Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About gokadroid
gokadroid
Motivator
Member since:
10-06-2016
04-12-2025
Community Statistics
| Posts | 480 |
| Solutions | 113 |
| Karma Given | 121 |
| Karma Received | 235 |
| Member Since | 10-06-2016 |
Activity Feed
- Got Karma for Re: How to use regex to extract field?. 01-12-2026 05:34 PM
- Got Karma for Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?. 01-12-2026 05:33 PM
- Got Karma for Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?. 07-17-2025 07:49 PM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-31-2024 08:08 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-31-2024 08:07 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-31-2024 08:07 AM
- Got Karma for Re: How to search a lookup table and return the matching term?. 02-15-2024 10:08 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-10-2023 09:13 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-10-2023 09:13 AM
- Got Karma for Re: How to combine multiple searches and output results into one CSV file?. 02-09-2022 06:05 AM
- Got Karma for Re: inputlookup compare the field values in my logs with lookup table. 03-30-2021 05:37 PM
- Got Karma for Re: How to use rex to extract JSON text in "msg" keyValue pair?. 03-10-2021 07:36 PM
- Got Karma for Re: How to use rex to extract JSON text in "msg" keyValue pair?. 03-10-2021 07:36 PM
- Posted Re: How to use rex to extract JSON text in "msg" keyValue pair? on Splunk Search. 03-10-2021 07:20 PM
- Got Karma for Re: How to use rex to extract JSON text in "msg" keyValue pair?. 12-20-2020 02:06 PM
- Karma Re: How to use regex to extract field? for kiran331. 10-04-2020 07:01 PM
- Got Karma for Re: How to build a trend chart that compares today's result with previous day, week, and month for the same time frame?. 09-19-2020 07:23 PM
- Got Karma for Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?. 07-07-2020 11:07 AM
- Karma Re: Head scratcher regex for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: Trying to get the domain from multiple email recipients using rex for micahkemp. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
01-12-2017
02:59 PM
Similar answer here:
Pasting content again:
1) Overlay seems to be line always
2) How far away from the edge an overlay will be dependent on:
- What visualization has been chosen, for example same data when represented as line graph or area chart will overlay the line to the edge.
- How many items are being graphed for each x axis element in case of bar chart and how many x axis points are there in total. For example if you had Volume, Volume(squared) and Volume(cubed) bars for each Sunday (and you were plotting only two Sundays) then the line might be even further away from the edge as now one x axis element (first Sunday) need to plot three bars and the line point which shall represent overlay shall be the middle point of "distance" from the edge of axis till first grouping plot end. If you were to plot these for say 20 Sundays now, the line will shift closer, given the bars will be slimmer and the "distance" used to plot the three bars per Sunday will be slimmer.
... View more
01-12-2017
02:53 PM
Hope this helps:
1) Overlay seems to be line always
2) How far away from the edge an overlay will be dependent on:
What visualization has been chosen, for example same data when represented as line graph or area chart will overlay the line to the edge.
How many items are being graphed for each x axis element in case of bar chart and how many x axis points are there in total. For example if you had Volume, Volume(squared) and Volume(cubed) bars for each Sunday (and you were plotting only two Sundays) then the line might be even further away from the edge as now one x axis element (first Sunday) need to plot three bars and the line point which shall represent overlay shall be the middle point of "distance" from the edge of axis till first grouping plot end. If you were to plot these for say 20 Sundays now, the line will shift closer, given the bars will be slimmer and the "distance" used to plot the three bars per Sunday will be slimmer.
What is the expected output when you mention I'm looking to reverse the axis on this graph, but keep the visualization the same.
... View more
01-12-2017
12:56 PM
Hope this works out:
your query to return events
| bucket _time span=1d
| eval date=strftime(_time, "%Y-%m-%d")
|eventstats dc(ID) as TEC
| stats latest(duration) as Latest, values(TEC) as TotalEventsChecked by ID, date
| search Latest>=20
| stats count(Latest) as Count_GreaterThan_20, values(TotalEventsChecked) as Total_Events_Checked, values(date) as Date
... View more
01-12-2017
12:40 PM
1 Karma
how about using append
index=A host=host1 | stats count by host
|append [ search index=B sourcetype=s1 | dedup host | table host ]
|append [ search index=C sourcetype=s2 | dedup host | table host ]
| outputcsv output_file_name
For details on append see here
... View more
01-12-2017
08:27 AM
I still think it might be due to the "layout" of your new app which must be same (or at least similar) to the dashboard app. That might be one of the reasons for you to see the similar divisions in your dashboards.
... View more
01-12-2017
07:53 AM
How about giving this a try that will find all the combinations, give enabled and disabled for the combinations as well as "Other" in case it is not one of the two combinations you want. Hope it helps:
UserSettings
| rex field=_raw "\[UserSettings\]\s*Player\s*\:\s*(?<playerName>[\S]+)\s*QC\s*\:\s*(?<qcCount>[\S]+)\s*QCAudio\s*\:\s*(?<qcAudioCount>[\S]+)
| eval qcenabled=case( qcCount=1 AND qcAudioCount=1, "Enabled", qcCount=0 AND qcAudioCount=0,"Disabled", 1=1, "Other")
| stats count by qcCount, qcAudioCount, qcenabled
I have added some extra \s* in the above rex just to be safe in case there are some spaces here and there but that rex can compactly be written like below as well:
| rex field=_raw "\[UserSettings\]\s*Player\:(?<playerName>[\S]+)\s*QC\:(?<qcCount>[\S]+)\s*QCAudio\:(?<qcAudioCount>[\S]+)
... View more
01-11-2017
07:52 PM
Something similar to @renjith.nair's query but with label updated with percentage to reflect that without mouse-over.
your base query to return fields operation and count
| eventstats sum(count) as total
|eval percentage=round((count/total)*100,2)
| eval myOperation=operation." : ".percentage."%"
| table myOperation,percentage
... View more
01-11-2017
04:52 PM
You are welcome. I am happy that it worked for you. Happy Splunking!
... View more
01-11-2017
01:18 PM
Can you try this below:
sourcetype=WinEventLog* "EventCode=4624" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| dedup src_ip| table src_ip ]
| table src_ip, user
|dedup src_ip, user
... View more
01-11-2017
12:58 PM
Is this new "my app" any ways a copied over version of "Dashboard app"? Can you please try to create this dashboard in "Search and Reporting App" for once. I just created the dashboard in Search and Reporting app and it doesn't show any of the bottom sections.
... View more
01-11-2017
12:27 PM
1 Karma
That is in the Dashboard examples app and you will not be able to remove it via editing xml. Your best bet is to copy the Source Code section xml code given at the bottom and come out of the Dashboard Example App and go to Search and Reporting app by clicking App: Search&Reporting drop down on top left hand corner of your screen.
Once in this Search and Reporting app, now you can create a new dashboard here, and paste the xml that you had copied to the source of this new dashboard.
That should get rid of that bottom description and xml piece.
Basically, in short, create a new dashboard in some other app rather than "Dashboard Examples App" using below xml which is the source of that dashboard:
<dashboard>
<label>Single Value Color Clone</label>
<row>
<panel>
<title>Temperatures</title>
<single>
<title>Color By Threshold, Absolute Trend</title>
<search>
<query>| inputlookup sf-temperatures.csv | eval _time=strptime(DATE, "%Y%m%d") | timechart avg(TMAX) AS tmax span=7d | eval tmax = tmax/10/5*9+32</query>
<earliest>1403420400</earliest>
<latest>1433228400</latest>
</search>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="trendInterval">-7d</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0x0E31EB","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,60,70,80]</option>
<option name="showTrendIndicator">1</option>
<option name="showSparkline">1</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="height">143</option>
<option name="underLabel">compared to last week</option>
<option name="drilldown">none</option>
<option name="unit">°F</option>
<option name="unitPosition">after</option>
</single>
</panel>
<panel>
<title>Stock Ticker</title>
<single>
<title>Color By Trend, in %</title>
<search>
<query>| inputlookup splunk-stock.csv | eval _time=strptime(date, "%Y-%m-%d") | timechart last(close) span=7d | fillnull value=NULL</query>
<earliest>0</earliest>
</search>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-1y</option>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0.00</option>
<option name="showTrendIndicator">1</option>
<option name="showSparkline">1</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="height">143</option>
<option name="underLabel">compared to 1 year before</option>
<option name="drilldown">none</option>
<option name="unit">$</option>
<option name="unitPosition">before</option>
</single>
</panel>
<panel>
<title>Stock Ticker</title>
<single>
<title>Color By Trend, in %</title>
<search>
<query>| inputlookup splunk-stock.csv | eval _time=strptime(date, "%Y-%m-%d") | timechart last(close) span=7d | fillnull value=NULL</query>
<earliest>0</earliest>
</search>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-1w</option>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0.00</option>
<option name="showTrendIndicator">1</option>
<option name="showSparkline">1</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="height">143</option>
<option name="underLabel">compared to 1 week before</option>
<option name="drilldown">none</option>
<option name="unit">$</option>
<option name="unitPosition">before</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search>
<query>| inputlookup sf-temperatures.csv | eval _time=strptime(DATE, "%Y%m%d") | timechart avg(TMAX) AS tmax span=7d | eval tmax = tmax/10/5*9+32</query>
<earliest>1403420400</earliest>
<latest>1433228400</latest>
</search>
<option name="trendColorInterpretation">inverse</option>
<option name="trendDisplayMode">absolute</option>
<option name="trendInterval">-7d</option>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0x0E31EB","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,60,70,80]</option>
<option name="showTrendIndicator">1</option>
<option name="showSparkline">1</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="height">143</option>
<option name="underLabel">compared to last week</option>
<option name="drilldown">none</option>
<option name="unit">°F</option>
<option name="unitPosition">after</option>
</single>
</panel>
<panel>
<single>
<search>
<query>| inputlookup splunk-stock.csv | eval _time=strptime(date, "%Y-%m-%d") | timechart last(close) span=7d | fillnull value=NULL</query>
<earliest>0</earliest>
</search>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-1y</option>
<option name="colorBy">trend</option>
<option name="colorMode">block</option>
<option name="numberPrecision">0.00</option>
<option name="showTrendIndicator">1</option>
<option name="showSparkline">1</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="height">143</option>
<option name="underLabel">compared to 1 year before</option>
<option name="drilldown">none</option>
<option name="unit">$</option>
<option name="unitPosition">before</option>
</single>
</panel>
<panel>
<single>
<search>
<query>| inputlookup splunk-stock.csv | eval _time=strptime(date, "%Y-%m-%d") | timechart last(close) span=7d | fillnull value=NULL</query>
<earliest>0</earliest>
</search>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-1w</option>
<option name="colorBy">trend</option>
<option name="colorMode">block</option>
<option name="numberPrecision">0.00</option>
<option name="showTrendIndicator">1</option>
<option name="showSparkline">1</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="height">143</option>
<option name="underLabel">compared to 1 week before</option>
<option name="drilldown">none</option>
<option name="unit">$</option>
<option name="unitPosition">before</option>
</single>
</panel>
</row>
</dashboard>
... View more
01-10-2017
10:28 PM
2 Karma
Try this please which should get you required items:
your base query to return xml events
| spath output=requester path=h:requester
| mvexpand requester
| table requester
| spath input=requester output=type path=h:requesterType
| spath input=requester output=id path=h:requesterId
| table type, id
| search type="Customer"
... View more
01-10-2017
11:22 AM
Have a look at mvexpand example1 here which might not be exactly what you need but will definitely create a new event for every value within the multivalued field. Try something like:
your base query
| mvexpand BEGIN
| table the values here
This will create one row in table for each of the values the multivalue field BEGIN has, keeping all the others intact.
... View more
01-09-2017
12:14 PM
Since the ReportRequestInstanceID is same, displaying it twice might be redundant and this query above will automatically return the data for the ids which match in both source1 and source2. You don't need a specific matching condition to match between source1.ReportRequestInstanceID and source2.ReportRequestInstanceID
... View more
01-09-2017
10:34 AM
I think since the field should be autoextracted and is same/common in both sources can you try this below which should work straight away without any issues:
(source=source1 OR source=source2)
| table ReportRequestInstanceID, CreatedOn, ReportRequestID, DownloadTime, DownloadMode
If the index and sourcetype is same, you might wanna add those filters too something like
index=yourIndex sourcetype=yourSourceType (source=source1 OR source=source2)
| table ReportRequestInstanceID, CreatedOn, ReportRequestID, DownloadTime, DownloadMode
... View more
01-09-2017
09:07 AM
Yes, reference your computer token in process query and that should list the process corresponding to the computer which got selected.
... View more
01-09-2017
08:09 AM
5 Karma
If you want two dropdowns that should populate dynamically, then using the query within the dropdowns is an option. You have to have query which will populate the field , say, computerName in first dropdown and then assign it to computer_name token. The second dropdown query then can use this computer_token to search and list all the field processName` and show it in second dropdown. Try something like below:
<input type="dropdown" searchWhenChanged="true" token="computer_token">
<label>Computers Dropdown</label>
<choice value="*">All Computers</choice>
<search>
<query>index=yourIndex sourcetype=yourSourceType | stats count by computerName</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<fieldForLabel>computerName</fieldForLabel>
<fieldForValue>computerName</fieldForValue>
</input>
<input type="dropdown" searchWhenChanged="true" token="process_token">
<label>BackEnd</label>
<choice value="*">All</choice>
<search>
<query>index=yourIndex sourcetype=yourSourceType computerName=$computer_token$ | stats count by ProcessName</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
<fieldForLabel>ProcessName</fieldForLabel>
<fieldForValue>ProcessName</fieldForValue>
</input>
From here on, both $computer_token$ and $process_token$ can be used in a panel query to filter for any specific computerNmae and processName combination.
... View more
01-08-2017
05:59 PM
You are welcome!
... View more
01-08-2017
04:30 PM
Should not the last one hour users be also part of last 24 hours? and so shall be the last 24 hours part of last 7days? Just thinking!
... View more
01-08-2017
04:27 PM
2 Karma
If you have the keywords to detect and filter out unique active users then you can follow below approach assuming field user identifies a user:
index= yourIndex earliest=-1h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Hour"
| append [ search index= yourIndex earliest=-24h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last24Hour" ]
| append [ search index= yourIndex earliest=-7d your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Week" ]
| chart ActiveUser over reportKey
... View more
01-06-2017
08:29 PM
A shot in the dark but can you please check if it is more related to the time chosen to produce data rather than the actual data. For example for below data try choosing earliest as 14:48:00 and latest as 16:03:00 , then the first row will be blank as there is no data in the first time slot of 14:48:00 to 15:00:00 as this grouping will land in of 14:45:00 even though "visually" the data of 14:47:47 exists .
2017-01-06 16:02:45 QUEUE_COUNT="42"
2017-01-06 15:47:47 QUEUE_COUNT="42"
2017-01-06 15:32:45 QUEUE_COUNT="42"
2017-01-06 15:17:45 QUEUE_COUNT="43"
2017-01-06 15:02:45 QUEUE_COUNT="43"
2017-01-06 14:47:47 QUEUE_COUNT="43"
Same might be the case why the ending data might be missing when latest time chosen is maybe few minutes before the grouping data.
... View more
01-06-2017
08:21 AM
Can you first try to evaluate the string you are interested in as tokens using eval and then use those tokens in the title. Say the token of your timepicker is myTimepicker then try something like this and see if it works out:
<eval token="fromDate">strftime($myTimepicker.earliest$,"%Y%m/%d %H:%M:%S")</eval>
<eval token="toDate">strftime($myTimepicker.latest$, "%Y%m/%d %H:%M:%S")</eval>
And then later use $fromDate$ and $toDate$ in the panel title.
... View more
01-06-2017
08:13 AM
2 Karma
When you run this search, you have an option of Save As Alert . In the Alert Trigger Actions there is an option of Add Action > Send Email > When Triggered > Include hich can be used to send the results as attachments or inline as table .
... View more
01-05-2017
09:22 PM
You can check what role you have and get the _internal index search ability assigned to it. Or if admin can edit the power role and assign _internal index added in roles section. To achieve it go to Settings>>AccessControl>>Role>>yourRole
Go to section which has heading Indexes and if the role is power it should have All non-internal indexes currently. Get the _internal index added to this list.
... View more
01-05-2017
08:49 PM
I think what I understood that requirement was:
index1 had exception1, exception2
index2 had exception 2, exception3
Required output
Type.............. count
exception1....... 1
exception2........ 2
exception3........ 1
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-12-2025
06:34 PM
|
Karma given to
