Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About matansocher
matansocher
Contributor
Member since:
03-15-2017
06-05-2020
Community Statistics
| Posts | 105 |
| Solutions | 1 |
| Karma Given | 40 |
| Karma Received | 7 |
| Member Since | 03-15-2017 |
Activity Feed
- Karma Re: How to present the date and value not in epoch format and is there a way to add a line to the bubble chart (over the time), in order to show trend? for Richfez. 06-05-2020 12:49 AM
- Karma Re: Extracting date from a date string that has many options for HiroshiSatoh. 06-05-2020 12:49 AM
- Karma Re: Dashboard drilldown: user clicks on value, search is ran on that value, value from this search opens a new web page for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Dashboard drilldown: user clicks on value, search is ran on that value, value from this search opens a new web page for niketn. 06-05-2020 12:49 AM
- Karma Re: Sum values from a table for niketn. 06-05-2020 12:49 AM
- Karma Re: changing bars colors by a string value of a field for niketn. 06-05-2020 12:49 AM
- Karma Re: Return a custom table with empty results when no results on base search for gcusello. 06-05-2020 12:49 AM
- Karma Re: show difference of 2 accumulated values in line chart for rjthibod. 06-05-2020 12:49 AM
- Karma Re: count how many records was opened by open date field for rjthibod. 06-05-2020 12:49 AM
- Karma Re: adding css to dashboard crashed dashboard for kmaron. 06-05-2020 12:49 AM
- Got Karma for Re: Passing token value from one dashboard to another in drilldown. 06-05-2020 12:49 AM
- Got Karma for Re: How do you use eval in XML drilldown?. 06-05-2020 12:49 AM
- Got Karma for change search based on the event's field's value. 06-05-2020 12:49 AM
- Got Karma for How to use time input in another input search. 06-05-2020 12:49 AM
- Got Karma for How to use time input in another input search. 06-05-2020 12:49 AM
- Karma Re: add cumulative line on bar chart for HiroshiSatoh. 06-05-2020 12:48 AM
- Karma Re: run dashboard hourly for kamlesh_vaghela. 06-05-2020 12:48 AM
- Karma Re: Show 2 bars in every "by" value bar chart for niketn. 06-05-2020 12:48 AM
- Karma Re: Show 2 bars in every "by" value bar chart for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: how to extract time from a string time field? for dineshraj9. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 0 |
09-12-2017
07:18 AM
I have managed to do this with that way, but I need my table not to include the field "Drilldown ID".
I want to look for it in another search and then open a new web page with that value.
... View more
09-12-2017
05:51 AM
Hi,
I need to create a drilldown for my dashboard. I need to give the ability to the user to click on a value, and then run a new query and use the value that returned from the query to open a new web page with the value returned from the new query.
example:
I have the following table:
I want to exclude the "Drilldown ID" field from the table, and give the user the option to click on a record and another web page will be opened. I need the "Drilldown ID" field to be in the url of the new web page opened, but I dont want it in my table results.
Is that possible?
Thanks
... View more
08-31-2017
05:33 AM
cmerriman, it didnt work for me. I think the problem was with the format of the numbers.
the trim function solve my problem.
... View more
08-31-2017
03:57 AM
the last suggestion does not work either.
I will try to figure out the problem with the format
thanks
... View more
08-31-2017
03:25 AM
Still no results in sumForCore
count, min, max
only avg and sum doesn't
... View more
08-31-2017
01:31 AM
Hi,
I have created a table in splunk and 1 of the fields is numeric('sloc').
I would like to sum the values for each 'core'
I was trying to write something like:
index=testeda_p groupID=sloc_data
| table core sloc_date sloc
| stats sum(sloc) as sumForCore by core
But there are no results in the new field I created (sumForCore)
My result:
I have also tried:
| stats sum(tonumber(sloc)) as sumForCore by core
and nothing
what am I doing wrong?
Thanks
... View more
08-23-2017
02:59 AM
Thanks! exactly what I needed
... View more
08-23-2017
02:14 AM
Hi,
I have a field (string) that contains dates. the fields has a few formats and I need to extract the day, month and year from it.
Examples for the values possible of that field:
4/8/2016
4/8/16
04/8/2016
04/8/16
4/08/2016
04/08/2016
31/08/16
I think regex would be a good way to solve it, but I cant figure out how to use it.
Thanks
... View more
08-10-2017
01:16 AM
Hi,
I have a table of incidents and I want to count the number of incidents opened per month.
Each record updates after the status of an incident is change. for example, incident is closed so the old record updated the status field to close.
table:
After an update, the only thing I have left to know about the opening of the incident is the creation date field (sys_created_on).
Is there any way I can count the number of incidents opened for every month in timechart?
Thanks
... View more
08-06-2017
01:54 AM
Hi,
I have created a chart to show the accumulated number of open and closed ticket:
My code:
sourcetype=snow:incident
| dedup number
| search dv_assignment_group=*israel* (dv_assigned_to=*)
| eval sys_created_on = substr(sys_created_on,1,10)
| replace 5 with Closed 7 with Closed in incident_state
| table number incident_state _time
| timechart span=1d count as Opened count(eval(incident_state=="Closed")) as Closed
| accum Opened
| accum Closed
I thought of a better way to show the difference: 1 line to represent the difference between the "Open" and "Closed" over time.
Thanks
... View more
07-17-2017
01:49 AM
Hi,
I am using sql query with dbquery to get data of an item from 2 different tables.
In the first table I have the Item table that has the most data on it.
the second table:
I would like to join the tables and to get the CUSTOM_FIELD_NAME field as a field and the STRINGVALUE field as the value.
for example, I have an item with ItemID=30, and in the second table I am having 3 record with the ItemID=30:
Customer Name=ENG GEN
Area=Backup
Location=Haifa
and I need the table after the join between the 2 tables to look like that:
ItemID Item Name Customer Name Area Location
30 aaa ENG GEN Backup Haifa
40 bbb IT Backup Haifa
50 ccc IT Windows Tel Aviv
How do I join the tables with the ability to have the fields like that?
Thanks
... View more
05-26-2017
08:41 AM
this is a picture.
February (the arrow) is written on the left and I want it on the center.
https://ibb.co/kR5iXa
... View more
05-25-2017
06:49 AM
oh sorry. I did forget to mention the line of the error.
when I try to add that code that has the tag progress and finalized, the error line is:
< unset token = "NOOP_1">noop
the error is: Unexpected close tag
... View more
05-25-2017
06:41 AM
My meaning is that when I do timechart, the names of the months are at the left side of each bar. I need them to be in the center.
... View more
05-25-2017
04:33 AM
It is too big to post here but I will cut the most relevant parts.
after the input (that are serches by thier own) I have 4 reports like this one and they are the most important:
<panel>
<title>Open Tickets - All Priorities</title>
<chart>
<title>Service Now - Open Tickets</title>
<search>
<query>index=snow
assignment_group_name=*israel*
number!="Task*"
dv_state="Open*" priority=* $assignee$
| dedup number
| stats count(number) as number
| table number icon</query>
<earliest>1483257600</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[0,4000,6000,8000]</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0x84E900","0xFFE800","0xBF3030"]</option>
<option name="height">250</option>
</chart>
</panel>
and after I have 6 more reports that are "less important"
example for 1 of them:
<panel>
<title>Service Now - Time Invested on Tickets Per Queue In Hours</title>
<chart>
<search>
<query>index=snow assignment_group_name=*israel* dv_state="Clos*" number!="Task*" $assignee$
| dedup number
| eval year = substr(substr(closed_at,3,4),1,2)
| eval _time = strptime(closed_at,"%Y-%m-%d %H:%M:%S")
| rex field=dv_u_total_time_spent "(?<DAYS>\d+)\s*Day"
| rex field=dv_u_total_time_spent "(?<HOURS>\d+)\s*Hour"
| rex field=dv_u_total_time_spent "(?<MINS>\d+)\s*Minute"
| eval DAYS = if((isnull(DAYS)), 0, tonumber(DAYS))
| eval HOURS = if((isnull(HOURS)), 0, tonumber(HOURS))
| eval MINS = if((isnull(MINS)), 0, tonumber(MINS))
| eval FINAL_TIME=round(8*DAYS + HOURS + round(MINS/60,2))
| where year > 16
| replace "*dfs*" with "DFS" "*win*" with "Windows" "*new_emp*" with "Others" "*user_exit*" with "Others" israel_accessory with "HW" israel_caesarea with "Others" israel_cars with "Others" israel_ci with "Unix & Eng Comp" israel_eng_compute with "Unix & Eng Comp" israel_free_sw_approval with "Others" israel_gen with "Others" israel_hw_issue with "HW" israel_it with "Others" israel_linux_install with "Others" israel_mis with "Others" israel_network with "Net/Telephony" israel_office_relo with "Others" israel_storage with "Others" israel_tel with "Net/Telephony" israel_unix with "Unix & Eng Comp" israel_unix_eng_tools with "Unix & Eng Comp" oit_hwamstock_kiosk_israel_a with "Kiosk" oit_israel_accessory with "HW" oit_israel_eng_compute with "Unix & Eng Comp" oit_israel_gen with "Others" oit_israel_hw_issue with "HW" oit_israel_it with "Others" oit_israel_network with "Net/Telephony" oit_israel_tel with "Net/Telephony" oit_israel_unix with "Unix & Eng Comp" oit_mcs_kiosk_israel_a with "Kiosk" qct_israel with "Others" qct_israel_mis with "Others" qct_israel_pri with "Others" qct_israel_unix with "Unix & Eng Comp" mcs_kiosk_israel_a with "Kiosk" hwamstock_kiosk_israel_a with "Kiosk" israel_sparequeue3 with "CSR" OTHER with "Others" in assignment_group_name
| timechart span=1mon sum(FINAL_TIME) as "Number Of Hours" by assignment_group_name</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Number Of Hours</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="height">489</option>
</chart>
</panel>
... View more
05-25-2017
04:19 AM
Do you know that solution? because it gives me an error on that line:
noop
it says: Unexpected close tag
... View more
05-25-2017
01:48 AM
I want the reports to run in the background, so when I open my dashboard, it will be ready because it has already been activated.
... View more
05-25-2017
01:44 AM
the accum line was what I needed.
Thanks a lot!
... View more
05-25-2017
01:18 AM
I don't think that is what I need. I need my dashboard to run, even when its not open, so when I open it it will be ready and all reports are loaded. my dashboard is loaded with heavy reports.
... View more
05-25-2017
01:01 AM
Hi,
I have a report that shows the number of hours worked for each employee.
Can I add a cumulative line, to show the cumulative for all employees?
The code I am using:
index=snow dv_state="Clos*"
| dedup number
| rex field=dv_u_total_time_spent "(?<DAYS>\d+)\s*Day"
| rex field=dv_u_total_time_spent "(?<HOURS>\d+)\s*Hour"
| rex field=dv_u_total_time_spent "(?<MINS>\d+)\s*Minute"
| eval DAYS = if((isnull(DAYS)), 0, tonumber(DAYS))
| eval HOURS = if((isnull(HOURS)), 0, tonumber(HOURS))
| eval MINS = if((isnull(MINS)), 0, tonumber(MINS))
| eval numberOfHours = round(((DAYS*8) + HOURS + (MINS/60)),0)
| chart sum(numberOfHours) AS "Number Of Hours" by dv_assigned_to
| sort -"Number Of Hours"
This is the result now:
I need a line that starts from the left side (ddaniel) in 400, and than moves to 750 (slavag) and so on.
Its not by time, so is this possible to add that cumulative line?
Thanks
... View more
