About niketn

niketn · ‎01-19-2020

@gopiven this seems to be use case for a single query rather than three. If you are on Splunk 6.6 or higher you can use Trellis layout to split viz and show Total Successful And Failed logins. If you are on prior version, you can use Post-Processing to split the results to three different Single Value viz. You can try the single SPL on the following lines (untested of-course) index=main1 SOURCETYPE=base1 "TEXT MATCHING FOR SUCCESSFUL LOGIN" OR "TEXT MATCHING FOR FAILURE LOGIN" OR (index=main2 SOURCETYPE=base2 "TEXT MATCHING FOR SUCCESSFUL LOGIN" OR "TEXT MATCHING FOR FAILURE LOGIN") OR (index=main3 SOURCETYPE=base3 "TEXT MATCHING FOR SUCCESSFUL LOGIN" OR "TEXT MATCHING FOR FAILURE LOGIN") | eval type=case((index=="main1" AND sourcetype=="base1" AND searchmatch("TEXT MATCHING FOR SUCCESSFUL LOGIN")) OR (index=="main2" AND sourcetype=="base2" AND searchmatch("TEXT MATCHING FOR SUCCESSFUL LOGIN")) OR (index=="main3" AND sourcetype=="base3" AND searchmatch("TEXT MATCHING FOR SUCCESSFUL LOGIN")), "Successful", (index=="main1" AND sourcetype=="base1" AND searchmatch("TEXT MATCHING FOR FAILURE LOGIN")) OR (index=="main2" AND sourcetype=="base2" AND searchmatch("TEXT MATCHING FOR FAILURE LOGIN")) OR (index=="main3" AND sourcetype=="base3" AND searchmatch("TEXT MATCHING FOR FAILURE LOGIN")), "Failure",) | timechart span=1h count as TOTAL_COUNT count(eval(type=="Successful") as "SUCCESSFUL" count(eval(type=="Failure") as "FAILURE" by type Following is a run anywhere example based on Splunk's _internal index where I have manipulated INFO and ERROR events as Success and Failed scenarios similar to your use case: index=_internal sourcetype=splunkd ("INFO" OR "ERROR") | eval type=case(searchmatch("INFO"),"Success", searchmatch("ERROR"),"Failure") | timechart count as Total count(eval(type=="Success")) as "Success" count(eval(type=="Failure")) as "Failure"

niketn · ‎01-19-2020

@riqbal47010 Can you try the following steps one by one 1. Add searchWhenChanged="true" to md5 text box. 2. Remove Submit Button i.e. submitButton="false" If the token behavior is still not as expected please let us know which scenario does not work (expected behavior vs actual behavior). Also refer to one of my older answers to understand Default and Submitted token models in Splunk: https://answers.splunk.com/answers/742451/searchwhenchangedfalse-not-honored-1.html

niketn · ‎01-19-2020

Are the 9 panels in the same row or different rows? The answer you have referred was created only for one panel. So I would need to know whether you plan to single rows with 9 panels next to each other and 9 show/hide buttons or you need to have 9 rows with one set of show/hide and panel? A whiteboard screenshot of expected design would help assist better.

niketn · ‎01-19-2020

In Simple words join type outer when query before join command runs for last 15min and query after join runs for specific timestamp, all the services from last 15 min must be present in the result. I looked at the code and the question and does not seem like the two are in sync 🙂 Seems like the requirement is for full outer join not just outer join . Full outer join is not available through the join command. Your solution will still work however needs to be tweaked as the requirement is not to filter out results where counts are same in current and past, but to have 0 values when the service is not available. So | where DiffValue!=0 does not seem to be required. Rest all is fine and actually optimal. PS: I was confused between the requirement of outer join (which in Splunk is left join) and full outer join (which seems to be requirement and handled in your code)

niketn · ‎01-19-2020

@pjtbasu, as stated earlier did you get to try @to4kawa 's approach of avoiding subsearch? That would be the best solution for your use case.

niketn · ‎01-18-2020

@marisstella if you have count() aggregate function or fillnull in the single value query then 0s will be filled in the viz. You should change it to sum() aggregation or make sure no value is represented as NULL value in the tabular output instead of 0.

niketn · ‎01-18-2020

@prettysunshinez can you either provide the mock up of Panel and Button design or provide the current Simple XML that you are having? Multiple panels means how many and which is the viz being used?

niketn · ‎01-17-2020

@acfecondo75 trust me on Splunk Answers every community contributor's prime focus is the support for the poster. We do tend to give hints/ performance optimization tips rather than spoon feeding solutions. If you notice closely @kamlesh_vaghela's approach is different than yours. Also Kamlesh has posted his answer as a comment for @pjtbasu to try and confirm. Which means his comment can not be accepted as Answer, but your's can. However, the best solution approach is by @to4kawa which tried to avoid subsearch completely and would perform better as well with map-reduce commands. Unlike other online forums, Splunk Answers thrives on positive sentiments hence down-voting is rarely used by community members unless the suggested solution is detrimental/irreversible for Splunk stack. Refer to the Voting etiquette docs for Splunk Answers Community participation. Having said all these, let me up-vote both of your comments to get you on same page to keep assisting folks in need. Without our active participation and positive mindset the community will not thrive... so keep Splunking and Happy Weekend. There has to be upvote for @to4kawa 's answer once he fixes outer join approach as that is the best way to perform such kind of correlation. While there is no silver bullet for correlation, this is a good Splunk Documentation for Event Grouping and correlation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

niketn · ‎01-17-2020

@to4kawa, this is the right approach to pull required data from index and use stats for correlation. However, original query had left/outer join which means you were supposed to retain all the values from first time range which means you would need to do either values(date_label) as uniqueLables or dc(date_label) as uniqueLables and filter all values with uniqueLables for current and non-zero values from old . Which means finally | fillnull CurrentCount will be required even in your query! 🙂

niketn · ‎01-14-2020

@ialahdal refer to one of my older answer with two options available in Splunk Enterprise. See if one of them works for you https://answers.splunk.com/answers/607729/dashboard-to-display-varied-graph-types-on-a-singl.html

niketn · ‎01-13-2020

@swazimodo a screenshot (or mock whiteboard diagram) of the flow of what you intend to do would help community members assist you better. However, to answer your question, Simple XML Dashboards allow you to extend your own expected functionalities by using Simple XML JS Extension and Splunk JS Stack. Here are some of my previous answers: Table with Right Click Context Menu: https://answers.splunk.com/answers/513122/how-to-provide-right-click-menu-optioncontext-menu.html Draggable Modal Pop-up: https://answers.splunk.com/answers/747524/draggable-modal-context-pop-up.html?childToView=747145#answer-747145 Double Click on custom html results: https://answers.splunk.com/answers/757191/is-there-something-called-doubleclick-in-splunk-da.html

niketn · ‎01-13-2020

@daymauler if this worked do up vote the answer! 🙂

niketn · ‎01-13-2020

@sarvesh_11 I have already answered this on similar lines (https://answers.splunk.com/answers/757191/is-there-something-called-doubleclick-in-splunk-da.html). Do up vote the answer if it helped.

niketn · ‎01-13-2020

@joesrepsolc if you need to refresh your DB data pulled into Splunk, best way would have been to use dbxquery to fetch data and update a KV Store and accelerate/replicate to indexer the same to support querying through million rows. (PS: Also should not have too many columns) delete would be a bad way to remove searchable data in an index as it still occupies space on your indexers. . Refer to doc: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete Also, indexing million records every day and purging the same seems a bad use of license. Check out one of older answers for details on KV Store Acceleration and Index Replication of KV Store: https://answers.splunk.com/answers/432770/scaling-kv-store-performance.html

niketn · ‎01-12-2020

@ashikuma your exact query from the example and question is not clear. However, if you want to calculate and show the 95th percentile value rounded off to integer you can try the following using perc statistical function: <yourExistingSearchThatGivesAboveResults> | stats perc95(Responsetime) as per95RespTime | eval per95RespTime=round(per95RespTime,0) Following is a run anywhere example to show the results with 95th percentile value associated with each row (using eventstats instead of stats ) so that you can perform further calculations. (Commands from | makeresults till | fields Responsetime count are used to generate dummy data as per your question. | makeresults | eval data="11 1;12 183;13 13968;14 81599;15 104666;16 70917;17 43351;18 26854;19 17698;20 12432;21 9401;22 7561;23 6139;24 5175;25 4581;26 4087;27 3899" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Responsetime=mvindex(data,0), count=mvindex(data,1) | fields - _time data | fields Responsetime count | eventstats perc95(Responsetime) as per95RespTime | eval per95RespTime=round(per95RespTime,0)

niketn · ‎01-12-2020

@nick405060 how many values will you have returned in your Multiselect query? Also how long does it take to execute and return? Would the issue be resolved if you show multi-select is displayed after the query completes populating? Also for the query performance could you run a scheduled search every hour for past 24 hour (or similar schedule as per your data frequency and use case) and populate results of the scheduled search? PS: If you have more than 10K results or so, still you would face issues with multiselect scroll not responding very well and it is not the right use case for multiselect as well (ideally Users will never select more than 10-20).

niketn · ‎01-08-2020

@373782073 is the above example the backup file name bkp_filename from which you need to extract date?

niketn · ‎01-08-2020

@skirven your code snippet is quite confusing. As per your code, only if you type "changed" in the text box the value will be assigned to the token $client_action$ . However, even with that there is actually a delay of one change because you have used $client_action$ instead of $value$ to access the changed value. For the community to assist you better just provide what is the use case of text box i.e. once the value changes do you want to pass on the same changed value to the search or something else? If it is just the changed value then you do not even need the change event handler of text input. You can simply use the following code: <input type="text" token="client_action" searchWhenChanged="true"> <label>Client Action</label> <default>*</default> </input> Where $client_action$ will have text box changed value that can be used in searches.

niketn · ‎01-07-2020

@MERBAG I think this has been called out in the uses of eval to set the token in the dashboard using relative_time : https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting For your use case you can passed the clicked value as a token to an Independent Search which will set the required tokens. Following is an example:  <search> <query>| makeresults | eval clickedValue="$click.value$" | eval STARTFROMMACHINE = strptime(mvindex(split(clickedValue,"-"),0), "%d.%m.%Y %H:%M") | eval STARTFROMADMACHINE = relative_time(STARTFROMMACHINE, "-0d@d") | eval ENDATADMACHINE = relative_time(STARTFROMMACHINE, "+1d@d") | table STARTFROMMACHINE, STARTFROMADMACHINE, ENDATADMACHINE </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <done> <set token="tokSTARTFROMMACHINE">$result.STARTFROMMACHINE$</set> <set token="tokSTARTFROMADMACHINE">$result.STARTFROMADMACHINE$</set> <set token="tokENDATADMACHINE">$result.ENDATADMACHINE$</set> </done> </search> You can refer to one of my answers on similar lines where I have used Independent Search to set required tokens. https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html Please try out and confirm!

niketn · ‎01-07-2020

@mehrdad_2000 try the following run anywhere example which creates data similar to what you have provided and I have done some extraction required for the solution. PS: Pipes from | makeresults till | eval _time... is used to generate the data. | dedup 2 fingerprint module is to ensure that we have latest two events for each finderprint and module. If not 2 they bring only one. This may not be required if a fingerprint module can enter the IN state once it has been in the OUT state before. If not then you do not need dedup pipe at all. | makeresults | eval data="09:04:04.042 module1: F[6]L: IN; 09:04:01.417 module1: F[6]L: OUT; 09:04:01.418 module4: F[6]L: IN; 09:04:01.419 module4: F[6]L: OUT; 09:04:01.420 module12: F[6]L: IN; 09:04:01.421 module2: F[6]L: IN; 09:04:01.422 module41: F[6]L: IN; 09:04:01.426 module12: F[6]L: OUT; 09:04:01.427 module50: F[18]L: IN; 09:04:01.428 module52: F[20]L: IN; 09:04:01.429 module50: F[18]L: OUT; 09:04:01.435 module52: F[20]L: OUT;" | eval data=replace(data,";(\s+)",";") | makemv data delim=";" | mvexpand data | rename data as _raw | rex "^(?<Time>[^\s]+)\smodule(?<module>[^\:]+)\:\s+F\[(?<fingerprint>[^\]]+)\]L:\s+(?<state>.*)$" | eval _time=strptime(Time,"%H:%M:%S.%3N") | dedup 2 fingerprint module | stats min(_time) as _time max(_time) as LatestTime values(state) as state by fingerprint module | eval duration=LatestTime-_time | search state="IN" AND state!="OUT" PS: final search filter ensure to pick fingerprint modules which have IN state but not OUT state. You can play around with this search filter to implement other use cases for example finding the duration between State transition from IN to OUT using | search state="IN" AND state="OUT" etc.

niketn · ‎01-07-2020

So if both of you have same issue, even though I am not able to re-produce, this still seems like a bug. Work with Splunk Support! Do let us know the outcome.

niketn · ‎01-06-2020

@sharif_ahmmad your data is missing the correlation between Customer_Name and Purchased_ID for through the counter. Please add that details for the community to assist you better.

niketn · ‎01-06-2020

@raj00350 you can try couple of options. Option 1: You can create a column chart for First Column values over time and then create overlay for second column. Then use charting.chart.showMarkers Simple XML Chart configuration to show markers for 0 and 1 as Line Chart overlay. Option 2: You can use the Chart Event Annotation feature in Splunk version 7.x and above to annotate events as per your use case (even apply dynamic color and hover message based on existing field/s). Refer to the run anywhere example below for both approach where I am displaying the Count of Errors and markers on overlay chart and message for Error field as Annotation. Please try out and confirm! Refer to the required run anywhere Simple XML code for both the options mentioned above. <form> <label>Line Overlay with Markers</label> <fieldset submitButton="false"> <input type="time" token="field1" searchWhenChanged="true"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="field2" searchWhenChanged="true"> <label>Select Span</label> <choice value="1h">Hourly</choice> <choice value="1d">Daily</choice> <default>1h</default> </input> </fieldset> <row> <panel> <title>Using Chart Overlay with <option name="charting.chart.showMarkers">true</option></title> <chart> <title>PS: Show Markers does not work with Y-Axis scale as Log Scale.</title> <search> <query>index="_internal" sourcetype="splunkd" log_level="ERROR" | timechart span="$field2$" count as ErrorCount dc(eval(if(log_level=="ERROR",1,0))) as Error | eval Error=case(Error>0,"1",true(),0)</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisLabelsY2.majorUnit">1</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">1</option> <option name="charting.axisY2.maximumNumber">1</option> <option name="charting.axisY2.minimumNumber">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.overlayFields">Error</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.showMarkers">1</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> <row> <panel> <title>Using Chart Event Annotation (Splunk 7.x onward)</title> <chart> <search> <query>index="_internal" sourcetype="splunkd" log_level="ERROR" | fields _time log_level | timechart span="$field2$" count as ErrorCount</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <search type="annotation"> <query>index=_internal sourcetype=splunkd log_level=ERROR | fields _time log_level | bin _time span="$field2$" | dedup _time | eval annotation_label = "Error on: ".strftime(_time,"%c") | eval annotation_category = log_level</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search>   <option name="charting.annotation.categoryColors">{"ERROR":"0xff3300"}</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">log</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">1</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.overlayFields">Error</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </form>

niketn · ‎01-06-2020

If your issue is resolved please go ahead and accept the answer 🙂

niketn · ‎01-06-2020

@riqbal47010 you can code that using <change> event handler for specific input. Do you want to apply only one filter at a time or all of them. If you want to set all of the filters then you will have AND filter, if you want to apply specific filter you can pass the value as default like "*" for all and run OR in your SPL like (i.e. instead of unset you should be setting remaining filters to * or leave as previously selected in case you default on Form Load), URL="www.abcdef.com" OR MD5="*" OR SHA="*" etc

Posts	6912
Solutions	1166
Karma Given	832
Karma Received	2453
Member Since	‎03-09-2015

How to avoid un-responsive dropdown input with 100...

How to enable drilldown from the Horizon Chart vis...

How can we create Tabs using Link List in Splunk w...

Splunk Add On builder not working on Mac but on Wi...

How to enable drilldown from the Outlier Chart vis...

[BUG] Built in token $message$ for <fail> Search E...

How do you make a table that reduces in height whe...

What is the expected behavior for Submit button wh...

App Certification criteria: I need help on the 64...

Parallel Coordinates Example has been named Locati...

Re: Two dashboards values in single value panel sh...

Re: Tokens not propagating values

Re: Alignment and sizing of panels in dashboard

Re: Fillnull in outer join

Re: Fillnull in outer join

Re: All the single value panels in the table showi...

Re: Alignment and sizing of panels in dashboard

Re: Fillnull in outer join

Re: Fillnull in outer join

Re: Timechart mouse over

Re: Feature Request: add support for middle click ...

Re: How to Provide Right click Menu option(Context...

Re: How to Provide Right click Menu option(Context...

Re: Best way to delete all data in an index every ...

Re: How to get value which is coming at 95 positio...

Re: How to fix the "populating" message bug on a m...

Re: Using regex on Extracted field

Re: Text Box not updating Dashboard

Re: Issue with eval in Dashboard XML Source

Re: Find IN does not OUT

Re: Event: Show source loading ....

Re: Problem With keeping relevant data in the sam...

Re: Highlight line chart depending on value from 2...

Re: Zoom to selection

Re: How to copy paste values for multiselect input

Join the Conversation