Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About greg
greg
Communicator
Member since:
09-12-2011
06-05-2020
Community Statistics
| Posts | 61 |
| Solutions | 2 |
| Karma Given | 13 |
| Karma Received | 24 |
| Member Since | 09-12-2011 |
Activity Feed
- Karma Re: How can I view Splunk С# SDK 2.2.7 reference on an official documentation? for apruneda_splunk. 06-05-2020 12:49 AM
- Karma Re: Sideview Utils: When all items are selected in CheckboxPulldown, can I have the result set to "*" instead of full OR-linked list? for sideview. 06-05-2020 12:47 AM
- Karma Re: Why does placing "table _time" after timechart make x-axis labels disappear on JSChart? for frobinson_splun. 06-05-2020 12:47 AM
- Got Karma for Re: Why does placing "table _time" after timechart make x-axis labels disappear on JSChart?. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: When all items are selected in CheckboxPulldown, can I have the result set to "*" instead of full OR-linked list?. 06-05-2020 12:47 AM
- Got Karma for Why do standard navigation menu items disappear on custom dashboards?. 06-05-2020 12:47 AM
- Got Karma for Why do standard navigation menu items disappear on custom dashboards?. 06-05-2020 12:47 AM
- Karma Re: How to set the default value for a dynamically populated Pulldown? for sideview. 06-05-2020 12:46 AM
- Karma Re: Number of day per month for vganjare. 06-05-2020 12:46 AM
- Karma Re: Combined chart types in a single chart display for jonuwz. 06-05-2020 12:46 AM
- Karma IE8 is not displaying the flashchart if Pulldown module is used for imrago. 06-05-2020 12:46 AM
- Karma Re: How to place the Pulldown below the main search and populate it with a new search? for sideview. 06-05-2020 12:46 AM
- Karma Limits that shouldn't be exeeded and potential big data for iKate. 06-05-2020 12:46 AM
- Karma [SimpleResultsTable module] (9, 'Bad file descriptor') for srw46. 06-05-2020 12:46 AM
- Karma Re: Escaping $ in SideView Search Module for sideview. 06-05-2020 12:46 AM
- Karma Re: Omitting zero values when calculating stats avg()? for Stephen_Sorkin. 06-05-2020 12:46 AM
- Got Karma for Displaying duration in human-readable format instead of seconds on chart by axis Y?. 06-05-2020 12:46 AM
- Got Karma for Re: Joining two searches with and without stats command. 06-05-2020 12:46 AM
- Got Karma for Joining two searches with and without stats command. 06-05-2020 12:46 AM
- Got Karma for How can I use the value of a field as an immediate search expression (dynamic search string formatting)?. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 2 | |||
| 2 | |||
| 1 |
03-01-2013
08:22 AM
2 Karma
I'm trying to solve a problem with dynamic resizing of a Bar FlashChart in runtime.
What I want to achieve is to resize the chart height depending on the result count:
ChartHeight = 20 *ResultCount
i.e. to stretch it accordingly (20px per bar) and make it look readable and nice.
Since the official documentation says one can only set the chart height in design time only in pixels or percentage:
<param name="height">300px</param>
and there's no auto-resizing option (and default 210px is not an option), I gonna give Sideview techniques a try (Hi Nick ;).
Here is the raw scheme of the view fragment:
Pulldown (where number of results is selected)
PostProcess (to calculate the chart height)
ResultsValueSetter (to extract calculated height and pass it downstream)
PostProcess (to fullfil the chart)
ValueSetter (to set chart property "height")
FlashChart (that should take property "height" from upstream)
The problem is that the FlashChart (native Splunk module) doesn't grab "height" property from upstream and remains unresized. If I insert HTML module for debug purpose before the chart, I can see the height is calculated correctly (e.g. 200px or 400px).
Did I miss something? Is there any way to pass this value to FlashChart?
--
Here is the code sample in Advanced XML:
<module name="Pulldown">
<param name="name">TopCount</param>
<param name="label">Top:</param>
<param name="float">left</param>
<param name="staticOptions">
<list>
<param name="value">10</param>
</list>
<list>
<param name="value">20</param>
<param name="selected">True</param>
</list>
<list>
<param name="value">50</param>
</list>
<list>
<param name="value">100</param>
</list>
</param>
...
Main Search Here
...
<module name="HTML" layoutPanel="panel_row4_col1">
<param name="html"><![CDATA[<h3>Panel 4</h3>]]></param>
<module name="PostProcess">
<param name="search">
$postProcess$ | eval ChartHeight = 20*$TopCount$ | eval ChartHeight = ChartHeight."px"
</param>
<module name="ResultsValueSetter">
<param name="fields">ChartHeight</param>
<module name="PostProcess">
<param name="search">
$postProcess$ |
table Host, Duration
</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">bar</param>
<module name="ValueSetter">
<param name="name">height</param>
<param name="value">$ChartHeight$</param>
<module name="FlashChart"></module>
</module>
</module>
</module>
</module>
</module>
</module>
... View more
02-25-2013
03:12 PM
Well, this slowness is only a problem in Internet Explorer, checked this out for many times today. In Opera and Chrome the page has been loaded for a couple seconds. In addition, search+postprocess in a separate search window work quite fast. Looks like a browser-specific issue in JavaScript or flash, have you ever seen it in advanced XML views?
... View more
02-22-2013
03:59 PM
Noticed one side effect - my view now loads visually "slower", web-page behaves weird during processing (it hangs, no job progress, no UI responding - and after a while it instantly comes up with fully rendered charts). This one is with Internet Explorer only (in Chrome/Opera I see progress gear is rolling), guess it's because flash loading specific in IE.
... View more
02-22-2013
03:55 PM
Thank you for such a detailed reply, appreciate it!
First thing I tried was approach #2 since I'm already familiar with "old trick #1" to suppress some of splunk warnings. It works! but please correct a misprint in your code snippet (declareCustomBehavior("stashMySearch", customBehaviorModule) -> ...function(customBehaviorModule), and for "unstashMySearch" as well, am I right?)
I will also try to compose search #1 (guess I got your 'datacube' idea), maybe things be simpler this way (I will email you if I get stuck).
... View more
02-21-2013
12:23 PM
1 Karma
I'm trying to implement the following advanced view:
This is a mockup, drop-down boxes A,B,C,D will be populated with values from 4 different sourcetypes. The main data is taken from 5-th sourcetype to be filtered out by pulldown selection on each chart.
The tricky thing here is that I want to place Pulldown modules on each panel right next to charts and use them as post-process parameters. Basically (what I have seen in examples) we place Pulldown modules one by one above the main search module and then use the values chosen by user as $foo$ parameters. In my case, I want firstly to execute the main search and then to post-process its results passed downstream to panels, displaying charts based on selection in the Pulldown.
It will be faster (no need to execute main search for the sake of some final filtering) and more user-friendly (a user can choose filters right on each panel, say, if panel count is 10 or more and you have to scroll the web-page). The drop-down boxes are filled in by new searches, each on different sourcetype. I can't combine these searches with the main one, because sourcetypes and output data are different.
The problem is that if I create a new search for each pulldown, postProcess module below no longer sees the results of upstream main search. Looks like new search cleans it up or overrides somehow.
E.g. the postprocess in code sample below
$postProcess$ | where Percentage == “$PercentA$” | table Host, Percentage
doesn't work and produces no data. I want it to inherit the results from main search.
Is there any way to rearrange the modules or use any workaround?
I'm using Sideview Utils 2.2.6.
--
The view structure:
<module name="Search" autoRun=" True">
<param name="search">
sourcetype="Main" … | fields Host, Percentage
</param>
…
<module name="Search" autoRun="True">
<param name="search">sourcetype="ForPulldownA" | stats count by PercentA</param>
<module name="Pulldown">
<param name="name">PercentA</param>
…
<module name="PostProcess">
<param name="search">
$postProcess$ | where Percentage == “$PercentA$” | table Host, Percentage
</param>
<module name="HiddenChartFormatter">
…
</module>
<module name="Search" autoRun="True">
<param name="search">sourcetype="ForPulldownB" | stats count by PercentB</param>
<module name="Pulldown">
<param name="name">PercentB</param>
…
<module name="PostProcess">
<param name="search">
$postProcess$ | where Percentage == “$PercentB$” | table Host, Percentage
</param>
<module name="HiddenChartFormatter">
…
</module>
... View more
02-18-2013
08:28 AM
1 Karma
I have already asked this question long ago, but still no correction from Splunk team.
See some workarounds on this:
http://splunk-base.splunk.com/answers/40985/time-zone-recognition-still-doesnt-work-after-editing-propsconf
... View more
10-29-2012
09:08 AM
1 Karma
I solved the same problem by inserting a time filtering clause into my main search. Then you can use TimeRangePicker after the search and it will work.
Here is how the Advanced XML code sample looks like:
< module name="Search" autoRun="False" >
< param name="search" >
sourcetype="Updates" UpdateSet="$UpdateSet$" UpdateName="$UpdateName$"
table _time, UpdateSize |
eval epoch = strptime("06/01/2012:12:00:00", "%m/%d/%Y:%H:%M:%S") | where _time > epoch
< /param >
< module name="TimeRangePicker" >
< param name="label" > Time range: < /param >
< param name="selected" > Last 7 days < /param >
< param name="searchWhenChanged" > false < /param >
... View more
03-27-2012
08:57 AM
Thanks Stephen, this trick works great!
Is it mentioned somewhere in docs (about avg() and nulls), could you point out?
... View more
03-27-2012
07:43 AM
Is your idea in preliminary filtering of zero values before stats?
In my case, "search ..." is a complicated search about 10 lines long and I can't just put AND NOT at the end. Using ... | where MyValue!=0 | stats ... filters out some necessary fields together with MyValue, so it's not the case also.
... View more
03-27-2012
07:20 AM
What I want is:
... | stats avg(eval(MyValue!=0)) as Avg
It doesn't work that way (Avg is always 1.0).
Of course, the workaround is:
... | stats sum(MyValue) as Sum, count(eval(MyValue!=0)) as Count | eval Avg = Sum/Count
But is there a simpler way of using a conditional expression with stats avg()?
... View more
02-24-2012
06:22 AM
Well, the difference between these 2 approaches is that OR adds new rows to the resulting set while JOIN adds new columns. Thus, the result after doing OR looks very similar to FULL OUTER JOIN in SQL except that even matching rows are listed separately (i.e. conjuction), which is the reason of a better search speed.
But sometimes you may need to compare fields within one resulting event and using OR doesn't help too much. In such case eventstats or transaction are good to use, or JOIN as really a last resort weapon.
... View more
02-24-2012
06:12 AM
Yes, using OR really helps to achieve what I wanted in my original question:
(sourcetype="A" Field1=... Field2=...) OR
(sourcetype="B" Field3=... Field4=...) |
eval Uid=if(sourcetype="A",Id,TxId) |
stats min(StartTime) as start, max(TxEndTime) as end by Uid | where !isnull(start) AND !isnull(end) | eval Duration = End - Start | ...
Some additional filtering of NULL values was required as well since the resulting set contains all non-common fields in both sourcetypes as nulls.
... View more
02-23-2012
09:31 AM
2 Karma
As for the tabular data, yes, I've already done so.
But still looking for a solution on axis labels...
... View more
02-22-2012
04:18 PM
4 Karma
I have an advanced XML chart that displays duration in seconds on axis Y.
Sometimes, when the values are high, axis labels become difficult to interpret:
Can I set the labels in human-readable format, in appropriate value range, like this:
So far I've just set the axis type as
<param name="charting.axisY">time</param>
to have duration converted to epoch time (starting from 1970-10-01).
However for big duration values my workaround doesn't look very well since full date timestamps are included into label markers for the bottom and top values on the Y-axis.
Is there any way to configure a label convertor for the proper time scale?
... View more
02-21-2012
08:53 AM
1 Karma
I went further in my investigation and found some interesting things:
If I remove props.conf at all, event timestamps become correct (UTC +04:00).
In the mean time, timestamps on search summary page are still off by an hour (UTC +03:00).
If I change Windows time zone, say, to "Abu Dhabi/Muscat" (UTC +04:00), timestamps on summary page turn to their correct values.
So I can conclude there are incorrect time zone mappings in Splunk for Moscow time zone.
The workaround for me was to set computer time zone to "Abu Dhabi/Muscat" (UTC +04:00), but it doesn't look very nice.
-- P.S. --
How can I check the timezone offset for Europe/Moscow in Splunk 4.3?
Question to Splunk guys:Is it a bug in Splunk timezone package (Moscow is now in UTC +04:00 with "no upcoming Daylight Saving Time changes" (c))?
... View more
02-21-2012
03:23 AM
Yes, I have checked everything twice.
My situation is stated in this question:
http://splunk-base.splunk.com/answers/40985/time-zone-recognition-still-doesnt-work-after-editing-propsconf
Could you please check on your system, do you really have UTC+0300 for Europe/Moscow?
... View more
02-21-2012
03:09 AM
Well, according to this wikipedia table, column "Standard Time", Asia/Krasnoyarsk is UTC+08:00, which is too much for me 😉 I'm still in Europe/Moscow (not Moscow +0400).
... View more
02-21-2012
02:53 AM
Hi!
Do you have UTC+03:00 after assigning TZ=Europe/Moscow?
I'm struggling with the same issue at the moment, i.e. Europe/Moscow gives me UTC+03:00, but we are actually in UTC+04:00.
... View more
02-19-2012
02:44 PM
1 Karma
Thanks for this command, I found my config section in the output and it looks OK. Still trying to figure out where the problem is.
Newly indexed data keeps coming with incorrect time zone.
... View more
02-18-2012
05:21 PM
Splunk 4.3 is installed locally on my Windows computer where time zone is set correctly.
I have timestamps formatted like this: 2012-01-01 12:00:00 ...log data...
My ...\etc\system\local\props.conf is:
[source::...\\*Statistics\\...\\*.log*]
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TZ=Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD=30
and my logs are stored according to the path mask specified under source stanza
(say, D:\Data\Statistics\Db\Transactions.log).
After restarting Splunk with such settings I still have GMT+3 instead of GMT+4.
Incorrectly shifted timestamps are displayed on summary page and in every report table where _time field is present.
I managed to fix this problem in 4.2 simply by editing props.conf.
Strange, but after installing 4.3 it came again.
What should I check and correct in addition to props.conf?
Did something change in 4.3, maybe .conf file location or settings format?
--
UPDATE:
Since November, 2014 we are back in GMT+3 in Moscow (RTZ2 timezone) with no further switch to daylight time.
So, the problem is no longer actual and not reproduced (Splunk 6.1).
However, the workaround below could be useful for somebody with similar problem.
... View more
- Tags:
- time-format
- timestamp
02-16-2012
02:24 AM
Thanks for clarification, I'll try to rewrite the search in some other way. Switching places is not the case here.
The problem is the subsearch returns multiple results and join takes only one from the returned set (that looks strange and not like in SQL). I was able to combine the subsearch results into a single event using transaction and get them joined anyway, but then the rest of the search becomes complicated with all these splitting back makemv/mvexpand operators.
It would be much easier to make filtering in the subsearch.
... View more
02-15-2012
01:23 PM
I'm trying to compose a search like this:
sourcetype=A | eval param=ceil(SomeField) | join Name [search sourcetype=B status<param | sort status | head 1] | table _time, Name, status
but it returns no results.
I guess it's because "param" is not visible (empty) in scope of inner search.
In other words, I want to parametrize the inner search so it could do some filtering over sourcetype B and return a single event to join to main search results.
Is there any way to pass the param value from the outer search to the inner subsearch?
Any help is greatly appreciated.
... View more
02-12-2012
02:12 PM
I encountered the same problem ago.
The easiest workaround was to insert an empty HTML module right after the PullDown and before the HiddenChartFormatter (or PostProcess):
<![CDATA[< br >< /br >]]>
Line breaks will be invisible on the page and will not allow the child modules to disappear.
... View more
02-12-2012
10:52 AM
Hi, I've got the same problem right after upgrading to Splunk 4.3.
In previous versions 4.2.x, the progress was properly aligned.
Also I haven't done any changes in my custom CSS file and the code of my view since Splunk 4.2.4.
Thus, I suppose some changes in Splunk 4.3 UI may cause such misalignment. Maybe, you can recommend any other solution except modifying Pulldown.js?
... View more
12-09-2011
05:57 AM
Thanks Nick, now I need some time to learn about CustomBehaviour. I will reply with further questions a little bit later.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
