Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ashish9433
ashish9433
Communicator
Member since:
01-11-2015
09-25-2023
Community Statistics
| Posts | 84 |
| Solutions | 2 |
| Karma Given | 46 |
| Karma Received | 21 |
| Member Since | 01-11-2015 |
Activity Feed
- Got Karma for Re: Align the first column of the table. 12-02-2021 11:07 PM
- Got Karma for Re: Where does Splunk Technical Assessment App should be exactly installed. 03-18-2021 09:27 AM
- Posted Re: Where does Splunk Technical Assessment App should be exactly installed on Splunk Enterprise. 03-18-2021 08:42 AM
- Karma My Journey of Life with Splunk for vikramyadav. 12-15-2020 06:59 AM
- Got Karma for Remove "All" from Multiselect Input in Dashboard. 10-08-2020 11:36 AM
- Got Karma for Get URL for Splunk ITSI Glasstables with Service Swappning. 09-21-2020 07:08 AM
- Got Karma for Re: how to input encrypted files like PGP encrypted files. 06-29-2020 09:03 AM
- Got Karma for Re: how to input encrypted files like PGP encrypted files. 06-29-2020 08:43 AM
- Got Karma for Re: how to input encrypted files like PGP encrypted files. 06-29-2020 08:39 AM
- Posted Re: how to input encrypted files like PGP encrypted files on Getting Data In. 06-29-2020 08:30 AM
- Karma how to input encrypted files like PGP encrypted files for VSIRIS. 06-29-2020 08:26 AM
- Karma ITSI - Issue with no entities showing in service for rcraft1218. 06-05-2020 12:50 AM
- Karma Re: How can I apply JavaScript on a multiselect dropdown menu? for jeffland. 06-05-2020 12:49 AM
- Karma Re: Heavy Forwarder not showing in Deployment Server for s2_splunk. 06-05-2020 12:49 AM
- Karma Re: Remove "All" from Multiselect Input in Dashboard for ashleyherbert. 06-05-2020 12:49 AM
- Karma Re: Remove "All" from Multiselect Input in Dashboard for niketn. 06-05-2020 12:49 AM
- Got Karma for Remove "All" from Multiselect Input in Dashboard. 06-05-2020 12:49 AM
- Got Karma for Heavy Forwarder not showing in Deployment Server. 06-05-2020 12:49 AM
- Got Karma for Re: Remove "All" from Multiselect Input in Dashboard. 06-05-2020 12:49 AM
- Got Karma for Re: Remove "All" from Multiselect Input in Dashboard. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
09-15-2016
10:17 PM
Check this link, https://answers.splunk.com/answers/63730/using-fieldformat-and-rename.html
It seems that there is a bug or may be splunk has purposely made it that way!
... View more
09-15-2016
10:07 PM
if i sort before and then use eval command, then in that case definetly it will show in sorted format. But as i have mentioned in the question as well, if i click on the field name then the sorting happens as a string because it contains Letters and special characters. Whereas if i use fieldformat, then it works exactly the way i want.
The problem with fieldformat is, it works only when it is the last command in the search query. Incase if try to use fields command or even table command, the value formatted with fieldformat command becomes empty and hence the issue.
... View more
09-14-2016
10:49 PM
Yes, instead of fieldformat, if i use eval the result is proper.
But again due to eval i am not able sort, which fieldformat is able to give me.
... View more
09-13-2016
05:39 AM
Thanks for your effort and revert.
The above search query also not working.
The result is the way if the below is removed
| table Group, new
| rename new AS "Val1"
So again the problem reaches the same point, wherein once the table or even just the rename command is used the formatting of new done using fieldformat command is lost and the value is empty.
... View more
09-13-2016
04:57 AM
@sundareshr updated the search query.
... View more
09-13-2016
04:16 AM
Hi,
I am trying to convert some values with combination of Alphabets, Special Characters and numbers but still want to retain the property to be number so as to be able to sort on numeric values.
The below is an example -> 3.4M (0.00/0.00%)
I am able to do this using fieldformat command, if i use eval command then the numeric property of the field is not retained.
Now the problem is commands like fields, rename, table doesn't work. If any of these commands are used after fieldformat, then the field which was formatted using fieldformat becomes blank.
Can any one guide me, how to overcome this issue.
Note - It is not possible to use fields, rename, table commands before fieldformat in my search query. so need a work around to overcome this issue.
Update - Search Query
index = abc source="2016-09-12" | rename "Name" as Group | lookup parents Node as Group | eval parentsSplit=split(Parents,"|") | table "Group", parentsSplit, "Critical Count" | search parentsSplit="*_OS*" | rename "Critical Count" as new | join type=outer Group [search index = abc source="2016-09-05" | rename "Name" as Group | lookup parents Node as Group | eval parentsSplit=split(Parents,"|") | table "Group", parentsSplit, "Critical Count" | search parentsSplit="*_OS*" | rename "Critical Count" as old] | fillnull VALUE=0 | eval delta=new-old | eval delta_perc=if(old==0,round((delta/1)*100,2),round((delta/old)*100,2)) | eval delta_perc = if(abs(delta_perc)>1000000,round(delta_perc/1000000,1)."M",if(abs(delta_perc)>1000,round(delta_perc/1000,1)."K",delta_perc)) | fieldformat new=if((abs(new)>1000000),round(new/1000000,1)."M",if((abs(new)>1000),round(new/1000,1)."K",round(new,2)))." (".if ((abs(delta)>1000000),if(round(delta/1000000,0)>0,"+".round(delta/1000000,1)."M",round(delta/1000000,1)."M"),if((abs(delta)>1000),if(round(delta/1000,0)>0,"+".round(delta/1000,1)."K",round(delta/1000,1)."K"),if(round(delta,2)>0,"+".round(delta,2),round(delta,2))))."/".delta_perc."%)" |
The above query runs well and gives me the output i want, but once i add the below i get empty result
table Group, new | rename new AS "Val1"
So using table, rename command is not working after fieldformat command.
... View more
09-08-2016
05:01 AM
Hi Sundareshr,
Thanks for your revert. I understand that fieldformat can be used to retain the orignal value of field but i am not able to apply or may be it is not working in my query. Below is my query can you help me to point where exactly and what change do i need to do.
index = abc | rename "Name" as Group | lookup parents Node as Group | eval parentsSplit=split(Parents,"|") | table "Group", parentsSplit, "Critical Count" | search parentsSplit="*_OS*" | rename "Critical Count" as new | join type=outer Group [search index = abc | rename "Name" as Group | lookup parents Node as Group | eval parentsSplit=split(Parents,"|") | table "Group", parentsSplit, "Critical Count" | search parentsSplit="*_OS*" | rename "Critical Count" as old] | fillnull VALUE=0 | eval delta=new-old | eval delta_perc=if(old==0,round((delta/1)*100,2),round((delta/old)*100,2)) | eval delta_perc = if(abs(delta_perc)>1000000,round(delta_perc/1000000,1)."M",if(abs(delta_perc)>1000,round(delta_perc/1000,1)."K",delta_perc)) | eval result=if((abs(new)>1000000),round(new/1000000,1)."M",if((abs(new)>1000),round(new/1000,1)."K",round(new,2)))." (".if ((abs(delta)>1000000),if(round(delta/1000000,0)>0,"+".round(delta/1000000,1)."M",round(delta/1000000,1)."M"),if((abs(delta)>1000),if(round(delta/1000,0)>0,"+".round(delta/1000,1)."K",round(delta/1000,1)."K"),if(round(delta,2)>0,"+".round(delta,2),round(delta,2))))."/".delta_perc."%)" | table Group, result | rename result AS "Val1"
The output of above search query is as below
Group | Val1
A |18.4K (-2.3K/-10.99%)
B |1.1M (+217.1K/25.38%)
C |313.6K (+236.0K/303.90%)
D |3.4M (+2.0M/148.51%)
E |44.00 (+22.00/100.00%)
So now when i click on Val1 i want it to get sorted as M -> K -> Number && Number -> K -> M
Can you help me where and how fieldformat will work in the above query?
Thanks!
... View more
09-08-2016
04:11 AM
Hi,
As far as i know Splunk does not have inbuilt functionality to convert/format number in 10000 as 10K or 1000000 as 1M. So i wrote few eval statements which does the task and i am able to get the result as required.
In the Image above, i have sorted the 2nd column (Val1) and then converted into K's & M's format and it pretty well serves the purpose.
But the issue is, unlike as in the image above i have many columns Val2, Val3..... Val11, with so many rows and whenever i click on the header (Val2, Val3.. or so on) to sort the sort happens on the basis of String. Like if click on Val3 header the sorting will happen like K first then M and then the number or the number, then M and then K
Is there a way/feature by which the sorting happens in a custom or user defined way where in the way in the search query i have sorted before converting into K & M format, i could do so when clicking on the table headers.
... View more
08-08-2016
05:50 AM
Yes, most of them but not all.
In the linechart section, it is specified how all the line in the linechart can be made dotted, but not specified how to apply it for selective lines only.
Also there is no mention of font size and other such options, can you please help me where can i find it?
... View more
08-08-2016
05:20 AM
Hi Team,
Can any one please help me how can I change the size of the font on Splunk charts. Also i wish to make few lines in the Splunk line chart as dotted and relatively less thick.
I am referring to Splunk documentation:
http://docs.splunk.com/Documentation/Splunk/5.0/Viz/CustomChartingConfig-FontColorBrushPalette
I tried as mentioned in the link, but no changes are seen on the visualization. Can anyone please help me? How can I achieve it in Splunk 6.4 as the above link doesn't hold valid for Splunk 6.4 and I am not able to find any reference in Splunk 6.4
... View more
07-27-2016
05:06 AM
yes not exactly the way wanted, but yes! Thanks @woodcock
... View more
07-26-2016
03:30 AM
seems to be good workaround! Thanks @Lucas K
any ideas on how can i make the lines distinct/dotted or bit lighter as compared to other graph lines?
... View more
07-26-2016
01:57 AM
Yes kind off! i was looking for alternatives
But for time being, this can be good to go!
... View more
07-25-2016
08:46 AM
Thanks woodcock!
... View more
07-25-2016
08:46 AM
Thanks Sundareshr!
... View more
07-25-2016
07:47 AM
Hi Sundareshr,
Thanks for your revert!
I am aware of timechart command, but the span option can be pretty usefull when i have atleast a fair idea of difference between the dates.
I can have only 2 days difference to 30-40 days difference in dates in my data, so span doesn't seems to be feasible here, though it can be considered as one way to fix this.
What i wanted was that the location of dates on x-axis is distributed proportionally on the basis of difference between the number of days, instead of equally spaced.
Any other suggestions?
... View more
07-25-2016
07:22 AM
Here goes my search query
index=testindex Name=testName | eval fileDate=mvindex(split(mvindex(split(mvindex(split(source,"\"),-1),"."),0),"_"),1) | eval dateSplit=split(fileDate,"-") | eval displayDate=mvindex(dateSplit,0).mvindex(dateSplit,1).mvindex(dateSplit,2) | stats values(abc) by displayDate
... View more
07-25-2016
05:00 AM
any clues, after looking at the code below?
... View more
07-25-2016
04:58 AM
Hi Team,
Can any one please provide me any help or clue how to map Dates/time proportionally on X-axis of Splunk Chart?
In the below image, the Date on x-axis is placed at equidistant from others dates, irrespective of the differrence in number of days between the dates.
The First value on x-axis is 27 Jan 2016, 2nd value 10 Feb 2016 (difference in number of days - 14)
The 2nd value on x-axis is 10 Feb 2016 and 3rd value is 02 March 2016 (difference in number of days - 21)
And similarly, there are variations in number of days in the x-axis, but irrespective of difference in number of days between them, they all are placed in equidistant.
Do we have any functionality in Splunk, wherein this situation can be handled and the dates on x-axis are place proportional to the gap between them.
... View more
07-19-2016
02:02 AM
Let us suppose, i have a chart as below
search = basically count of events in all of my index and assume that score is the count (in the main question image).
This is the XML code with no modification (default)
<dashboard>
<label>Chart Colouring</label>
<description>Test App</description>
<row>
<panel>
<chart>
<search>
<query>index=* | stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</dashboard>
I tried adding the below code
<option name="charting.backgroundBrush">solidFill</option>
<option name="charting.backgroundBrush.color">0xFF0000</option>
<option name="charting.backgroundBrush.alpha">0.5</option>
in the dashboard as below
<dashboard>
<label>Chart Colouring</label>
<description>Test App</description>
<row>
<panel>
<chart>
<search>
<query>index=* | stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.backgroundBrush">solidFill</option>
<option name="charting.backgroundBrush.color">0xFF0000</option>
<option name="charting.backgroundBrush.alpha">0.5</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</dashboard>
and i even tried adding the below code
<option name="charting.backgroundBrush">gradientFill</option>
<option name="charting.backgroundBrush.type">radial</option>
<option name="charting.backgroundBrush.colors">[0xFF0000,0x0000FF]</option>
<option name="charting.backgroundBrush.alphas">[1,1]</option>
<option name="charting.backgroundBrush.ratios">[0,255]</option>
<option name="charting.backgroundBrush.focalPointRatio">.5</option>
in the XML code as below
<dashboard>
<label>Chart Colouring</label>
<description>Test App</description>
<row>
<panel>
<chart>
<search>
<query>index=* | stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.backgroundBrush">gradientFill</option>
<option name="charting.backgroundBrush.type">radial</option>
<option name="charting.backgroundBrush.colors">[0xFF0000,0x0000FF]</option>
<option name="charting.backgroundBrush.alphas">[1,1]</option>
<option name="charting.backgroundBrush.ratios">[0,255]</option>
<option name="charting.backgroundBrush.focalPointRatio">.5</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</dashboard>
But there was no change in the background of the chart. I am able to change the background (white color) to any one single colour by adding the below code
<option name="charting.backgroundColor">0xFFFFFF</option>
But how do i add multiple colours in the background with specific conditions is what i am looking at.
Can you help me what exactly i am missing? or what way should i proceed to get the required background in the chart?
... View more
07-18-2016
04:44 AM
I tried and read all the links thoroughly, and i got one link which describes filling the background of the graph.
http://docs.splunk.com/Documentation/Splunk/6.2.10/AdvancedDev/CustomChartingConfig-FontColorBrushPalette#Examples_2
So basically changing the background to one specific colour is working. But i when i tried some other options like SolidFill, GradientFill with multiple colours i do not see any change in the graph.
Is there anything i am missing?
... View more
07-13-2016
04:27 AM
The above link, does helps me to change the color of the chart. But i do not see any hint of changing the background color of chart. Is there something which i am missing? Can you help?
... View more
07-12-2016
05:53 AM
2 Karma
Hi Team,
Can any one help me to know if conditional coloring is possible in Splunk Charts as shown in the below image?
Basically, the background color will be horizontal divisions on basis of condition defined, like for the below chart,
0-5 -> Low - Green Colour
6-25-> Medium - Yellow Colour
more than 25 -> High - Amber Colour
Please guide how such chart can be made in Splunk Dashboard.
Update
If not colouring, atleast can we add additional graph lines, perhaps dotted across the graph to show the threshold boundaries?
Anyone who can help on pointers on this?
... View more
06-22-2016
02:38 AM
Thanks @kbarker302,
This logic worked and i am able to get the result as i wanted.
Many thanks!
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-25-2023
03:20 PM
|
