>
</row>
<row grouping="3,3,3">
<html>
<h1><b>INFO</b></h1>
<a href="https://lists.afilias.info/lurker/mindex/info-cc- notify@20990101.050000.00000000.en.html">Check INFO stats on Lurker</a><br />
</html>
<single>
<searchName>balance_email_to_send_info</searchName>
<fields>TotalEmailsToSend</fields>
<option name="beforeLabel">Total Emails To Send</option>
</single>
<single>
<searchName>balance_email_sent_info</searchName>
<fields>TotalEmailsSent</fields>
<option name="beforeLabel">Total Emails Sent</option>
</single>
<html>
<h1><b>ASIA</b></h1>
<a href="https://lists.afilias.info/lurker/mindex/asia-cc-notify@20990101.050000.00000000.en.html">Check ASIA stats on Lurker</a><br />
</html>
<single>
<searchName>balance_email_to_send_asia</searchName>
<fields>TotalEmailsToSend</fields>
<option name="beforeLabel">Total Emails To Send</option>
</single>
<single>
<searchName>balance_email_sent_asia</searchName>
<fields>TotalEmailsSent</fields>
<option name="beforeLabel">Total Emails Sent</option>
</single>
<html>
<h1><b>ORG</b></h1>
<a href="https://lists.afilias.info/lurker/mindex/org-cc-notify@20990101.050000.00000000.en.html">Check ORG stats on Lurker</a>
</html>
<single>
<searchName>balance_email_to_send_org</searchName>
<fields>TotalEmailsToSend</fields>
<option name="beforeLabel">Total Emails To Send</option>
</single>
<single>
<searchName>balance_email_sent_org</searchName>
<fields>TotalEmailsToSend</fields>
<option name="beforeLabel">Total Emails Sent</option>
</single>
</row>
<row>
<table>
<title>Registrar Emails Sent ALL</title>
<searchName>balance_email_sent_registrars</searchName>
<fields>_time, Registrar</fields>
</table>
<table>
<title>Registrar Emails Sent .INFO</title>
<searchName>balance_email_sent_registrars_info</searchName>
<fields>_time, Registrar</fields>
</table>
</row>
<row>
<table>
<title>Registrar Emails Sent .ASIA</title>
<searchName>balance_email_sent_registrars_asia</searchName>
<fields>_time, Registrar</fields>
</table>
<table>
<title>Registrar Emails Sent .ORG</title>
<searchName>balance_email_sent_registrars_org</searchName>
<fields>_time, Registrar</fields>
</table>
</row>
</form>
... View more
- Tags:
- form-search
12-29-2010
04:32 PM
I had to take out from the top of the code and from the bottom of the code.
... View more
12-29-2010
03:59 PM
This actually works if I make a new "view" or dashboard and put this code in it. However I am having issues trying to incorporate this code with my current dashboard. At some point the view shows up as "None" in the views menu and when I click it I get an error.
I'm still looking into this but not sure why it's doing this.
... View more
12-22-2010
09:40 PM
I'm starting to wonder: do i have to make this entire dashboard advanced XML now to be able to add a drop down menu where the user can select the timerange for the search results?
... View more
12-22-2010
09:20 PM
Also keep in mind that code for the drop down I "borrowed" from another example so the $timespan$ token i am not sure is relevant to the search or not. I was trying to find more data on what exactly to specify for a token but that info is sometimes hard to find.
... View more
12-22-2010
09:17 PM
When you say "use a different saved search that is configured with is_visible=False." what do you mean? Can you explain?
... View more
12-22-2010
08:28 PM
I tried putting this search directly in the dashboard xml but it threw an error. I had sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(? [\d]+) of (? [\d]+) of email notification sent." | search TotalEmailsToSend="" OR TotalEmailsSent="" | timechart $timeSpan$ sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent and it did not work. Also where do I put the code for the drop down?
... View more
12-21-2010
08:32 PM
Also here is the search as well: sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(? [\d]+) of (? [\d]+) of email notification sent." | search TotalEmailsToSend="" OR TotalEmailsSent=""
| timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent
... View more
12-21-2010
08:31 PM
1 Karma
Hi,
I'm trying to add a drop down menu to a chart I have created on my dashboard but I can't seem to get it to work. The code for the chart on my dashboard is:
<label>Balance Email Summary - Last 24 Hours</label>
<row>
<chart>
<title>Total Emails For All Registries</title>
<searchName>balance_email_sent_and_tosend</searchName>
<option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
<option name="charting.chart.useAbsoluteSpacing">true</option>
<option name="charting.chart.columnSpacing">5</option>
<option name="charting.legend.placement">top</option>
</chart>
I'd like to add a drop down menu to this so that users can select the time span they would like for the search.
The code I have for the drop down menu is:
<input type="time"/>
<input type="dropdown" token="timeSpan">
<label>Time span for charts</label>
<default>span=4h</default>
<choice value="span=5m">5 Minute</choice>
<choice value="span=10m">10 Minutes</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=4h">4 hours</choice>
<choice value="span=24h">24 hours</choice>
<choice value="span=7d">7 days</choice>
<choice value="rt">Real-time</choice>
</input>
I've tried inserting this before row and after row but I still can't seem to get it to show up or work. Is there something anyone notices out of the ordinary that I could be missing?
... View more
- Tags:
- timerangepicker
12-21-2010
07:27 PM
Chart generated nicely! Thanks for the help as I missed a few minor details as usual!
... View more
12-21-2010
07:25 PM
This worked. sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(? [\d]+) of (? [\d]+) of email notification sent." | search TotalEmailsToSend="" OR TotalEmailsSent=""
| timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent
... View more
12-21-2010
07:09 PM
Here are the 2 saved searches:
Total Emails to Send search:
sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsToSend="*" | timechart sum(TotalEmailsToSend)
Total Emails Sent search:
sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsSent="*" | timechart sum(TotalEmailsSent)
... View more
12-21-2010
06:59 PM
1 Karma
Hi
Is it possible to chart data from 2 saved searches? I currently have 2 charts that are generated, each using a single saved search to generate each chart. What I'd like to do is combine 2 saved searches into one chart. The chart is displaying the data in columns.
Currently the code I have in my dashboard to generate the charts is below:
<row>
<chart>
<title>Total Emails To Send For All Registries</title>
<searchName>balance_email_to_send</searchName>
<option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
<option name="charting.chart.useAbsoluteSpacing">true</option>
<option name="charting.chart.columnSpacing">5</option>
<option name="charting.legend.placement">top</option>
</chart>
<chart>
<chart>
<title>Total Emails Sent To All Registries</title>
<searchName>balance_email_sent</searchName>
<option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
<option name="charting.chart.useAbsoluteSpacing">true</option>
<option name="charting.chart.columnSpacing">5</option>
<option name="charting.legend.placement">top</option>
</chart>
How can I have both of these saved searches generate data in 1 chart? Oh and also add another color and category to the legend too.
... View more
- Tags:
- charting
12-17-2010
05:46 PM
I just noticed the one line for the drop down I believe should be span=4h
... View more
12-17-2010
05:42 PM
Ok so here goes. I have been working with some charts for about a week now and have slowly started to get results. However I'm still a bit stuck here. I will explain:
First, here is the search I am using to generate the chart:
sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsToSend="*" | chart sum(TotalEmailsToSend) over date_wday
And here is the snipped from the dashboard XML file where I have the code to generate the chart:
<chart>
<title>Total Emails To Send For All Registries</title>
<searchName>balance_email_to_send</searchName>
<option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
<option name="charting.chart.useAbsoluteSpacing">true</option>
<option name="charting.chart.columnSpacing">5</option>
<option name="charting.legend.placement">top</option>
</chart>
The chart is generated, but the days of the week aren't displayed in order.
I have tried changing the end of the search to be chart sum(TotalEmailsToSend) over _time but when I do this, the columns in the graph are thin and the secondary axis values change and are not a reflection of the actual number of email that were sent out.
I want to have the dates displayed on the bottom of the chart (as opposed to just the name of the day of the week) and I'd like them to be in order. Also if possible, if there was a way to add a drop down menu to the chart to allow the user to select the time range they want, that would also be great.
I found this in a ticket on answers.splunk.com regarding a drop dowm menu, but not sure if this is correct as it threw me an error when I tried to add it to my xml file or the dashboard. I perhaps put it in the wrong spot?
<input type="time"/>
<input type="dropdown" token="timeSpan">
<label>Time span for charts</label>
<default>span=4h</span>
<choice value="span=5m">5 Minute</choice>
<choice value="span=10m">10 Minutes</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=4h">4 hours</choice>
<choice value="span=24h">24 hours</choice>
<choice value="span=7d">7 days</choice>
<choice value="rt">Real-time</choice>
Can anyone spot the obvious things I may be doing wrong?
... View more
- Tags:
- charting
12-10-2010
08:52 PM
advanced xml is here i believe:
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Total Emails To Send For All Registries" autoRun="True">
<param name="savedSearch">balance_email_to_send</param>
<param name="groupLabel">Total Emails To Send For All Registries</param>
<module name="ViewstateAdapter">
<param name="savedSearch">balance_email_to_send</param>
<module name="HiddenFieldPicker">
<param name="fields">TotalEmailsToSend</param>
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">bar</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">400</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
... View more
12-10-2010
07:51 PM
The search for "balance_email_to_send" looks like this:
sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="24" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(? [\d]+) of (? [\d]+) of email notification sent." | search TotalEmailsToSend="*" | chart sum(TotalEmailsToSend)
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
