Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About wangkevin1029
wangkevin1029
Communicator
Member since:
11-27-2021
04-04-2023
Community Statistics
| Posts | 113 |
| Solutions | 2 |
| Karma Given | 15 |
| Karma Received | 3 |
| Member Since | 11-27-2021 |
Activity Feed
- Got Karma for Re: drilldown AND conditions doesn't work. 04-04-2023 06:30 AM
- Posted Re: drilldown AND conditions doesn't work on Dashboards & Visualizations. 04-04-2023 05:56 AM
- Posted Why won't drilldown AND conditions work? on Dashboards & Visualizations. 04-03-2023 08:13 PM
- Posted Re: How to find out who is using my shared dashboard? on Dashboards & Visualizations. 03-27-2023 05:43 AM
- Posted How to find out who is using my shared dashboard? on Dashboards & Visualizations. 03-23-2023 10:46 AM
- Posted Re: Why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-20-2023 07:31 AM
- Karma Re: Why can I not increase multiselect field input area width? for bowesmana. 02-20-2023 07:31 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 03:08 PM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 11:14 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 07:53 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 07:27 AM
- Posted Why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 06:43 AM
- Posted Re: 3rd Token handler doesn't work with 1st and 2nd token handler together. on Splunk Search. 01-20-2023 11:14 AM
- Posted 3rd Token handler doesn't work with 1st and 2nd token handler together? on Splunk Search. 01-20-2023 10:04 AM
- Posted Re: chart drilldown earliest and latest time not working on Dashboards & Visualizations. 01-20-2023 05:41 AM
- Posted Re: chart drilldown earliest and latest time not working on Dashboards & Visualizations. 01-20-2023 05:38 AM
- Posted Why is chart drilldown earliest and latest time not working? on Dashboards & Visualizations. 01-19-2023 07:39 PM
- Got Karma for Re: How to click a timechart "count by" result as input to reopen the same dashboard?. 01-19-2023 07:24 AM
- Posted Re: How to click a timechart "count by" result as input to reopen the same dashboard? on Dashboards & Visualizations. 01-19-2023 06:49 AM
- Posted Re: How to click a timechart "count by" result as input to reopen the same dashboard? on Dashboards & Visualizations. 01-18-2023 06:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-16-2022
12:10 PM
Right, the result is either TRUE or FALSE, but what I want to display in dashboard is not only either TRUE or FALSE, also could be both. Kevin
... View more
01-16-2022
09:57 AM
ITWhisperer, it's perfect for TRUE or FALSE, but when I select ALL/* (value) from droplist, there is still no return. like I said before I did try both | where ValidatorResult=* , and where ValidatorResult="*", there is all no return. what I expected for selecting ALL/*, it should return all events for both TRUE and FALSE. Kevin
... View more
01-16-2022
08:33 AM
Hi, ITWhisperer, | where ValidatorResult=$dropdowntoken$ is shown as | where ValidatorResult= TRUE in search (when I open a search from dashboard)， when I select TRUE from droplist. but there is no any event return. if in search I changed | where ValidatorResult= TRUE to | where ValidatorResult= "TRUE", then there is return. or let me put it this way, the value sent from token are TRUE, or FALSE，or *， but in real search，only when I quote TRUE， FALSE， there are event return. for all/*, both * and "*", all no event return. Kevin
... View more
01-15-2022
12:02 PM
I have to admit I am a little confused about how to use boolean and string type here for TRUE or FALSE correctly. Kevin
... View more
01-15-2022
12:01 PM
ITWhisperer, thanks for your clarification. Beside, I tried to filter this valid or invalid result with input droplist with 3 choice values, name/value: ALL/*, TRUE/TRUE, FALSE/FALSE, but when I used the following search to verify where ValidatorResult = ， then i noticed, for TRUE, or FLASE, I have to use | where ValidatorResult = "TRUE", ValidatorResult = "FALSE", it works, but quote must be used, , but for *, either no quote or with quote, it doesn't work. more important, the value sent by Token, is just TRUE, FALSE, or *, all no quote. so, how to have this droplist ALL(*), TRUE, FALSE work with the validator result as a filter? | rex mode=sed field=TargeValidator "s/(?<var>\w+)\s*(?<comparator>[<>=]+)\s*(?<num>0|[1-9]\d*)//g" | eval ValidatorResult = if(match(TargeValidator,"[\d\w]"),"FALSE","TRUE") | where ValidatorResult = "*" thx in advance. Kevin
... View more
01-15-2022
07:19 AM
thank you very much, ITWhisperer... your Whisper ALWAYS the best. Btw, the 00 should also be detected as false, so, I made a little change for skill level expression. Orange > 5 & apple < 00 & ( Peach = 0 | Tomato >2) & (Strawberry =7) | rex mode=sed field=test "s/(?<var>\w+)\s*(?<comparator>[<>=]+)\s*(?<num>0|[1-9]\d*)//g" thanks again. Kevin
... View more
01-14-2022
06:00 PM
Hi， Splunkers， I have some skill expression as below: Orange > 5 & apple < 0 & ( Peach = 0 | Tomato >) & (Strawberry =7) this skill expression covers all possible combinations. How to develop a Regex to find any invalid string in this expression? Btw, extra space between different strings, or symbol is ok here. for example, like here, after apple, there is double 0 with space, there is space between tomato, and there is a missing right bracket for Strawberry =7, etc. Orange > 5 & apple < 0 0 & ( Peach = 0 | To mato >) & (Strawberry =7 thanks in advance. Kevin
... View more
Labels
- Labels:
-
regex
01-11-2022
09:18 PM
Hi, splunkers, is it possible to have multiselect also be able to type in a string? I can either select from droplist, or directly input a string? Kevin
... View more
Labels
- Labels:
-
panel
01-11-2022
10:56 AM
it works, makes perfect sense.... one it global variable, the other two are local variables. thanks again. Kevin
... View more
01-11-2022
10:28 AM
Besides, my drilldown click is to open two dashboards, one is itself, the other one different dashboard, different dashboard got the passed cellvalue. Kevin
... View more
01-11-2022
10:14 AM
BTW， I clicked the same cell I always clicked.. so, the value is a valid value for panel query 1. Kevin
... View more
01-11-2022
10:12 AM
Hi, ITWhisperer, since my original token name is Gucid_token, so, I still keep it for panel 1 query, in this way I don't have to change any other original code related to Gucid_token. but then I noticed some drilldown click stop working, which tries to open the same dashboard. why this form.Gucid_token=$click.value2$ to pass cell value to open the same dashboard stop working? I attached the full open link at the bottom. <input type="text" token="Gucid_token_with2handlers" searchWhenChanged="true"> <label>Gucid/UUID/SID</label> <change> <eval token="Gucid_token">if(match(value, "^[0-9][0-9]?$"),"", value)</eval> <eval token="skillexpressionLength">if(match(value, "^[0-9][0-9]?$"),value, 0)</eval> </change> <default></default> </input> <drilldown> <link target="_blank">/abcabc/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2$</link> </drilldown> kevin
... View more
01-11-2022
09:06 AM
thank you very much, works amazingly....
... View more
01-11-2022
08:20 AM
thank you very much, I will give a try.
... View more
01-11-2022
06:38 AM
Ok, I kinda understand your suggestion. you meant having this logic developed in input change handler, instead of in each panel's query. but how to have 2 different handlers with two tokens in one input? can you show me some sample code here? I am a junior splunker.... thx. Kevin
... View more
01-11-2022
05:50 AM
I need a hidden feature from this input field. that's why I don't want to use 2 inputs for this. Kevin
... View more
01-10-2022
07:38 PM
Hi, Splunkers， I have a dashboard with 2 panels. there is one input token, Gucid_token, what I need is when Gucid_token is any string but not a 1 or 2 digits number, then use it as search string for panle1's query , in this case, this token has nothing to do with panel 2 query. panel1 <query>sourcetype="omni:ors:voice" $Gucid_token$ Panel2 <query>sourcetype="omni:ors:voice" keyword1 keyword2 | search skilllength >1 when Gucid_token is a 1 or 2 digits number, then ignore it in panel1's query, but for panel2's query, use this token to build search like search skilllength > $Gucid_token$ panel1 <query>sourcetype="omni:ors:voice" Panel2 <query>sourcetype="omni:ors:voice" keyword1 keyword2 | search skilllength > $Gucid_token$ thx in advance. Kevin
... View more
Labels
- Labels:
-
subsearch
12-28-2021
06:13 AM
<drilldown>
<link target="_blank">/app/appname/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2$&form.field2=-7d</link>
</drilldown> the key/value patter following the dashboard link is ?form.Gucid_token=$click.value2$&form.field2=-7d not sure how to add the following two <a>xxx</a> to token fields... <earliest>-7d@h</earliest> <latest>now</latest>
... View more
12-27-2021
05:45 PM
I tried -7d@h, it doesn't work. I noticed in input type=time.... <earliest>-7d@h</earliest> <latest>now</latest> not sure if it means for any last 24 hrs， 7 days， 30days，latest field also need to be specified? Kevin
... View more
12-27-2021
10:52 AM
Hi, Splunkers， I have a dashboard with multiple panels, which all use shared time picker from token field2. when I used the following drilldown link to send token Gucid_token, time range is used dashboard's default time range. <drilldown> <link target="_blank">/app/appname/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2</link> </drilldown> but when I click drilldown link, I prefer to use a different hardcode time range, like "Last 7 days", instead of original default time range of my dashboard. so, I added form.field2=Last 7 days in my drilldown link following the 1st token form.Gucid_token=$click.value2 as below. but unfortunately, it doesn't work. <drilldown> <link target="_blank">/app/appname/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2$&form.field2=Last%207%20days</link> </drilldown> anyone knows how to pass the hardcode time range through this drilldown link? thanks in advance. Kevin
... View more
12-25-2021
12:21 AM
doesn't work. if I put NOT _raw="*$free_text_tok$*" in my search, then it changes to NOT _raw="*"*" "tokenvalue"*" if I put NOT _raw="$free_text_tok$" in my search, then it changes to NOT _raw=""*" "tokenvalue"" in real search. Kevin
... View more
12-24-2021
12:23 PM
I may or may not have this text or dropdown input to exclude this string. that means If I don't have this Exclude string by this text or dropdown input, then search _raw!="" ??? I tried sth similar, but not working.
... View more
12-24-2021
11:21 AM
<change>
<condition>
<set token=not_free_text_tok>NOT $free_text_tok|s$</set>
<condition>
</set> should <condition> </set> be </condition> </change>? besides, there is unquoted attribute value for line <set token=not_free_text_tok>........ Kevin
... View more
12-24-2021
07:58 AM
Besides, I can't use NOT $tokenname$ in xml, cause I may or may not use this EXCLUDE string. Kevin
... View more
12-24-2021
07:56 AM
rrovers， I need to input this string in an input box or select this string from dropdown list in dashboard. Kevin
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-04-2023
09:46 AM
|
Karma given to
