Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About wangkevin1029
wangkevin1029
Communicator
Member since:
11-27-2021
04-04-2023
Community Statistics
| Posts | 113 |
| Solutions | 2 |
| Karma Given | 15 |
| Karma Received | 3 |
| Member Since | 11-27-2021 |
Activity Feed
- Got Karma for Re: drilldown AND conditions doesn't work. 04-04-2023 06:30 AM
- Posted Re: drilldown AND conditions doesn't work on Dashboards & Visualizations. 04-04-2023 05:56 AM
- Posted Why won't drilldown AND conditions work? on Dashboards & Visualizations. 04-03-2023 08:13 PM
- Posted Re: How to find out who is using my shared dashboard? on Dashboards & Visualizations. 03-27-2023 05:43 AM
- Posted How to find out who is using my shared dashboard? on Dashboards & Visualizations. 03-23-2023 10:46 AM
- Posted Re: Why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-20-2023 07:31 AM
- Karma Re: Why can I not increase multiselect field input area width? for bowesmana. 02-20-2023 07:31 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 03:08 PM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 11:14 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 07:53 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 07:27 AM
- Posted Why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 06:43 AM
- Posted Re: 3rd Token handler doesn't work with 1st and 2nd token handler together. on Splunk Search. 01-20-2023 11:14 AM
- Posted 3rd Token handler doesn't work with 1st and 2nd token handler together? on Splunk Search. 01-20-2023 10:04 AM
- Posted Re: chart drilldown earliest and latest time not working on Dashboards & Visualizations. 01-20-2023 05:41 AM
- Posted Re: chart drilldown earliest and latest time not working on Dashboards & Visualizations. 01-20-2023 05:38 AM
- Posted Why is chart drilldown earliest and latest time not working? on Dashboards & Visualizations. 01-19-2023 07:39 PM
- Got Karma for Re: How to click a timechart "count by" result as input to reopen the same dashboard?. 01-19-2023 07:24 AM
- Posted Re: How to click a timechart "count by" result as input to reopen the same dashboard? on Dashboards & Visualizations. 01-19-2023 06:49 AM
- Posted Re: How to click a timechart "count by" result as input to reopen the same dashboard? on Dashboards & Visualizations. 01-18-2023 06:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-19-2022
02:45 PM
Hi, ITWhisperer, Now I added max-width, it looks better, but not fully working, now, field box width changed, but area width not changed. before I added max-width, area width decreased, but field box not changed. #TargetSEValidationID div[data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] { width: 120px; !important; max-width: 140px; !important; } Kevin
... View more
02-19-2022
02:15 PM
Thx, ITWhisperer, I noticed that. now, I tried to use where AFRoute=case as below: basically, token can have 3 values, ALL/*, Agent/A, GroupAgent/GA, it works when Agent/A, GroupAgent/GA are selected from dropdown list, but when ALL/* is selected, it doesn't work. the following is where clause I used in query, and the other 3 are when 3 different values are selected, what shown in search. | where AFRoute=case($t_TargetType|s$ == "A","true",$t_TargetType|s$ == "GA","false",$t_TargetType|s$ == "*","*") | where AFRoute=case("*" == "A","true","*" == "GA","false","*" == "*","*") ( not working) | where AFRoute=case("GA" == "A","true","GA" == "GA","false","GA" == "*","*") (working) | where AFRoute=case("A" == "A","true","A" == "GA","false","A" == "*","*") (working) but if I directly add | search AFRoute=*, or | search AFRoute="*", it works. Kevin
... View more
02-19-2022
09:31 AM
Hi, Splunkers,
I have a Search with an input token , which is not working in my query in dashboard
t_TargetType is token name.
| search AFRoute=if($t_TargetType|s$ == "A","true","*")
when token has value A,
| search AFRoute=if("A" == "A","true","*"), which I assume is equal to | search AFRoute="true".
but when I directly run a search with | search AFRoute=if("A" == "A","true","*") , it doesn't work same as | search AFRoute="true".
what's the difference between | search AFRoute=if("A" == "A","true","*") and | search AFRoute="true"?
Kevin
... View more
Labels
- Labels:
-
panel
02-19-2022
07:54 AM
ITWhisperer， thx for your quick response. I put your code in front of my dropdown id TargetSEValidationid. unfortunately, width change not working here, I attached a screenshot below. besides, this code looks inserts a line break before it. whatever width I put here, there is always just a line break. I am pretty sure, this code causes this line break. <html> <style type="text/css"> #TargetSEValidationid div[data-component="splunk-core:/splunkjs/mvc/components/Dropdown"] { width: 100px; !important; } </style> </html> <input id="TargetSEValidationid" type="dropdown" token="t_TargetSEValidation" searchWhenChanged="true"> <label>TargetSEValidation</label> <choice value=".">ALL</choice> <choice value="TRUE">TRUE</choice> <choice value="FALSE">FALSE</choice> <default>.</default> <initialValue>.</initialValue> </input> Kevin
... View more
02-18-2022
06:49 PM
Hi, Splunkers， I used the following code to change my dropdown input width, .input-dropdown {
min-width: 120px !important;
width: 120px !important;
max-width: 120px !important;
}
.splunk-dropdown .select2-container {
min-width: 120px !important;
width: 120px !important;
max-width: 120px !important;
} when I changed width, the width of the dropdown area decreased, but the dropdown field width not change, which caused the dropdown overlapped with the next dropdown. I tried some different combination of these widths, also the following HTML text/css, also margin-bottom, etc, etc, but whatever I tried, only the width of whole area dropdown changed, never worked for the dropdown box width. I also tried the following CSS code, but have the same issue. <html>
<style type="text/css">
#input_unit {
width: 440px;
}
</style>
</html> thx in advance. Kevin
... View more
Labels
- Labels:
-
panel
01-21-2022
10:16 PM
thx, the documentation link you sent reminded me of $t_VB|s$, now, I run into a similar issue. how to concatenate a field with a token. like the following where clause, ENT_CallType is a field, t_CallType is token, using . (dot) to do concatenation doesn't work, I also tried ENT_CallType + $t_CallType|s$, it doesn't work either. | where ENT_CallType=if($t_CallType|s$ == "*",ENT_CallType,ENT_CallType.$t_CallType|s$) Kevin
... View more
01-21-2022
09:33 PM
it works when I selected VQ_abc_efg, but when ALL/* is selected, still not working. Kevin
... View more
01-21-2022
09:15 PM
it looks I should use $t_VQ|s$, instead of $t_VQ$, will do more testing. Kevin
... View more
01-21-2022
09:02 PM
acharlieh， sorry for misleading your, ALL/* here means label/value, when ALL is selected, value is *. same thing, VQ_abc_efg is also the value of token. Kevin
... View more
01-21-2022
07:00 PM
Hi, Splunkers, | where ENT_CallType=if($t_VQ$ =="*","*",ltrim($t_VQ$,"VQ_")) t_VQ is a dropdown token, value is either ALL/* or VQ_abc_efg (string starting with VQ_) what my code expected is when t_VQ = *, then |where ENT_CallType=* when t_VQ = VQ_abc_efg, then |where ENT_CallType=abc_efg but when I selected ALL/*， has the following error Error in ‘where’ command: The expression is malformed. An unexpected character is reached at ‘* == “*”,”*”, ltrim(*,”VQ_”) when VQ_abc_efg is selected, doesn't work either. thx in advance Kevin
... View more
01-20-2022
08:16 AM
Hi, ITWhisperer, it works when I just put a “” for false value， then it keeps original color. <colorPalette type="expression">if(tonumber(value)>20, "#789056","")</colorPalette> Kevin
... View more
01-20-2022
05:53 AM
Btw, the original color in table is alternatively light/dark color every other line. in this way, not sure how to specify the default color here. Kevin
... View more
01-20-2022
05:34 AM
Hi, ITWhisperer <colorPalette type="expression">if(tonumber(value)>20, "#789056","#009056")</colorPalette> I put another color code here, it works. However, here, I want to keep the original color , if tonumber(value)>20 is false. what value should I put here as color code for false? besides,
... View more
01-20-2022
01:38 AM
Hi, Splunkers， I have a field duration in the panel, I added the following <format></format> into the panel. I want this duration field to show different color when it is greater than 20. but it doesn't work. <format type="color" field="duration"> <colorPalette type="expression">if(tonumber(value)>20),"#789056")</colorPalette> </format> thx in advance. Kevin
... View more
Labels
- Labels:
-
Dashboard Studio
01-19-2022
11:23 AM
<eval token="t_VQ">if(value=="*",value,value)</eval> I changed 1st token to if... like 2nd token, it looks it works fine. will do more testing. Btw, will this unnecessary "if" expression causes a little unnecessary performance issue? Kevin
... View more
01-19-2022
08:34 AM
1st and 2nd panels using token 1 don't work. 3nd panel using token 2 works perfectly.
... View more
01-19-2022
08:26 AM
or something wrong here? only reselection of this dropdown can refresh value here? <eval token="t_VQ">$t_VQ_with2Handlers$</eval>
... View more
01-19-2022
08:20 AM
Hi,ITWhisperer, initial loading for token 2 works perfectly. but for token 1, after I added the following <init></init> at the top, still showing search waiting for input, and I can't open search to check how exactly the search is built. <init> <set token="form.t_VQ_with2Handlers">*</set> </init> Kevin
... View more
01-19-2022
07:35 AM
Hi,ITWhisperer, After more testing for token 1 t_VQ, <eval token="t_VQ">$t_VQ_with2Handlers$</eval> I noticed when I load the dashboard at the beginning, the panel using this token also shows search is waiting for input (default/initial value are ALL/*), I have to reselect other value, then change back to ALL/*, then search works. it's odd why initial load doesn't take dropdown selection? Kevin
... View more
01-19-2022
05:53 AM
should I use \ to convert *? but I did try it as below, doesn't work either. <eval token="t_VQ_CB">if(match(value, "\*"),value, value+"_CB")</eval>
... View more
01-19-2022
05:29 AM
Hi,ITWhisperer, <change> <eval token="t_VQ">$t_VQ_with2Handlers$</eval> <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> </change> 1st token t_VQ works as expected, but 2nd token t_VQ_CB, | search VQ=$t_VQ_CB$ (VQ is the field name), in the panel, why always showing Search is waiting for input... it looks there is some syntax error? Kevin
... View more
01-18-2022
11:41 PM
<input type="dropdown" token="t_VQ_with2Handlers" searchWhenChanged="true"> <label>Virtual Queue</label> <change> <eval token="t_VQ">t_VQ = t_VQ_with2Handlers</eval> like this ?do I still need $ symbol? <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> (this one is for panel2, if value is *, keep value no change, if not *, value+"_CB") </change> BTW， is the 2nd <eval token- correct? Kevin
... View more
01-18-2022
11:04 PM
Hi, ITWhisperer, I did remember what you explained to me last time for that hidden feature in a text input. not very familiar with the grammar here. <input type="dropdown" token="t_VQ_with2Handlers" searchWhenChanged="true"> <label>Virtual Queue</label> <change> <eval token="t_VQ"></eval> ( this one is for Panel1, value no change), should I leave here blank? <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> (this one is for panel2, if value is *, keep value no change, if not *, value+"_CB") </change> <default></default> </input> I tried this, but doesn't work. Kevin
... View more
01-18-2022
07:56 PM
Hi,Splunkers, I have a dashboard with 2 Panels， which share one droplist input. droplist has name/values as ALL/*, a/a, b/b, c/c, etc. for panel 1, whatever is selected, | search fieldname = $tokename$, but for panel 2, when ALL/* selected, |search fieldname = $tokenname$ as panel1, but when other values are selected, Iwant a suffix _CB to be added at the end, for example, when a/a selected, search should be built like |search fieldname=a_CB. thx in advance. Kevin
... View more
Labels
- Labels:
-
subsearch
01-16-2022
02:51 PM
thank you very much , it works. Kevin
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-04-2023
09:46 AM
|
Karma given to
