×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
msivill_splunk
Splunk Employee
Member since: ‎03-22-2016
‎05-18-2022
Community Statistics
Posts 164
Solutions 21
Karma Given 8
Karma Received 27
Member Since ‎03-22-2016
Activity Feed
View All

Re: Table customization Phone looking table CSS, p...

by Splunk Employee in Dashboards & Visualizations
‎04-17-2019 10:35 AM
‎04-17-2019 10:35 AM
With the Scalable Vector Graphics - Custom Visualization app you can paint images onto the page based on the data in Splunk (for example paint the button values onto the phone itself). However, given the dynamic nature of the rows coming in (i.e. no upper limit), I suspect using this visualisation won't work for this use case. If you know an upper limit for rows to could code a SVG visualization to handle this. If you look at the battery bars or truck examples in the SVG app it can "dynamically" handle up to 5 or 10 things because that is what the image was built to do. Perhaps someone with CSS ninja skills might be able to help you out. ... View more

Re: Table customization Phone looking table CSS, p...

by Splunk Employee in Dashboards & Visualizations
‎04-17-2019 10:12 AM
‎04-17-2019 10:12 AM
I can't quite visualise what you want to get to. Is the phone in the middle a static image, how does the phone buttons on the outside of the phone relate to what's on the phone screen. How does the phone screen change when only a few rows are returned vs many rows returned? Any chance of fleshing out your mockup showing one with few rows returned and one with many rows returned. I'm thinking about potentially another visualisation (Scalable Vector Graphics - Custom Visualization) but it depends on what you are trying to do and if that app might work. ... View more

Re: Table customization Phone looking table CSS, p...

by Splunk Employee in Dashboards & Visualizations
‎04-17-2019 09:52 AM
‎04-17-2019 09:52 AM
Is the number of rows in the table static or will they never exceed a certain number of rows? Are you planning to have a number next to different phone button icons? ... View more

Re: How to do custom visualization?

by Splunk Employee in Dashboards & Visualizations
‎04-16-2019 11:26 AM
‎04-16-2019 11:26 AM
I was able to create the following with the Scalable Vector Graphics - Custom Visualization app in Trellis layout for consideration. While it takes a different approach it should create something close to the original question by leveraging the Trellis layout. Example SPL - | makeresults count=6 | streamstats count | eval name = CASE (count==1, "Human Resource", count==2, "Marketing", count==3, "Customer Support", count==4, "Sales", count==5, "Accounting", count==6, "Distribution") | eval count = random()%3000 | stats sum(count) as count by name | eval outer_color = CASE(count <= 1000, "#B6DCFE", count <= 2000, "#BA9B48", 1==1, "#FF8080" ) | eval inner_color = CASE(count <= 1000, "#4788C7", count <= 2000, "#FFEEA3", 1==1, "#FF0000" ) | eval svg_viz = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 40 50\" version=\"1.1\"> <g> <path style=\" stroke:none;fill-rule:nonzero;fill:".inner_color.";fill-opacity:1;\" d=\"M 14.5 29.832031 L 14.5 28 C 14.5 26.085938 13.332031 24.238281 11.980469 22.101563 C 10.347656 19.523438 8.5 16.601563 8.5 13 C 8.5 6.660156 13.660156 1.5 20 1.5 C 26.339844 1.5 31.5 6.660156 31.5 13 C 31.5 16.601563 29.652344 19.523438 28.019531 22.101563 C 26.667969 24.238281 25.5 26.085938 25.5 28 L 25.5 29.832031 Z M 14.5 29.832031 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:".outer_color.";fill-opacity:1;\" d=\"M 20 2 C 26.066406 2 31 6.933594 31 13 C 31 16.457031 29.191406 19.316406 27.597656 21.835938 C 26.261719 23.945313 25 25.941406 25 28 L 25 29.332031 L 15 29.332031 L 15 28 C 15 25.941406 13.738281 23.945313 12.402344 21.835938 C 10.808594 19.316406 9 16.457031 9 13 C 9 6.933594 13.933594 2 20 2 M 20 1 C 13.371094 1 8 6.371094 8 13 C 8 19.667969 14 23.957031 14 28 L 14 30.332031 L 26 30.332031 L 26 28 C 26 23.957031 32 19.667969 32 13 C 32 6.371094 26.628906 1 20 1 Z M 20 1 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#FFFFFF;fill-opacity:1;\" d=\"M 22.714844 11.335938 C 23.214844 11.335938 23.6875 11.53125 24.042969 11.886719 C 24.777344 12.617188 24.777344 13.808594 24.042969 14.542969 L 22 16.585938 L 22 29 L 18 29 L 18 16.585938 L 15.957031 14.542969 C 15.222656 13.808594 15.222656 12.617188 15.957031 11.886719 C 16.3125 11.53125 16.785156 11.335938 17.285156 11.335938 C 17.789063 11.335938 18.261719 11.53125 18.613281 11.886719 L 19.292969 12.566406 L 20 13.269531 L 20.707031 12.5625 L 21.386719 11.886719 C 21.742188 11.53125 22.210938 11.335938 22.714844 11.335938 M 22.714844 10.335938 C 21.976563 10.335938 21.238281 10.617188 20.679688 11.179688 L 20 11.855469 L 19.320313 11.179688 C 18.757813 10.617188 18.023438 10.335938 17.285156 10.335938 C 16.546875 10.335938 15.8125 10.617188 15.25 11.179688 C 14.125 12.300781 14.125 14.125 15.25 15.25 L 17 17 L 17 30 L 23 30 L 23 17 L 24.75 15.25 C 25.875 14.125 25.875 12.304688 24.75 11.179688 C 24.1875 10.617188 23.449219 10.335938 22.714844 10.335938 Z M 22.714844 10.335938 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 24 35 C 24 37.210938 22.210938 39 20 39 C 17.789063 39 16 37.210938 16 35 C 16 32.789063 17.789063 31 20 31 C 22.210938 31 24 32.789063 24 35 Z M 24 35 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#DCD5F2;fill-opacity:1;\" d=\"M 17 36.5 C 15.621094 36.5 14.5 35.378906 14.5 34 L 14.5 28.5 L 25.5 28.5 L 25.5 34 C 25.5 35.378906 24.378906 36.5 23 36.5 Z M 17 36.5 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 25 29 L 25 34 C 25 35.101563 24.101563 36 23 36 L 17 36 C 15.898438 36 15 35.101563 15 34 L 15 29 L 25 29 M 26 28 L 14 28 L 14 34 C 14 35.65625 15.34375 37 17 37 L 23 37 C 24.65625 37 26 35.65625 26 34 Z M 26 28 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 19 34 L 25.488281 34 L 25.488281 35 L 19 35 Z M 19 34 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 14.558594 34 L 17 34 L 17 35 L 14.558594 35 Z M 14.558594 34 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 19 32 L 26 32 L 26 33 L 19 33 Z M 19 32 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 14 32 L 17 32 L 17 33 L 14 33 Z M 14 32 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 19 30 L 26 30 L 26 31 L 19 31 Z M 19 30 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 14 30 L 17 30 L 17 31 L 14 31 Z M 14 30 \"/> </g> <text dominant-baseline=\"central\" text-anchor=\"middle\" x=\"20\" y=\"45\" font-family=\"sans-serif\" font-size=\"12\" fill=\"black\">".count."</text> </svg>" Dashboard XML - <dashboard> <label>Light bulbs</label> <row> <panel> <viz type="svg.svg"> <search> <query>| makeresults count=6 | streamstats count | eval name = CASE (count==1, "Human Resource", count==2, "Marketing", count==3, "Customer Support", count==4, "Sales", count==5, "Accounting", count==6, "Distribution") | eval count = random()%3000 | stats sum(count) as count by name | eval outer_color = CASE(count <= 1000, "#B6DCFE", count <= 2000, "#BA9B48", 1==1, "#FF8080" ) | eval inner_color = CASE(count <= 1000, "#4788C7", count <= 2000, "#FFEEA3", 1==1, "#FF0000" ) | eval svg_viz = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 40 50\" version=\"1.1\"> <g> <path style=\" stroke:none;fill-rule:nonzero;fill:".inner_color.";fill-opacity:1;\" d=\"M 14.5 29.832031 L 14.5 28 C 14.5 26.085938 13.332031 24.238281 11.980469 22.101563 C 10.347656 19.523438 8.5 16.601563 8.5 13 C 8.5 6.660156 13.660156 1.5 20 1.5 C 26.339844 1.5 31.5 6.660156 31.5 13 C 31.5 16.601563 29.652344 19.523438 28.019531 22.101563 C 26.667969 24.238281 25.5 26.085938 25.5 28 L 25.5 29.832031 Z M 14.5 29.832031 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:".outer_color.";fill-opacity:1;\" d=\"M 20 2 C 26.066406 2 31 6.933594 31 13 C 31 16.457031 29.191406 19.316406 27.597656 21.835938 C 26.261719 23.945313 25 25.941406 25 28 L 25 29.332031 L 15 29.332031 L 15 28 C 15 25.941406 13.738281 23.945313 12.402344 21.835938 C 10.808594 19.316406 9 16.457031 9 13 C 9 6.933594 13.933594 2 20 2 M 20 1 C 13.371094 1 8 6.371094 8 13 C 8 19.667969 14 23.957031 14 28 L 14 30.332031 L 26 30.332031 L 26 28 C 26 23.957031 32 19.667969 32 13 C 32 6.371094 26.628906 1 20 1 Z M 20 1 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#FFFFFF;fill-opacity:1;\" d=\"M 22.714844 11.335938 C 23.214844 11.335938 23.6875 11.53125 24.042969 11.886719 C 24.777344 12.617188 24.777344 13.808594 24.042969 14.542969 L 22 16.585938 L 22 29 L 18 29 L 18 16.585938 L 15.957031 14.542969 C 15.222656 13.808594 15.222656 12.617188 15.957031 11.886719 C 16.3125 11.53125 16.785156 11.335938 17.285156 11.335938 C 17.789063 11.335938 18.261719 11.53125 18.613281 11.886719 L 19.292969 12.566406 L 20 13.269531 L 20.707031 12.5625 L 21.386719 11.886719 C 21.742188 11.53125 22.210938 11.335938 22.714844 11.335938 M 22.714844 10.335938 C 21.976563 10.335938 21.238281 10.617188 20.679688 11.179688 L 20 11.855469 L 19.320313 11.179688 C 18.757813 10.617188 18.023438 10.335938 17.285156 10.335938 C 16.546875 10.335938 15.8125 10.617188 15.25 11.179688 C 14.125 12.300781 14.125 14.125 15.25 15.25 L 17 17 L 17 30 L 23 30 L 23 17 L 24.75 15.25 C 25.875 14.125 25.875 12.304688 24.75 11.179688 C 24.1875 10.617188 23.449219 10.335938 22.714844 10.335938 Z M 22.714844 10.335938 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 24 35 C 24 37.210938 22.210938 39 20 39 C 17.789063 39 16 37.210938 16 35 C 16 32.789063 17.789063 31 20 31 C 22.210938 31 24 32.789063 24 35 Z M 24 35 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#DCD5F2;fill-opacity:1;\" d=\"M 17 36.5 C 15.621094 36.5 14.5 35.378906 14.5 34 L 14.5 28.5 L 25.5 28.5 L 25.5 34 C 25.5 35.378906 24.378906 36.5 23 36.5 Z M 17 36.5 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 25 29 L 25 34 C 25 35.101563 24.101563 36 23 36 L 17 36 C 15.898438 36 15 35.101563 15 34 L 15 29 L 25 29 M 26 28 L 14 28 L 14 34 C 14 35.65625 15.34375 37 17 37 L 23 37 C 24.65625 37 26 35.65625 26 34 Z M 26 28 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 19 34 L 25.488281 34 L 25.488281 35 L 19 35 Z M 19 34 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 14.558594 34 L 17 34 L 17 35 L 14.558594 35 Z M 14.558594 34 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 19 32 L 26 32 L 26 33 L 19 33 Z M 19 32 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 14 32 L 17 32 L 17 33 L 14 33 Z M 14 32 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 19 30 L 26 30 L 26 31 L 19 31 Z M 19 30 \"/> <path style=\" stroke:none;fill-rule:nonzero;fill:#8B75A1;fill-opacity:1;\" d=\"M 14 30 L 17 30 L 17 31 L 14 31 Z M 14 30 \"/> </g> <text dominant-baseline=\"central\" text-anchor=\"middle\" x=\"20\" y=\"45\" font-family=\"sans-serif\" font-size=\"12\" fill=\"black\">".count."</text> </svg>"</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="height">450</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </dashboard> While it is not using the same query, hopefully, you get an idea on how to put it together. I found and tweaked the following SVG images (lightbulb1, lightbulb2) from Icons8 as the basis of the light bulb images. ... View more

Re: SVG vizualization does not generate if there i...

by Splunk Employee in All Apps and Add-ons
‎04-16-2019 09:58 AM
‎04-16-2019 09:58 AM
Version 3.0.1 of the Scalable Vector Graphics - Custom Visualization app has been updated to show different error messages. If there are no events from the query results then the standard "No results found" will be returned Errors with the svg_viz field not appearing in the query results or not having a value will return "SVG field error" Errors with bad SVG in svg_viz filed will return "SVG parse error" While this does not solve the original issue it should help narrow down any potential issues quicker by identifying where the error may be. ... View more

Re: Quick State visualization Works in Search but...

by Splunk Employee in All Apps and Add-ons
‎03-29-2019 05:52 AM
‎03-29-2019 05:52 AM
If you are open to looking at alternative options the Scalable Vector Graphics - Custom Visualization has just been updated to support trellis layouts. So you could achieve something similar with custom images, the caveat being that it uses SVG to display images, not JPG/PNG. Example SVG trellis layout generating different battery levels Example SVG trellis layout generating different counter numbers ... View more

Re: Universal forwarded schedule

by Splunk Employee in Getting Data In
‎03-27-2019 03:43 PM
‎03-27-2019 03:43 PM
In your script could you record the status of the script elsewhere? For example update/create a file when the script starts then update/delete the same file when the scripts finishes? The script should also check the same file to see the state of the file before the main processing happens. With this approach, you could set the script to run at smaller intervals without worrying about a previous run completing. ... View more

Re: Built SVG app visualizations in the wild

by Splunk Employee in All Apps and Add-ons
‎03-15-2019 07:09 AM
1 Karma
‎03-15-2019 07:09 AM
1 Karma
To get the ball rolling here is a complex example I built early on with the SVG app. ... View more

Built SVG app visualizations in the wild

by Splunk Employee in All Apps and Add-ons
‎03-15-2019 07:06 AM
‎03-15-2019 07:06 AM
Hi, I'm looking for examples where people have built something with the SVG custom visualization app whether it is in a customer's Splunk instance, a demo, or anywhere else. There's a call for papers at .conf 2019 and I'm considering running a follow-up session to last years Visualize This, Mother Trucker session which introduced the app. This year I am hoping I can focus on what people have created with the app. If you have something that could be showcased as part of a .conf 2019 SVG app session please share a picture (and possible SPL) of it on this answer. Thanks Mark UPDATE: Unfortunately the SVG paper wasn't accepted for this years .conf (.conf19) however, please feel free to share any interesting things that have been created with the SVG app. ... View more

Re: Remove fields from a query

by Splunk Employee in Splunk Search
‎03-05-2019 08:34 AM
‎03-05-2019 08:34 AM
Could you create an expanded example of the SPL perhaps using | makeresults to generate the data for a standalone example? ... View more

Re: How do you put constraints in rex?

by Splunk Employee in Splunk Search
‎03-05-2019 08:16 AM
‎03-05-2019 08:16 AM
The following might be quicker to execute (untested) index=test_prod sourcetype="test-search-api" SFDC user-agent | rex field=message "x-forwarded-for=(?P<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^,]+)" By putting the search restriction "SFDC user-agent" before the first pipe should mean less work for the rex command as fewer events to process and therefore quicker. Depending on how field extraction is done user_agent=SFDC instead of just "SFDC user-agent" might be even quicker again. If no field extraction is done try "user_agent=SFDC" ... View more

Re: SQL Language - Pull all URLs with specific que...

by Splunk Employee in All Apps and Add-ons
‎01-16-2019 08:41 AM
‎01-16-2019 08:41 AM
Another example, which is self-contained. Everything up to and including the eval url is generating the test data. | makeresults count=4 | streamstats count | eval url = case( count==1, "http://abc.com/?a=1&b=2&c=3", count==2, "http://abc.com/?d=1&e=2&a=3", count==3, "http://abc.com/?f=1&g=2&h=3", count==4, "http://abc.com/?C=1&b=2&a=3") | rex field=url "[^?]*\?(?<url_path>.*)" | eval key_values = split(url_path, "&") | eval matching_keys=mvfilter(match(key_values, "a=") OR match(key_values, "b=")) | where isnotnull(matching_keys) | table url, url_path, matching_keys ... View more

Re: Forwarding to Splunk Light Cloud behind corpor...

by Splunk Employee in Security
‎11-29-2018 02:00 AM
‎11-29-2018 02:00 AM
Have you explored the universal forwarder setup from within Splunk Cloud? Looking at this app in Splunk Cloud then "Download Universal Forwarder Credentials" you will get the required config details (after unzipping the spl file as tar.gz) for sending data over the internet which you can feedback to firewall/bluecoat folks. ... View more

Re: Changing the top bar color for all apps

by Splunk Employee in Dashboards & Visualizations
‎11-29-2018 01:33 AM
‎11-29-2018 01:33 AM
As alternatives a) could you have users display with a different name in the bar so "Marios" in production and "TEST - Marios - TEST" in test b) override the global CSS so that the screen background is not grey, where the dashboard panels sit on top of. https://answers.splunk.com/answers/11709/css-for-view-higher-priority-than-application-css-and-default-css.html cover location of global CSS ... View more

Re: use streamstats for checking multiple column v...

by Splunk Employee in Splunk Search
‎11-15-2018 04:39 AM
‎11-15-2018 04:39 AM
If it is for only ten columns I would expand out the above example. Not sure its difficult (just repetitive) as there is a pattern in the SPL that needs to be repeated. ... View more

Re: use streamstats for checking multiple column v...

by Splunk Employee in Splunk Search
‎11-15-2018 03:51 AM
‎11-15-2018 03:51 AM
A time based one.... | makeresults count=11 | streamstats count as row | eval now = relative_time(now(),"-1m@m") | eval _time = now - ( row * 60 ) | eval a = IF ( (row >= 1 and row <= 3) or (row >= 5 and row <= 8) or (row >= 10 and row <= 11), 1, 0 ) | eval b = IF ( (row >= 2 and row <= 3) or (row == 5) or (row == 10), 1, 0 ) | eval c = IF ( (row >= 4 and row <= 5) or (row == 9) , 1, 0 ) | eval d = IF ( (row == 2) or (row == 7) or (row == 10), 1, 0 ) | table _time, a, b, c, d | streamstats first(_time) as time_a_first, last(_time) as time_a_last by a reset_on_change=true | streamstats first(_time) as time_b_first, last(_time) as time_b_last by b reset_on_change=true | streamstats first(_time) as time_c_first, last(_time) as time_c_last by c reset_on_change=true | streamstats first(_time) as time_d_first, last(_time) as time_d_last by d reset_on_change=true | eval time_a_duration = time_a_first - time_a_last | eval time_b_duration = time_b_first - time_b_last | eval time_c_duration = time_c_first - time_c_last | eval time_d_duration = time_d_first - time_d_last | where (a==0 and time_a_duration >= 180) or (b==0 and time_b_duration >= 180) or (c==0 and time_c_duration >= 180) or (d==0 and time_d_duration >= 180) | stats max(time_a_duration) as a, max(time_b_duration) as b, max(time_c_duration) as c, max(time_d_duration) as d | untable row indicator duration | table indicator duration | where duration >= 180 ... View more

Re: use streamstats for checking multiple column v...

by Splunk Employee in Splunk Search
‎11-15-2018 03:08 AM
‎11-15-2018 03:08 AM
The following is a self contained example, so people can quickly try this in their own instance of Splunk. Everything up to and including the table command generates the test data. | makeresults count=11 | streamstats count as row | eval now = relative_time(now(),"-1m@m") | eval _time = now - ( row * 60 ) | eval a = IF ( (row >= 1 and row <= 3) or (row >= 5 and row <= 8) or (row >= 10 and row <= 11), 1, 0 ) | eval b = IF ( (row >= 2 and row <= 3) or (row == 5) or (row == 10), 1, 0 ) | eval c = IF ( (row >= 4 and row <= 5) or (row == 9) , 1, 0 ) | eval d = IF ( (row == 2) or (row == 7) or (row == 10), 1, 0 ) | table _time, a, b, c, d | streamstats count as count_a by a reset_on_change=true | streamstats count as count_b by b reset_on_change=true | streamstats count as count_c by c reset_on_change=true | streamstats count as count_d by d reset_on_change=true | where (a==0 and count_a >= 4) or (b==0 and count_b >= 4) or (c==0 and count_c >= 4) or (d==0 and count_d >= 4) This will return one or more rows if there are 4 or more continuous 0 matches across any of the columns (a,b,c,d). An assumption is made that a new record appears on the minute. If you want a specific alert for each column you may want to consider running several queries instead of one. ... View more

Re: SVG vizualization does not generate if there i...

by Splunk Employee in All Apps and Add-ons
‎11-13-2018 12:52 PM
‎11-13-2018 12:52 PM
Good catch and workaround. I'll need to dig into how to fix this the next time I get to look at the code behind the SVG app. ... View more

Re: How can I fill different values according to d...

by Splunk Employee in Splunk Search
‎11-13-2018 09:02 AM
‎11-13-2018 09:02 AM
Thank you for accepting the answer ... View more

Re: How do I add ICONS to a table in a Splunk dash...

by Splunk Employee in Dashboards & Visualizations
‎11-13-2018 05:35 AM
‎11-13-2018 05:35 AM
This blog post should provide some pointers for you https://www.splunk.com/blog/2014/03/17/custom-icons-in-splunk-6-tables.html ... View more

Re: How can I fill different values according to d...

by Splunk Employee in Splunk Search
‎11-13-2018 05:12 AM
‎11-13-2018 05:12 AM
Not sure I've got the logic right but you could add the following line to your existing SPL. | eval c_value = CASE ( count==1, "Only One", (count>1 and c_value>1), "Level Up", c_value<0, "Level Down", (count>1 and c_value==0), "Normal" ) Hopefully the above shows the principle. A self-contained example showing this so people can test on thier own Splunk instances (everything upto the first eval c_value is generating the data) | makeresults count=5 | streamstats count as row | eval _time = _time - row | eval count = CASE (row==1,3, row==2,1, 1==1, 2) | eval c_value = CASE ( row==1,-1900,row==2,170,row==3,100,row==4,-100,row==5,0) | eval c_value = CASE ( count==1, "Only One", (count>1 and c_value>1), "Level Up", c_value<0, "Level Down", (count>1 and c_value==0), "Normal" ) ... View more

Re: Search for different values in same field and ...

by Splunk Employee in Splunk Search
‎11-01-2018 01:55 AM
‎11-01-2018 01:55 AM
I'm not familiar with Bro Files, any chance of providing some more cut down examples with incoming event data and expected outcomes? ... View more

Re: use streamstats for checking multiple column v...

by Splunk Employee in Splunk Search
‎11-01-2018 01:51 AM
‎11-01-2018 01:51 AM
Could you pad out the question with some examples of incoming event data and expected outcomes? ... View more

Re: editor for creating templates for Scalable Ve...

by Splunk Employee in All Apps and Add-ons
‎10-31-2018 09:49 AM
‎10-31-2018 09:49 AM
The infrastructure diagrams used in the SVG app dashboards were built with Omnigraffle exported as an SVG file then selectively altered within SPL. The selective alterations within SPL were for changing the numbers on the servers and displaying/hiding the tick/cross icons. I found Omnigraffle good as it had loads of vector images to play around with so creating the "static background" infrastructure diagram was fairly straightforward. I would go for any tool that has a library of vector images and can export directly to SVG. Hope this helps. Please share any interesting SVG images built with the app! ... View more

Re: Search for different values in same field and ...

by Splunk Employee in Splunk Search
‎10-30-2018 03:01 PM
‎10-30-2018 03:01 PM
Any chance of building a small test case using the makeresults command so people can try things out? Example of makeresults generating rows of data can be found on https://answers.splunk.com/answers/600683/i-want-to-diff-the-counts-before-and-after-a-certa.html Example | makeresults count=10 | streamstats count as number, min(_time) as first_time | eval _time = _time - (10-number) | eval site_id = CASE(number=1,"A",number=2,"B",number=3,"B",number=4,"C",number=5,"A",number=6,"A",number=7,"C",number=8,"C",number=9,"C",number=10,"C") | eval cut_off_time = first_time - 5 | eval is_start_count = IF(_time < cut_off_time, "start_count", "current_count") ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎05-18-2022 04:58 AM
Karma given to