Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About surekhasplunk
surekhasplunk
Communicator
Member since:
09-29-2016
09-17-2021
Community Statistics
| Posts | 320 |
| Solutions | 1 |
| Karma Given | 15 |
| Karma Received | 11 |
| Member Since | 09-29-2016 |
Activity Feed
- Got Karma for eval case statement. 02-03-2022 06:38 AM
- Posted extract only date from a date time field on Splunk Search. 09-17-2021 05:30 AM
- Posted savedsearches.conf push from deployer not getting updated in searchhead on All Apps and Add-ons. 05-17-2021 08:29 PM
- Got Karma for eval case statement. 03-17-2021 09:35 AM
- Posted rex to modify hostname field and where . is there remove it on Splunk Search. 03-09-2021 05:18 AM
- Posted Re: Where to keep the lookup file in a clustered environment on Getting Data In. 02-02-2021 05:45 PM
- Posted Where to keep the lookup file in a clustered environment on Getting Data In. 02-01-2021 06:27 PM
- Posted find the latest field only from multiple output on Splunk Search. 01-12-2021 04:56 AM
- Posted Re: http event collector interval where to set on Getting Data In. 12-11-2020 03:12 AM
- Posted http event collector interval where to set on Getting Data In. 12-10-2020 07:13 PM
- Posted Re: chart graph help on Splunk Search. 11-27-2020 05:36 AM
- Posted Re: chart graph help on Splunk Search. 11-27-2020 01:02 AM
- Posted chart graph help on Splunk Search. 11-26-2020 07:35 PM
- Posted Freeze column header of one table in a dashboard on Dashboards & Visualizations. 11-18-2020 02:41 AM
- Got Karma for rex help. 09-25-2020 05:04 AM
- Posted rex help on Splunk Search. 09-25-2020 03:32 AM
- Posted rex help on Splunk Search. 09-25-2020 03:15 AM
- Posted How to install a thirdcparty certificate and use it for api call on Security. 09-11-2020 04:14 AM
- Tagged How to install a thirdcparty certificate and use it for api call on Security. 09-11-2020 04:14 AM
- Posted Re: time field search in load job not working on Getting Data In. 09-09-2020 01:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
11-27-2017
02:01 AM
i want to allign all the cell values along with the header values to center in splunk dashboard. How do i achieve it.
... View more
11-27-2017
01:44 AM
1 Karma
I just want to color the column headers and not the cells of my dashboard tables
... View more
11-26-2017
10:16 PM
<input type="dropdown" token="dropregion" searchWhenChanged="true">
<label>REGION</label>
<choice value="ALL">ALL</choice>
<condition match="$dropregion$=="ALL"">
<set token="dropuk">1</set>
<set token="dropemea">1</set>
<set token="dropapac">1</set>
<set token="dropindia">1</set>
<set token="dropglobal">1</set>
</condition>
<condition match="$dropregion$=="UK"">
<set token="dropuk">1</set>
....
This token i have set as condition of panel dependent
<input type="radio" token="button" searchWhenChanged="true">
<label>RUN/CHANGE BANK</label>
This token is set for table dependent.
<panel depends="$dropuk$">
<title>RTB</title>
<table depends="$run$">
... View more
11-25-2017
12:14 AM
Hi @ashish9433
which is your table name or reference to the table here ?
If i want to do it for all the tables then is there any specific code which i can just put in my .css file.
... View more
11-24-2017
10:51 PM
I have set default values for dropdown as all and have set as panel condition
Then i have a readio button for selection of both which i have set for table condition.
Now when i first time load my dashboard then by default i want to see all my panels which is not working
first i have to change value in the dropdown then only it starts working
Has anyone faced this issue ?
... View more
11-24-2017
01:26 AM
Its not possible for me to share the queries is it possible for you to just share a sample query with above data and fields.
... View more
11-23-2017
09:20 AM
Hi,
Do we have a feature in splunk to add 1st row.field1 from 2 different panels and sum it in another panel.
i have in panel one or table 1 in dashboard which looks like below
col1 col2 col3 col4
A 1 1 1 1
B 2 2 2 2
I have 2nd table in the same dashboard which looks like below
col1 col2 col3 col4
A 3 3 3 3
B 4 4 4 4
I have one more tale which shoud look like below. Addition of col2 first row from both tables, addition of col3 of 1 row of both tables etc.
col1 col2 col3 col4
A 4 4 4 4
B 6 6 6 6
... View more
11-23-2017
03:53 AM
Hi @karker302,
I have implemented something line this.
I have named links for all the dashboards in the main page and by clicking on each of the links they take me to the respective dashboards.
But is there a option to increase the font size of those href links ?
... View more
11-23-2017
03:26 AM
Thanks a lot it worked well for me and i got the required result.
But if i want to do a pattern match there i am getting error saying you have to dynamically allocate the values.
| inputlookup file1.csv where ( category="Time" OR category="Outcome" )
| chart count(eval( category="Time" AND match('Onsite/Offshore',"Onsite"))) as "Time:ON" count(eval( category="Time" AND match('Onsite/Offshore',"Offsite"))) as "Time:OFF" count(eval( category="London" AND match('Onsite/Offshore',"Onsite"))) as "London:ON" count(eval( category="London" AND match('Onsite/Offshore',"Onsite"))) as "London:OFF" by department
| eval "Time:Total"='Time:ON' + 'Time:OFF'
| eval "London:Total"='London:ON' + 'London:OFF'
| table department Time* London*
Can you please help me with that pattern match against the category values.
... View more
11-22-2017
11:05 PM
Here am getting 2 validation warnings for line 3 .
I want to create custom buttons in my dashoard . how to do that
... View more
11-22-2017
08:04 AM
Hi @gkanapthy, and @tnkoehn
I have similar requirement but instead of | where match(Inbound, "^(ATT|MCI|QST)") OR match(Outbound, "^(ATT|MCI|QST)")
i have
| where match(Inbound, "abc") OR match(Outbound, "def")
now how should i achieve this
... View more
11-22-2017
07:33 AM
|inputlookup file1.csv|search category="Time" Region=UK "Location - City"="London"| stats count(eval("Onsite/Offsite" like "%Onsite%")) as ON , count(eval(match('Onsite/Offsite',"Offsite"))) as OFF by "CTO sub department" |eval Total=ON+OFF
Now i have another query
|inputlookup file1.csv|search category="Outcome" Region=UK "Location - City"="London"| stats count(eval("Onsite/Offsite" like "%Onsite%")) as ON , count(eval(match('Onsite/Offsite',"Offsite"))) as OFF by department |eval Total=ON+OFF
It just differs on the category value and i want output like below:
Time Outcome
ON|OFF|total|ON|OFF|total
department 10|10|20|22|33|55
hope its clear now. what i am trying to achieve.
... View more
11-22-2017
07:09 AM
Hi @niketnilay,
Thanks for your response but stats count(eval(match(field2,"xyz") AND match(field4,"222"))) doesn't seem to be working i am getting syntax error Error in 'stats' command: You must specify a rename for the aggregation specifier on the dynamically evaluated field
And i can use the performance approach since i have got more than 1 field to evaluate
... View more
11-22-2017
05:42 AM
Hi @somesoni2
Can you help me with a simple search i have following requirement
from a single input lookup file. Now am using below query to get the field2 count by field3 for a particular pattern math.
|inputlookup file1.csv|search field1=abc|stats count(eval(match(field2,xyz) as output by field3
How can i add another matching criteria to the same query something like this.
|inputlookup file1.csv|search field1=abc|stats count(eval(match(field2,xyz AND filed4,222) as output by field3
... View more
11-22-2017
05:30 AM
thats a mocked query so might b some typos but my problem is separately two quereis are returning me values but when i merge them together the inner query fields aren;t visible outside and when visible are coming in wrong order with the area
... View more
11-22-2017
03:57 AM
|inputlookup file1.csv |search "field1"="RUN"
|eval Aperm = if( 'Perm / Cont' = "Permanent",FTE,0)
|eval Acont=if( 'Permanent / FTC' = "Cont",FTE,0)
|eval Bperm = if('Perm / Cont' = "Permanent",FTE,0)
|eval Cperm = if('Perm / Cont' = "Permanent",FTE,0)
|eval Bont=if('Permanent / FTC' = "Cont",FTE,0)
|eval Ccont=if('Permanent / FTC' = "Cont",FTE,0)
| stats sum(Aperm) as APERM sum(Acont) as ACONT sum(Bperm) as BPERM sum(Bcont) as BCONT sum(Cperm) as CPERM sum(Ccont) as CCONT BY "Area"
|APPENDCOLS[|inputlookup TechIndia.csv |search "SubDivision 5"=* "SubDivision 2" = "RUN"
|eval Dperm = if('Perm / Cont' = "Permanent",FTE,0)
|eval Dcont=if('Permanent / FTC' = "Cont",FTE,0) |stats sum(Dperm) as DERM sum(Dcont) as DCONT BY "Region" |fields DPERM DCONT]
In my output currently am getting all the required columns but unfortunately the DPERM and DCONT values are incorrect against the Area or Region. They dont show the corresponding values against the area.
The output should be
Area /Region | APERM | BPERM | CPERM |DPERM |ACONT|BCONT|CCONT|DCONT|Total PERM| Total CONT|
... View more
- Tags:
- inputlookup
- sum
11-17-2017
08:20 AM
Thanks @niketnilay it worked by adding tag with my fields in that omitting the percentage field.
Thanks a lot ... cheers
... View more
11-17-2017
07:30 AM
Hi,
I have a calculated field call Percentage which is required for other calculations but i dont want that value to be shown in the dashbaord.
I tried table command without Percentage field name but that is still showing as Null% under that field.
I tried fields command with - Percentage but didn't work .
... View more
11-17-2017
02:47 AM
Hi am still struggling with this i am getting error error in lookup command.
my query starts with inputlookup and
| inputlookup myfile.csv |search country= [|lookup mapping.csv |search country_full=”United States" |fields country_abbreviation ] | fields "Employee Forename"
doesnot seem to be working.
... View more
11-16-2017
10:00 AM
Hi @elliotproebstel,
Can you help me with the query using two lookups here
... View more
11-16-2017
09:30 AM
Hi @niketnilay,
Can i have a separate mapping.csv file just with the short name and full name in it then how should i write my query equivalent to and ammend the new mapping.csv file.
|inputlookup myfile.csv | search Area="$row.Area$" | fields employee_name "Employee ID"
Right now $row.Area$ is getting replaced by UK . Now how to use mapping.csv file in the query so that i can tell if Area=UK search in mapping.csv and get the correspoding full name that is United Kindgom then assign that value to Area and the the requried Employee ID
Thanks
... View more
11-16-2017
08:43 AM
I think i am not able to put my query clearly.
Let me explain again.
|inputlookup myfile.csv | search Area="United States" | fields employee_name "Employee ID"
This retruns result since area has got full area name
But in my dashboard the area name is just US
So when i pass search Area="$row.Area$" it takes US instead of full name and query results nothing.
... View more
11-16-2017
07:44 AM
Hi @elliotproebstel,
I followed what you said and tried to change my drilldown query but looks like its not getting me any result.
|inputlookup myfile.csv | search Area = "United States" | fieldformat Area=case(match(Area, "United States"), "US", match(Area, "United Kingdom"), "UK") |fields employee_name "Employee ID"
Here i feel since its trying to search first for the vale "United States" and then trying to format it. so is that causing no rsults or whats the issue ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-17-2021
10:31 AM
|
Karma from
Karma given to
