Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ramdaspr
ramdaspr
Contributor
Member since:
02-02-2015
06-05-2020
Community Statistics
| Posts | 123 |
| Solutions | 29 |
| Karma Given | 19 |
| Karma Received | 83 |
| Member Since | 02-02-2015 |
Activity Feed
- Got Karma for Re: How to add a first column to number each row in a table so when I export to csv, the results are a list of numbered items?. 04-07-2022 08:12 AM
- Got Karma for Re: Getting multiple stats for a single search. 10-18-2020 08:30 PM
- Got Karma for Re: Getting multiple stats for a single search. 10-18-2020 08:30 PM
- Karma Re: How to edit my search to return one count for each minute that has < 10 events, including minutes where event count is 0? for sideview. 06-05-2020 12:47 AM
- Karma Re: Can you mix Operating Systems in an indexer cluster? for joshd. 06-05-2020 12:47 AM
- Karma Panel not display Description property for zxtdmsoge002. 06-05-2020 12:47 AM
- Karma Re: How to count how many times a field value has changed for a stream of events over a period of time? for musskopf. 06-05-2020 12:47 AM
- Karma Re: How to control the number of top results shown from a search in Splunk 6.1.2? for musskopf. 06-05-2020 12:47 AM
- Karma Re: How to create a table based if condition result? for MuS. 06-05-2020 12:47 AM
- Karma Re: Is _time in UTC or local time? for cpetterborg. 06-05-2020 12:47 AM
- Karma Re: How to calculate multiple durations within a transaction for event pairs? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to create an average on the position for each value in events (ex: Dog = position 1 and 5, Average for Dog = 3)? for aalanisr26. 06-05-2020 12:47 AM
- Karma Re: how to get the total row number of a search result for dwaddle. 06-05-2020 12:47 AM
- Karma Re: If I have a table with daily averages, how do I display the standard deviation of these averages at the bottom of the table as a consolidated result? for acharlieh. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to only show top 5 IPs by Office? for jtrucks. 06-05-2020 12:47 AM
- Karma Re: Replace '&' with ',' for David. 06-05-2020 12:47 AM
- Karma Re: How to extract all values for a single field using rex? for wpreston. 06-05-2020 12:47 AM
- Karma Re: Can I extract the values using 'rex mode=sed' ? for MuS. 06-05-2020 12:47 AM
- Karma Re: Can somone share a simple XML tag to change the Pie Chart label font size? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to pass 2 values at a time in a drilldown when clicking on a row in a table? for somesoni2. 06-05-2020 12:47 AM
Topics I've Started
No posts to display.
03-10-2015
11:10 PM
1 Karma
Well you can use the Code Sample button to write out a code block (5th from the left)
^[ \t]+|[ \t]+$
or surround your code with " "
^[ \t]+|[ \t]+$`
... View more
03-10-2015
05:47 PM
If the column isnt multivalues, you can use streamstats to capture what the first value of the column is and use it to calculate the new column.
... | streamstats first(columnA) as div | eval result=columnB/div | table columnA, ColumnB,result
... View more
03-08-2015
10:41 PM
AFAIK not without accessing the JS. A possible solution is provided here
... View more
03-08-2015
09:36 PM
++ simpler solution.
When i read the docs, it says "Specify the number of results to sort. " so I assumed only the first 3 events would be used but it should says "Specify the number of sorted results to return" instead.
... View more
03-08-2015
09:24 PM
2 Karma
That is because you have a by clause so it is showing you the top 5 MaxCPU for each measObjLdn. You should be using head 3 after sorting to find out the top 3 values regardless of the combination.
... View more
03-08-2015
09:09 PM
5 Karma
Assuming you have a mutivalue field called status the below (untested) code might work.
.. | eval foo=mvfilter(match(status,"success")) | eval bar=mvfilter(match(status,"failed")) | streamstats window=1 current=t count(foo) as success_count,count(bar) as failed_count | table status,success_count,failed_count
... View more
03-05-2015
07:27 PM
Sorry, I dont have an answer but you could use this answer as a start to recursively link fields
... View more
03-05-2015
07:22 PM
++
And you could replace the ending | table * by |stats count as CountofChanges if you are interested only in the count.
However, I am curious about the
and group it by a field called NetworkDeviceName.
@jedatt01 Are you interested in finding how many times it has changed from/to each Node_Group?
... View more
03-05-2015
05:11 PM
Wouldn't per_day solve the problem? It would total the storage for a day for graphing.
timechart per_day(usedGB) usenull=f
... View more
03-05-2015
04:13 PM
1 Karma
When you are doing Sunday==Monday it compares only the values for that one event.
What you need to do is to have a subsearch which returns every record for Monday to compare against each event for Sunday
so hopefully the below would work
| eval Match = if([search index=whatever | table Monday | dedup Monday| rename Monday as Sunday],"matches","doesnt match") | table Sunday,Monday,Match
however, do consider the limitations of subsearches wrt the output limits but it should work for both the fruit example or the IP matching.
... View more
03-03-2015
09:26 PM
1 Karma
can you add a sample of the input data and a sample output you are trying to achieve?
... View more
03-03-2015
06:50 PM
2 Karma
Is there any reason why you arent using the table command with a dedup following it?
Using values will force it to create a multi value field with distinct values which will give the output on one line.
Using table with dedup will give the unique output in individual rows
... View more
03-02-2015
10:02 PM
A possible answer by stephane_cyrille
... View more
03-02-2015
03:09 PM
1 Karma
The code for the dropdown is
<form>
<label>Sandbox</label>
<description>This is a description</description>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="time_tok" searchWhenChanged="false">
<label>Time Period</label>
<default>
<earliestTime>-3d@h</earliestTime>
<latestTime>-2d@h</latestTime>
</default>
</input>
And the actual panel used is
<row>
<panel>
<title>Test Panel</title>
<chart>
<title>Test2 Dashboard</title>
<search>
<query>[ |gentimes start=-1 | eval earliest=relative_time(now(), "$time_tok.earliest$") | eval latest=earliest+1800 | table earliest,latest | format "(" "(" "" ")" "OR" ")" ] index=myindex sourcetype=iis |fields cs_bytes, sc_bytes |timechart span=5min Max(cs_bytes), Avg(sc_bytes)</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</form>
... View more
02-25-2015
03:28 PM
3 Karma
| eval te=strptime(t,"%b %d %T %Y %Z") | eval tl=strftime(te,"%b %d %T %Y %Z")
You need to include the timezone capture (%Z) so that splunk can calculate what the offset needs to be.
... View more
02-24-2015
06:53 PM
EDIT: was not relevant to the question. Updated
I am using the below code in a test dashboard and it seems to load the default earliest and latest times as expected on v6.2.1.
<fieldset submitButton="true" autoRun="true">
<input type="time" token="time_tok" searchWhenChanged="false">
<label>Time Period</label>
<default>
<earliestTime>-3d@h</earliestTime>
<latestTime>-2d@h</latestTime>
</default>
</input>
I cant think of anything else which can influence the tokens from picking up the defaults
... View more
02-23-2015
03:51 PM
I have updated my answer above to add the final set of changes required to make it work..
Let me know if you are still running into issues
... View more
02-23-2015
02:39 PM
you shouldnt be getting rs as 1 since its been concatenated to provide something like 0,1,200,500.
Have you replaced the tokens with the actual data for trying out this query?
... View more
02-23-2015
02:33 PM
Hi Rajendra, can you share the final query/ setup which worked for you? I'd like to see if this answer works for my setup as well..
... View more
02-23-2015
05:12 AM
What is the result you get when you run the subsearch alone?
|gentimes start=-1 | lookup inventorylookup Devicename as $DEVICE1$-$STORAGE1$-$COLOR1$ OUTPUT AllocTotal | eval y1=round(AllocTotal*0.5, 2) | eval y2=round(AllocTotal*0.8, 2) | eval y3=AllocTotal | eval rs="0,"+y1+","+y2+","+y3 | fields rs
I didnt notice this earlier, but you seem to be rounding the y values to 2 decimal places.. Is that required and can you try the query by rounding it up instead?
|gentimes start=-1 | lookup inventorylookup Devicename as $DEVICE1$-$STORAGE1$-$COLOR1$ OUTPUT AllocTotal | eval y1=round(AllocTotal*0.5, 0) | eval y2=round(AllocTotal*0.8, 0) | eval y3=AllocTotal | eval rs="0,"+y1+","+y2+","+y3 | fields rs
... View more
02-22-2015
10:43 PM
How you want to display them depends on what you are trying to show with the data.
Each graph type is useful for a particular reason. You can read a bit more here and here [both are external sites]
... View more
02-22-2015
10:21 PM
2 Karma
Assuming you know what percentiles you are planning on plotting then its fairly simple. If you don't then it isnt and you can probably stop reading now else continue..
| chart perc50(latency) as p50, perc75(latency) as p75, perc95(latency) as p95 | transpose | rename "row 1" as Latency | sort - Latency
Of course, this means that the latency graphing is captured without any relation to which url has latency issues..
... View more
02-22-2015
09:49 PM
1 Karma
The way you have set the earliest time is probably causing this issue because you are adding the text "earliest=" to the actual value which splunk doesnt parse and you get an invalid earliest time which means your subquery is going to get a null
Instead of
<input type="time" searchWhenChanged="true" token="time_input_tok">
<label>Select a time:</label>
<default>
<earliest>earliest=-3d@h</earliest>
<latest>now</latest>
</default>
</input>
use
<input type="time" searchWhenChanged="true" token="time_input_tok">
<label>Select a time:</label>
<default>
<earliest>-3d@h</earliest>
<latest>now</latest>
</default>
</input>
EDIT: Updated answer since its easier to see all changes needed.
Since you are using time modifiers, you cannot directly add the time in seconds to them for e.g. you cannot add 1800 to "-15m@m"
In this case you will need to use the relative_time function to get the actual time which can be used.
Your SearchString needs to be
[ search index=xxxx| head 1
[ |gentimes start=-1
| eval earliest=relative_time(now(), "$time_tok.earliest$")
| eval latest=earliest+1800
| table earliest,latest
| format "(" "(" "" ")" "OR" ")" ]
index=indx sourcetype=xxx | fields TA, TM| timechart span=1sec max(TM), avg(TA)
... View more
02-22-2015
08:49 PM
I guess you can add the guage ranges in the main search query itself
source =/opt/data/splunkLogs/order_transaction.log ProductName="$DEVICE1$-$STORAGE1$-$COLOR1$" | dedup OrderId | stats sum(SKUQuantity) as TotalDevices | guage TotalDevices [|gentimes start=-1 | lookup inventorylookup Devicename as $DEVICE1$-$STORAGE1$-$COLOR1$ OUTPUT AllocTotal | eval y1=round(AllocTotal*0.5, 2) | eval y2=round(AllocTotal*0.8, 2) | eval y3=AllocTotal | eval rs="0,"+y1+","+y2+","+y3 | fields rs | rename rs as search ]
The subquery would return the guage limits for the main search to use.
This worked for me for a search where I am doing an eval to determine the value for the ranges so I think it should work for inputlookup as well.
Let me know how it goes.
... View more
02-22-2015
08:09 PM
If I didnt misunderstand the question, you should be able to get a sorted chart using the below query which will pick up the maximum latency per url and then sort it so that your graph will be sorted.
...| chart max(latency) as MaxLat by url | sort MaxLat
... View more
