Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vnravikumar
vnravikumar
Champion
Member since:
01-07-2019
11-19-2023
Community Statistics
| Posts | 904 |
| Solutions | 224 |
| Karma Given | 2 |
| Karma Received | 300 |
| Member Since | 01-07-2019 |
Activity Feed
- Got Karma for Re: Why is there a 10000 rows limit?. 03-16-2026 09:07 AM
- Got Karma for Re: How do you use regex to escape a backslash?. 07-29-2025 05:08 AM
- Got Karma for Re: How do you remove the first letter of a value?. 06-18-2025 12:47 PM
- Got Karma for Re: Fix table header and add vertical scrollbar using CSS and JavaScript. 03-17-2025 09:11 PM
- Got Karma for Re: Mouse hover tooltip on inputs. 12-12-2024 04:58 AM
- Got Karma for Re: Changing data label font size. 12-09-2024 02:22 PM
- Got Karma for Re: How to make table row count 100 over?. 11-08-2024 01:25 AM
- Got Karma for Re: How to sort a chart based on a sum?. 11-04-2024 09:42 AM
- Got Karma for Re: How to sort a chart based on a sum?. 11-04-2024 09:41 AM
- Got Karma for Re: If statement wild card. 10-11-2024 03:26 AM
- Got Karma for Re: Mouse hover tooltip on inputs. 08-22-2024 03:21 AM
- Got Karma for Re: Using panel id to change background color of panel. 06-25-2024 11:49 PM
- Got Karma for Re: How do you have a drilldown condition use Field AND Match?. 05-28-2024 10:41 AM
- Got Karma for Re: Fix table header and add vertical scrollbar using CSS and JavaScript. 03-06-2024 01:29 AM
- Got Karma for Re: View the parameters, e.g. from limits.conf using the search. 02-09-2024 08:47 AM
- Got Karma for Re: regex - everything after last slash. 01-26-2024 07:03 AM
- Got Karma for Re: Why is there a 10000 rows limit?. 09-14-2023 03:17 AM
- Got Karma for Re: Increase width of a multiselect? Of a timepicker?. 04-26-2023 12:49 PM
- Got Karma for Re: How do you remove the first letter of a value?. 04-22-2023 03:19 AM
- Got Karma for Re: How to unset token if I choose other values from dropdown. 04-19-2023 06:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
05-13-2020
11:18 PM
1 Karma
Can you please accept my answer?
... View more
05-13-2020
07:38 AM
have you used transpose command?
... View more
05-13-2020
04:42 AM
1 Karma
Hi
Check this sample
<dashboard>
<label>chart</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal
| stats count by sourcetype
| transpose 0 header_field=sourcetype |fields - column</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
<option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f, 0x11a88b]</option>
</chart>
</panel>
</row>
</dashboard>
... View more
05-13-2020
01:18 AM
I not able to find, can you post the URL?
... View more
05-13-2020
12:05 AM
Hi
Check this
| rex field=Account_Domain max_match=0 "(?P<Account_Domain>\w+)"
... View more
05-12-2020
09:44 PM
2 Karma
Hi
Try this
| makeresults
| eval url="/api/clients/11111/interactions,/api/clients/22222/interactions,/api/clients/33333/profiles"
| makemv delim="," url
| mvexpand url
| rex mode=sed field=url "s/\/\w+//3"
| rename url as service_name
| stats count by service_name
... View more
05-12-2020
06:52 AM
Please accept the answer.
... View more
05-12-2020
06:42 AM
1 Karma
You can use table command with the required column at the end
... View more
05-12-2020
06:21 AM
1 Karma
Hi
Try this
source="jsonfile"
| rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number
| eval data=mvzip(mvzip(id,Number),Status)
| mvexpand data
| makemv data delim=","
| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2)
| fields - data
... View more
05-12-2020
06:16 AM
Hi
$result.<fieldname>$ - The token accesses the value from the first row of returned results.
You can check here:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/EventHandlerReference
... View more
05-12-2020
05:41 AM
Please accept my answer
... View more
05-12-2020
05:39 AM
1 Karma
Hi
Try this
| makeresults
| eval id="02,03,01"
| makemv delim="," id
| appendcols
[| makeresults
| eval Number="30,20,40"
| makemv delim="," Number]
| appendcols
[| makeresults
| eval Status="In progress,In Progress,To Do"
| makemv delim="," Status]
| fields - _time
| eval temp=mvzip(mvzip(id,Number),Status)
| fields temp
| mvexpand temp
| eval temp_value=split(temp,",")
| eval id=mvindex(temp_value,0), Number=mvindex(temp_value,1), Status=mvindex(temp_value,2)
| table id Number Status
... View more
05-12-2020
04:40 AM
Hi
You can try this also
| makeresults
| eval str="14/04/2020|A3|ABC149251|text"
| rex field=str "(?P<output>[^|]+)$"
... View more
05-12-2020
04:36 AM
Hi
Try like
| rex field=user_description "\((?P<result>[^)]+)"
... View more
05-12-2020
04:09 AM
Hi
Still, it is missing
... View more
05-12-2020
03:55 AM
Is it possible to post your XML?
... View more
05-12-2020
12:46 AM
Hi
Try this
30 2,10,18 * * *
... View more
05-11-2020
08:12 PM
Hi
Check this
| makeresults
| eval _raw="{\"userid\": 1, \"action\": \"development (project)\", \"user_description\": \" Michael Jordan (adm-Jordan)\"}"
| spath path=user_description output=user_description
| rex field=user_description "\((?P<result>[^)]+)"
... View more
05-11-2020
03:11 AM
Hi
Check this,
<dashboard>
<label>singlecolor</label>
<row depends="$hide$">
<html>
<style>
#$blur${
-webkit-filter: blur(5px);
background-color: #ccc;
}
</style>
</html>
</row>
<row>
<panel>
<single id="rk">
<search>
<query>| makeresults
| eval value=0
| table value</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<condition match="'result.value' =="0"">
<set token="blur">rk</set>
</condition>
<condition>
<unset token="blur"></unset>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
... View more
05-11-2020
12:15 AM
1 Karma
Hi
Check this sample and let me know
<dashboard>
<label>singlecolor</label>
<row depends="$hide$">
<html>
<style>
#$blur${
-webkit-filter: blur(5px);
background-color: #ccc;
}
</style>
</html>
</row>
<row>
<panel>
<single id="rk">
<search>
<query>| makeresults
| eval value=20
| table value |where value!=20</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' ==0">
<set token="blur">rk</set>
</condition>
<condition>
<unset token="blur"></unset>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</dashboard>
... View more
05-07-2020
11:00 PM
Hi
Check this sample, if it does not help share your query
<dashboard>
<label>chart</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal
| stats count by sourcetype
| transpose 0 header_field=sourcetype |fields - column</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</dashboard>
... View more
05-07-2020
10:22 PM
1 Karma
Hi
Check this, drilldown value will available in value token
<dashboard>
<label>drilldown</label>
<row>
<panel>
<table>
<title>$value$</title>
<search>
<query>| makeresults
| eval A=1, B=2, C=3
| append
[| makeresults
| eval A=4, B=5, C=6]|table A B C</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<condition field="A">
<set token="value">$click.value$</set>
</condition>
<condition field="B">
</condition>
<condition field="C">
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
05-07-2020
10:00 PM
Hi
Check this
https://www.splunk.com/en_us/blog/tips-and-tricks/i-cant-make-my-time-range-picker-pick.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-19-2023
05:21 PM
|
