Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About robertlynch2020
robertlynch2020
Influencer
Member since:
11-05-2015
3 weeks ago
Community Statistics
| Posts | 656 |
| Solutions | 34 |
| Karma Given | 100 |
| Karma Received | 66 |
| Member Since | 11-05-2015 |
Activity Feed
- Posted Re: How to Graph white space before and after my data in a stats graph on Splunk Enterprise. 11-18-2025 02:00 AM
- Karma Re: How to Graph white space before and after my data in a stats graph for bowesmana. 11-18-2025 01:31 AM
- Karma Re: How to Graph white space before and after my data in a stats graph for ITWhisperer. 11-18-2025 01:31 AM
- Posted How to Graph white space before and after my data in a stats graph on Splunk Enterprise. 11-14-2025 07:57 AM
- Got Karma for Re: Can i create trellis with overlays, when the overlap can be dynamic.. 11-05-2025 10:53 AM
- Posted Re: Can i create trellis with overlays, when the overlap can be dynamic. on Dashboards & Visualizations. 11-05-2025 08:57 AM
- Karma Re: Can i create trellis with overlays, when the overlap can be dynamic. for tscroggins. 11-05-2025 08:56 AM
- Karma Re: Can i create trellis with overlays, when the overlap can be dynamic. for tscroggins. 11-05-2025 08:26 AM
- Got Karma for Re: Is it possible to Monitor Splunk User activity?. 11-05-2025 02:56 AM
- Posted Re: Can i create trellies wiht overlays, when the overlap can by dynamic. on Dashboards & Visualizations. 11-04-2025 02:46 AM
- Karma Re: Can i create trellies wiht overlays, when the overlap can by dynamic. for livehybrid. 11-03-2025 02:30 AM
- Posted Can i create trellis with overlays, when the overlap can be dynamic. on Dashboards & Visualizations. 10-31-2025 05:53 AM
- Karma Re: Can i have overlap on a Multi-series graph for livehybrid. 10-09-2025 06:52 AM
- Posted Re: Can i have overlap on a Multi-series graph on Splunk Enterprise. 10-08-2025 09:40 AM
- Posted Can i have overlap on a Multi-series graph on Splunk Enterprise. 10-08-2025 09:02 AM
- Posted Re: Search for a path the might not exist on Splunk Search. 05-28-2025 01:39 AM
- Karma Re: Search for a path the might not exist for livehybrid. 05-28-2025 01:39 AM
- Karma Re: Search for a path the might not exist for yuanliu. 05-28-2025 01:38 AM
- Posted Re: Search for a path the might not exist on Splunk Search. 05-22-2025 08:46 AM
- Posted Re: Search for a path the might not exist on Splunk Search. 05-22-2025 08:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-01-2019
05:42 AM
Hi
I have an accelerated datamodel, so what is "data that is not summarized". Is this data that will be summarized if i give it more time?
Thanks
Rob
... View more
02-01-2019
04:28 AM
1 Karma
How do I know when | tstats summariesonly=true is 100% finished on an accelerated Data-model?
I have issues where we upload log drops into Splunk from yesterday, so HOST=_NEW_LOG_DROP (So, No new data will go-into this host).
We have noticed that with | tstats summariesonly=true , the performance is a lot better, so we want to keep it on.
However often, users are clicking to see this data and getting a blank screen as the data is not 100% ready.
We can use | tstats summariesonly=false , but we have hundreds of millions of lines, and the performance is better with | tstats summariesonly=true .
So i was thinking, do I run a command like this?
| tstats summariesonly=true count(All_TPS_Logs.duration) AS count FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =***
vs
| tstats summariesonly=false count(All_TPS_Logs.duration) AS count FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =***
And when one equals the other the data-model is 100% done?
Thanks in Advance
Rob
... View more
02-01-2019
02:43 AM
Hi
Cheers as always for the answer.
My indexers are not peered to more then one search head, I only have one.
Rob 🙂
... View more
02-01-2019
02:43 AM
Hi
Thanks for the answer and the explanation.
I was logging into the indexer and turning on the datamodels. So i wont do this from now on
What you said sounds correct.
Rob
... View more
02-01-2019
02:41 AM
Hi - Yes it was
We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.
Rob
... View more
02-01-2019
02:40 AM
Hi - Yes it was
We changed the architecture from each forwarder pulling/pushing from one machine not 2.
So if one goes down it does not affect the other.
Rob
... View more
02-01-2019
02:34 AM
To be honest this issues is not happening anymore, after an upgrade to 7.0.3. Perhaps something changed
... View more
02-01-2019
02:34 AM
At the moment i have one indexer and one search head.
To be honest this issues is not happening anymore, after an upgrade to 7.0.3. Perhaps something changed
... View more
02-01-2019
02:31 AM
Hi
I agree i think this is what is happening.
However i taught warm and hot will be accessed at the same speed, this is the bit i am not really getting.
Rob
... View more
02-01-2019
02:29 AM
ok thanks
... View more
01-23-2019
08:43 AM
Hi
Thanks, i will look into this.
One of my issues is i need the value (string) not just numbers(stats) to come back sometimes, so i am not 100% sure if i will be able to use it. As i got the feeling metrics. I will try it out and get back.
I will mark the answer as accepted for the moment and i will report back.
Rob
... View more
01-23-2019
08:41 AM
HI
Ok cool
Cheers
... View more
01-22-2019
04:59 AM
Hi
I use the same storage for cold and warm SSD.
Rob
... View more
01-22-2019
04:14 AM
Hi Woodcook
This is a funny one, sometimes is happens a lot and other times it does not happen as much. So i as startign to think is it to do with other verabiles not just the dashboard code..
Below is how i set the enter_saved_test_id - a simple input.
</input>
<input type="text" token="enter_saved_test_id" searchWhenChanged="true">
<label>Enter an existing SPLUNK_ID</label>
</input>
... View more
01-22-2019
04:12 AM
HI
I have removed some of the tokens that were not been used, but the issue can still happen - But not as frequent.
<form script="table_cell_highlighting.js,table_cell_highlighting1.js" hideFilters="true" refresh="30">
<label>KPI_MONITORING</label>
<description>Last 12 Hours by default (Auto Refresh 30 seconds)</description>
<search>
<!-- Search Test ID Details in SavedTest.csv-->
<query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID, Log_or_Live</query>
<earliest>0</earliest>
<latest></latest>
<done>
<condition match="'job.resultCount'==0">
<set token="form.enter_saved_test_id">Test not found</set>
</condition>
<condition>
<set token="form.time_token.earliest">$result.Start$</set>
<set token="form.time_token.latest">$result.Stop$</set>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="enter_saved_test_id" searchWhenChanged="true">
<label>Enter an existing SPLUNK_ID</label>
</input>
</fieldset>
... View more
01-21-2019
09:16 AM
MR Woodcock, i hope you are well 🙂
Thanks for the answer, this is what worked
inputs.conf
[default]
host = hp400srv_5000
[splunktcp://5997]
connection_host = ip
outputs.conf
# Turn off indexing on the search head
[indexAndForward]
index = false
[tcpout]
defaultGroup = my_search_peers
forwardedindex.filter.disable = true
indexAndForward = false
[tcpout:my_search_peers]
server=10.25.5.169:5997,10.25.53.57:5997
Cheers
Rob
... View more
01-21-2019
09:04 AM
HI
Thanks for you efforts for this question, sorry i have voted @niketnilay answers out of the two.
Thanks Again for the help
Rob
... View more
01-21-2019
09:02 AM
1 Karma
Hi
Thanks for this, this worked and I understand the example.
perfect 🙂
Rob
... View more
01-21-2019
04:17 AM
Hi
A SPL line is retrieving data 100% all of the time, but it retrieves data 70% of the time when used as dashboard code "Test not found" pops up).
Its like the query did not run correctly and returns 0. its like there is a "race condition"
..any ideas would be great and thanks 🙂
<search>
<!-- Search Test ID Details in SavedTest.csv-->
<query>| inputlookup Saved_Tests.csv | where ID="$enter_saved_test_id$" | table ID, Host, Test_Name, Comments, Status, Start, Stop, Version, MX_Build_ID, Log_or_Live</query>
<earliest>0</earliest>
<latest></latest>
<done>
<condition match="'job.resultCount'==0">
<set token="form.enter_saved_test_id">Test not found</set>
</condition>
<condition>
<unset token="execute_save_test"></unset>
<unset token="save_test"></unset>
<set token="host_token">$result.Host$</set>
<set token="form.host_token">$result.Host$</set>
<set token="form.time_token.earliest">$result.Start$</set>
<set token="form.time_token.latest">$result.Stop$</set>
<eval token="form.save_test_status">$result.Status$</eval>
<set token="form.save_test_name_token">$result.Test_Name$</set>
<set token="form.save_test_comments">$result.Comments$</set>
<set token="saved_test_id">$result.ID$</set>
</condition>
</done>
</search>
... View more
01-20-2019
07:50 AM
Hi
Sorry, but i am confused.
I have ended up with this but it not working, but i am still referring to myTableSearch at the top of the code and i am unsure how to deal with the issues form the Splunk code where i am referencing 2 things tableid and search ID.
For one table
<table id="highlight1">
<search id="myTableSearch1">
SO i want to be able to say for second table
<table id="highlight2">
<search id="myTableSearch2">
require([
"underscore",
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/simplexml/ready!"
], function(_, $, mvc, SearchManager, TableView) {
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch");
var myResults = mySearch.data("results", {count:0});
var allFields,filteredFields;
myResults.on("data", function(){
allFields=myResults.data().fields;
filteredFields=allFields.filter(filterFields);
console.log("Filtered Fields:",filteredFields);
});
function filterFields(field) {
return field !== "_time";
}
// Row Coloring Example with custom, client-side range interpretation
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for all fields except TAG
return _(filteredFields).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = parseInt(cell.value);
// Apply interpretation based on count of errors per TAG for each field
if(cell.field !== "_time"){
if (value >= 5) {
$td.addClass("range-cell").addClass("range-severe");
}
else if (value >= 1 && value < 5) {
$td.addClass("range-cell").addClass("range-elevated");
}
else if (value < 1) {
$td.addClass("range-cell").addClass("range-low");
}
// Update the cell content
$td.text(value).addClass("numeric");
}
}
});
var tableIDs = ["myTableSearch","myTableSearch2","myTableSearch3"];
for (i=0;i<tableIDs.length;i++) {
var sh = mvc.Components.get(tableIDs[i]);
if(typeof(sh)!="undefined") {
sh.getVisualization(function(tableView) {
// Add custom cell renderer and force re-render
tableView.table.addCellRenderer(new CustomRangeRenderer());
tableView.table.render();
});
}
}
});
... View more
01-20-2019
04:28 AM
1 Karma
@niketnilayn
This is a great answer and thanks
https://answers.splunk.com/answers/618930/how-can-i-get-the-table-cell-colorization-renderin-1.html
I was wondering if you could tell me how to apply it to more then one table.
I need to have 2 tables with different color needs, however my java script it not great at all.
For example the first example is working fine
I have copied the javascript and made a new one called table_cell_render_all_cells1.js, so i want the second table to refer to that one.
First Table (Working)
<row>
<panel depends="$alaysHideCSS$">
<html>
<style>
#highlight td {
background-color: #6DB7C6 !important;
}
*/
#highlight td.range-low {
color: #6DB7C6;
}
#highlight td.range-elevated {
background-color: #ffc57a !important;
font-weight: bold;
}
#highlight td.range-severe {
background-color: #d59392 !important;
font-weight: bold;
}
</style>
</html>
</panel>
<panel>
<title>NOK - Real Time (Count)</title>
<table id="highlight">
<search id="myTableSearch">
<query>| tstats summariesonly=true values(All_TPS_Logs.duration) AS Duration max(All_TPS_Logs.duration) AS All_TPS_Logs.duration FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =*** GROUPBY _time, All_TPS_Logs.fullyQualifiedMethod span=1s
| rename All_TPS_Logs.fullyQualifiedMethod as series
| rename All_TPS_Logs.duration as value
| table _time series value
| search (series=**murex**)
| lookup TPS_TAGS_HIGH_LEVEL Method#Class AS "series" OUTPUT TAG Threshold
| where value > Threshold
| fillnull Threshold
| fillnull TAG
| eval TAG=if(TAG=0,"PLEASE_ADD_TAG",TAG)
| search NOT TAG = "PLEASE_ADD_TAG"
| timechart span=1h count(value) by TAG
| untable _time TAG value
| eval c_time=strftime(_time,"%F %T")
| xyseries TAG c_time value | rename TAG as _time</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
However the second one is not - On the same page. I have changed a few things for example
<table id="highlight1">
<search id="myTableSearch1">
-------------------
<row>
<panel depends="$alaysHideCSS$">
<html>
<style>
#highlight1 td {
background-color: #6DB7C6 !important;
}
*/
#highlight1 td.range-low {
color: #6DB7C6;
}
#highlight1 td.range-elevated {
background-color: #ffc57a !important;
font-weight: bold;
}
#highlight1 td.range-severe {
background-color: #d59392 !important;
font-weight: bold;
}
</style>
</html>
</panel>
<panel>
<title>OK - Real Time (Count)</title>
<table id="highlight1">
<search id="myTableSearch1">
<query>| tstats summariesonly=true values(All_TPS_Logs.duration) AS Duration max(All_TPS_Logs.duration) AS All_TPS_Logs.duration FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =*** GROUPBY _time, All_TPS_Logs.fullyQualifiedMethod span=1s
| rename All_TPS_Logs.fullyQualifiedMethod as series
| rename All_TPS_Logs.duration as value
| table _time series value
| search (series=**murex**)
| lookup TPS_TAGS_HIGH_LEVEL Method#Class AS "series" OUTPUT TAG Threshold
| where value > Threshold
| fillnull Threshold
| fillnull TAG
| eval TAG=if(TAG=0,"PLEASE_ADD_TAG",TAG)
| search NOT TAG = "PLEASE_ADD_TAG"
| timechart span=1h count(value) by TAG
| untable _time TAG value
| eval c_time=strftime(_time,"%F %T")
| xyseries TAG c_time value | rename TAG as _time</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
Seconds Java script
I have changed one thing, myTableSearch1 as i reference this in my second table.
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch1");
require([
"underscore",
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/simplexml/ready!"
], function(_, $, mvc, SearchManager, TableView) {
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch1");
var myResults = mySearch.data("results", {count:0});
var allFields,filteredFields;
myResults.on("data", function(){
allFields=myResults.data().fields;
filteredFields=allFields.filter(filterFields);
console.log("Filtered Fields:",filteredFields);
});
function filterFields(field) {
return field !== "_time";
}
// Row Coloring Example with custom, client-side range interpretation
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for all fields except _time
return _(filteredFields).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = parseInt(cell.value);
// Apply interpretation based on count of errors per _time for each field
if(cell.field !== "_time"){
if (value >= 5) {
$td.addClass("range-cell").addClass("range-severe");
}
else if (value >= 1 && value < 5) {
$td.addClass("range-cell").addClass("range-elevated");
}
else if (value < 1) {
$td.addClass("range-cell").addClass("range-low");
}
// Update the cell content
$td.text(value).addClass("numeric");
}
}
});
mvc.Components.get("highlight1").getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
any help would be super and thanks
... View more
01-20-2019
04:06 AM
Hi
Thank very much for this, i think i have found the issue.
If i use table it works, i was using | xyseries TAG c_time value (This does not work) .
However i need to use | xyseries TAG c_time value as the values i am producing are dynamic (Its time and a date[I have also now need the year and month etc..] so its changing all the time) so unless i can use the table command and sat TAG and everything..not sure that is possible.
However this is not the end of the world if i use _time that table does not look so bad..
So again thanks for you help you have been very very good 🙂
... View more
01-18-2019
08:17 AM
On a separate question.
If i have 2 tables with different colors needs on the same page.
AS you can have 2 tables with the same ID i hvae tried to duplicate as much as i can... but i am missing something
I have tried to duplicate your cool script
Then i have renamed parts, but
<search id="myTableSearch1">
Then in the script
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch1");
But i cant get it to work, so sorry my java script is not great, what else do i need to change.
so this is my trying to call the new script
<panel depends="$alaysHideCSS$">
<html>
<style>
#highlight1 td {
background-color: #6DB7C6 !important;
}
*/
#highlight1 td.range-low {
color: #6DB7C6;
}
#highlight1 td.range-elevated {
background-color: #ffc57a !important;
font-weight: bold;
}
#highlight1 td.range-severe {
background-color: #d59392 !important;
font-weight: bold;
}
</style>
</html>
</panel>
<panel>
<title>OK - Real Time (Count)</title>
<table id="highlight1">
<search id="myTableSearch1">
<query>| tstats summariesonly=true values(All_TPS_Logs.duration) AS Duration max(All_TPS_Logs.duration) AS All_TPS_Logs.duration FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =*** GROUPBY _time, All_TPS_Logs.fullyQualifiedMethod span=1s
| rename All_TPS_Logs.fullyQualifiedMethod as series
| rename All_TPS_Logs.duration as value
| table _time series value
| search (series=**murex**)
| lookup TPS_TAGS_HIGH_LEVEL Method#Class AS "series" OUTPUT TAG Threshold
| where value > Threshold
| fillnull Threshold
| fillnull TAG
| eval TAG=if(TAG=0,"PLEASE_ADD_TAG",TAG)
| search NOT TAG = "PLEASE_ADD_TAG"
| timechart span=1h count(value) by TAG
| untable _time TAG value
| eval c_time=strftime(_time,"%F %T")
| xyseries TAG c_time value | rename TAG as _time
$time_token.earliest$
$time_token.latest$
1
20
none
none
false
false
false
true
and this is the new scripts. I have only change one line
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch1");
require([
"underscore",
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/simplexml/ready!"
], function(_, $, mvc, SearchManager, TableView) {
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch1");
var myResults = mySearch.data("results", {count:0});
var allFields,filteredFields;
myResults.on("data", function(){
allFields=myResults.data().fields;
filteredFields=allFields.filter(filterFields);
console.log("Filtered Fields:",filteredFields);
});
function filterFields(field) {
return field !== "_time";
}
// Row Coloring Example with custom, client-side range interpretation
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for all fields except _time
return _(filteredFields).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = parseInt(cell.value);
// Apply interpretation based on count of errors per _time for each field
if(cell.field !== "_time"){
if (value >= 5) {
$td.addClass("range-cell").addClass("range-severe");
}
else if (value >= 1 && value < 5) {
$td.addClass("range-cell").addClass("range-elevated");
}
else if (value < 1) {
$td.addClass("range-cell").addClass("range-low");
}
// Update the cell content
$td.text(value).addClass("numeric");
}
}
});
mvc.Components.get("highlight1").getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
Thanks in advance
Rob
... View more
01-18-2019
08:05 AM
Hi
Thanks for your replay.
I added in the workaround of renaming it to _time as if i leave it as TAG i will get NaN.
I don't have any NULL values.
So if i try the follwing i will get NaN, but if i use my workaround of renaming | rename TAG as _time it working. The data does not change.
The below code does not work. (Unless i change 2 things, 1st rename TAG to _time and update script from TAG to _time)
<query>| tstats summariesonly=true values(All_TPS_Logs.duration) AS Duration max(All_TPS_Logs.duration) AS All_TPS_Logs.duration FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =*** GROUPBY _time, All_TPS_Logs.fullyQualifiedMethod span=1s
| rename All_TPS_Logs.fullyQualifiedMethod as series
| rename All_TPS_Logs.duration as value
| table _time series value
| search (series=**murex**)
| lookup TPS_TAGS_HIGH_LEVEL Method#Class AS "series" OUTPUT TAG Threshold
| where value > Threshold
| fillnull Threshold
| fillnull TAG
| eval TAG=if(TAG=0,"PLEASE_ADD_TAG",TAG)
| search NOT TAG = "PLEASE_ADD_TAG"
| timechart span=1h count(value) by TAG
| untable _time TAG value
| eval c_time=strftime(_time,"%F %T")
| xyseries TAG c_time value </query>
require([
"underscore",
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/simplexml/ready!"
], function(_, $, mvc, SearchManager, TableView) {
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch");
var myResults = mySearch.data("results", {count:0});
var allFields,filteredFields;
myResults.on("data", function(){
allFields=myResults.data().fields;
filteredFields=allFields.filter(filterFields);
console.log("Filtered Fields:",filteredFields);
});
function filterFields(field) {
return field !== "TAG";
}
// Row Coloring Example with custom, client-side range interpretation
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for all fields except TAG
return _(filteredFields).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = parseInt(cell.value);
// Apply interpretation based on count of errors per TAG for each field
if(cell.field !== "TAG"){
if (value >= 5) {
$td.addClass("range-cell").addClass("range-severe");
}
else if (value >= 1 && value < 5) {
$td.addClass("range-cell").addClass("range-elevated");
}
else if (value < 1) {
$td.addClass("range-cell").addClass("range-low");
}
// Update the cell content
$td.text(value).addClass("numeric");
}
}
});
mvc.Components.get("highlight").getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
... View more
01-18-2019
04:38 AM
Hi
Thanks for the replay, however i am having issues getting it to work without _time in the javascript.
I have replaced _time with TAG, but i get NaN for the values.
An ideas?
require([
"underscore",
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/simplexml/ready!"
], function(_, $, mvc, SearchManager, TableView) {
var mySearch = splunkjs.mvc.Components.getInstance("myTableSearch");
var myResults = mySearch.data("results", {count:0});
var allFields,filteredFields;
myResults.on("data", function(){
allFields=myResults.data().fields;
filteredFields=allFields.filter(filterFields);
console.log("Filtered Fields:",filteredFields);
});
function filterFields(field) {
return field !== "TAG";
}
// Row Coloring Example with custom, client-side range interpretation
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for all fields except TAG
return _(filteredFields).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = parseInt(cell.value);
// Apply interpretation based on count of errors per TAG for each field
if(cell.field !== "TAG"){
if (value >= 5) {
$td.addClass("range-cell").addClass("range-severe");
}
else if (value >= 1 && value < 5) {
$td.addClass("range-cell").addClass("range-elevated");
}
else if (value < 1) {
$td.addClass("range-cell").addClass("range-low");
}
// Update the cell content
$td.text(value).addClass("numeric");
}
}
});
mvc.Components.get("highlight").getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
For record this is the full code i am running
<row>
<panel depends="$alaysHideCSS$">
<html>
<style>
#highlight td {
background-color: #c1ffc3 !important;
}
*/
#highlight td.range-low {
color: #C0D9D9;
}
#highlight td.range-elevated {
background-color: #ffc57a !important;
font-weight: bold;
}
#highlight td.range-severe {
background-color: #d59392 !important;
font-weight: bold;
}
</style>
</html>
</panel>
<panel>
<table id="highlight">
<search id="myTableSearch">
<query>| tstats summariesonly=true values(All_TPS_Logs.duration) AS Duration max(All_TPS_Logs.duration) AS All_TPS_Logs.duration FROM datamodel=TPS_V5 WHERE (nodename=All_TPS_Logs host=LUAS_2019_01_01 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") All_TPS_Logs.name =*** GROUPBY _time, All_TPS_Logs.fullyQualifiedMethod span=1s
| rename All_TPS_Logs.fullyQualifiedMethod as series
| rename All_TPS_Logs.duration as value
| table _time series value
| search (series=**murex**)
| lookup TPS_TAGS_HIGH_LEVEL Method#Class AS "series" OUTPUT TAG Threshold
| where value > Threshold
| fillnull Threshold
| fillnull TAG
| eval TAG=if(TAG=0,"PLEASE_ADD_TAG",TAG)
| search NOT TAG = "PLEASE_ADD_TAG"
| timechart span=1h count(value) by TAG
| untable _time TAG value
| eval c_time=strftime(_time,"%T")
| xyseries TAG c_time value | rename TAG as _time</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma given to
