About Jouman

Jouman · ‎04-20-2023

Hi all, I design a dashboard with 3 panels and I hope to set different color to the background or headline of each panel to be able to read clearly. Is there any way to assign each Panel into different color in XML? Thanks

Jouman · ‎04-20-2023

Thanks for the suggestion. I think about this method. However, in the following Panel_2, Panel_3 and Panel_4, the search index and data are more than what Panel_1 can generated. I found if I set Panel_1 as base_search, my Panel_2~Panel_4 are unable to execute since no sufficient index and data. Is there any other method? Panel_1 is used to limit the input to Panel_2~4 while Panel_2~4 have each own condition to select the exact input from output of Panel_1. Thanks.

Jouman · ‎04-20-2023

Hi all, I want to implement 2 panels in one dashboard. Output of Panel_1 will be a list of ID that meet the search keyword and I hope to find a way to use the output as the input to Panel_2, Panel_3, and Panel_4. Panel_2, Panel_3, Panel_4 will use the list of ID to search but using different conditions. I can't find a way to make the output of Panel_1 as the input to the rest 3 Panels. Is there any way to implement such purpose? Moreover, is there any way to color each Panel into different color? Thanks.

Jouman · ‎01-04-2023

Thank you so much! I just tried this solution, and it works perfectly. I can't describe how much I am delighted, thanks again.

Jouman · ‎01-03-2023

Hi all, I applied the code as following, but it does not work. Neither A,B,C panels are displayed no matter what kind of input I select. It seems the match function is unable to pass in the condition check. I tried several ways to adjust the match function but it doesn't work still. Does anyone have any clues about the issue? --------- <input type="multiselect" token="tokShowHidePanel" searchWhenChanged="true"> <label>Display Level-2 Panel</label> <choice value="panelA">A</choice> <choice value="panelB">B</choice> <choice value="panelC">C</choice> <default>panelA</default> <change> <eval token="tokShowPanelA">mvfind($value$,"panelA")</eval> <eval token="tokShowPanelB">mvfind($value$,"panelB")</eval> <eval token="tokShowPanelC">mvfind($value$,"panelC")</eval> </change> </input> <panel depends="$tokShowPanelA$"> <title>Table 1</title> <table> .... </table> </panel> <panel depends="$tokShowPanelB$"> <title>Table 2</title> <table> .... </table> </panel> <panel depends="$tokShowPanelC$"> <title>Table 3</title> <table> ... </table> </panel> Thank you so much.

Jouman · ‎01-02-2023

The answer works perfectly! Thank you so much!

Jouman · ‎01-02-2023

Hi, I try this suggestion and rephrase into my codes as below. But the 3 panels will not be displayed no matter I select A, B, C sololy, or AB, BC, CA as a pair, or select ABC all. Therefore, sadly the suggested codes can not work as I expect. Does anyone have any further suggestion ? <input type="multiselect" token="tokShowHidePanel" searchWhenChanged="true"> <label>Display Panel</label> <choice value="panelA">A</choice> <choice value="panelB">B</choice> <choice value="panelC">C</choice> <default>panelA</default> <change> <eval token="tokShowPanelA">mvfind($value$,"A")</eval> <eval token="tokShowPanelB">mvfind($value$,"B")</eval> <eval token="tokShowPanelC">mvfind($value$,"C")</eval> </change> </input> <row> <panel depends="$tokShowPanelA$"> .... </panel> <row> <panel depends="$tokShowPanelB$"> .... </panel> <row> <panel depends="$tokShowPanelC$"> .... </panel> Thank you!

Jouman · ‎01-02-2023

Hi all, I deal with a multi-value fields and try to provide a multiselect dropdown for users. Therefore, I use mvfind() in the setting for Token value(prefix) / Token value(Suffix). Token value(Prefix) = isnotnull(mvfind( HWid, " Token value(Suffix) = ")) It works well if I input one HW ID or many HW ID. However, I get trouble in inputing "all". I want to provide users all events by default but I am unable to find a way to do this by using mvfind(). It is similar as wildchar (all any values) to mvfind(). Is there any suggestion on how to provide all events on mvfind() ? Thank you so much! Jouman

Jouman · ‎12-30-2022

Hi all, I would like to display panels only if they are selected by multi-select dropdown. So I use <condition match=....> to compare the input string. Becuase users may enter more than one keywords for panels, I want to make the condition to allow multiple input values. ex. if users select Panel A and Panel B, then both panels should be shown, and panel C is hidden. But my code doesn't work as I expected. No matter I choose Panel A or Panel B from dropdown, none of the panels are displayed. Could anyone help to check which part of codes I wrote is wrong? <choice value="panelA">Panel A</choice> <choice value="panelB">Panel B</choice> <choice value="panelC">Panel C</choice> <change> <condition match="match('value',"panelA")"> <set token="tokenA">true</set> <unset token="tokenB" /> <unset token="tokenC" /> <set token="tokenA_B">true</set> </condition> <condition match="match('value',"panelB")"> <set token="tokenB">true</set> <unset token="tokenA" /> <unset token="tokenB" /> <set token="tokenA_B">true</set> </condition> <condition match="match('value',"panelC")"> <set token="tokenC">true</set> <unset token="tokenA" /> <unset token="tokenB" /> <unset token="tokenA_B" /> </condition> ... <row> <panel depends="$tokenA$, $tokenA_B$,"> <title>Table 1</title> ...... Thank you.

Jouman · ‎12-29-2022

Hello! Thanks for your advice. How can I set/unset tokens for each categories, for example, if I have A,B,C, 3 categories in total? i.e., if I select "A" in the multi-selection dropdown, only panel "A" should be visible. i.e., if I select "A" and "B" in the multi-selection dropdown, both panel "A" and panel "B" can be visible. I know I should check tokens in xml as below but I don't have any idea about where/how to set the tokens. <panel depends="tokenA"> <search> </search> </panel> <panel depends="tokenB"> <search> </search> </panel> <panel depends="tokenC"> <search> </search> </panel> Thank you indeed!

Jouman · ‎12-29-2022

Hello! I got trouble to find a way to provide panels for user-input percentage on raw events. User can input 90, 75, 50, 25, or any value to represent percentage 90, percentage 75, percentage 50, percentage 25, and so on. The corresponding events could be displayed in seperated panels. The number of panels displayed depends on how many counts of values from users' input. Does anyone have ideas to implement this? Thank you so much.

Jouman · ‎12-29-2022

Hi Sir, Thanks for the reply. If using this method, the category can be filtered out. However, if I select two categories, the events belong to two categories will be displayed in one panel. I wish to display the events belong to two or three categories in to seperated panels and pop-out the corresponding panel only if the category is selected. Does any one have any ideas? Do I need to change any code in xml? Thanks.

Jouman · ‎12-29-2022

Hi All, I am working on analyzing processing time among 10 devices and categorize all the evnets into 3 categories, including "Max", "Avg" and "PR99" (Which means its processing time in percent 99 in all events) for each device. Raw data: Category Processing time(sec) Device id Max 121 1 PR99 106 1 Avg 70 1 Max 117 2 PR99 106 2 Avg 71 2 Max 78 3 PR99 77 3 Avg 62 3 ... .... ... I want to display the category into seperated panel only if the category is selected. Does any one have suggestion on how to implement this on Splunk? For example: if select "Max", "Avg" through some scroll bar Panel 1: List "Max" only Category Processing time(sec) Device id Max 121 1 Max 117 2 Max 78 3 ... .... ... Panel 2: List "Avg" only Category Processing time(sec) Device id Avg 70 1 Avg 71 2 Avg 62 3 ... .... ... Thank you. Jounman

Jouman · ‎12-05-2022

Hi all, Do you know what is the logic of bin command? I want to explain why the number of bin is 2 instead of 10. Thank you.

Jouman · ‎12-05-2022

Hi all, I use the demo data and the bin commands as below. I expect to get 5 bins seperately, 1st bin : include 1-4 2nd bin : include 5-8 3rd bin : include 9-12 4th bin : include 13-16 5th bin : include 17-20 But the output bin is only 2, they are 0-10 and 10-20. -------------------------------------------- | makeresults | eval exe_time="1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20" | makemv exe_time delim="," | mvexpand exe_time | bin exe_time as time_bin bins=10

Jouman · ‎12-05-2022

Hi all, I would like to highlight each fields in the same column in blue. But I don't know how to configure it. Do any one have ideas? For numeric fields, currently, I set color as "range" and set the range from minimum to maximum into one color to fulfill my expectation. But for those fields with letters, I don't have a good way to do. Thank you.

Jouman · ‎12-05-2022

Hi Sir, Because the number of Test-id becomes quite large, after I apply the code as a solution, | stats max(*) as max* avg(*) as avg* list(*) as * The warning will be displayed along with the output: The following caution(s) occurred while the search ran. 'stats' command: limit for values of field 'xxx' reached. Some values may have been truncated or ignored. Is there any way to avoid or solve this issue ? Thank you.

Jouman · ‎12-04-2022

Hi all, I would like to assign the column name in the table below, and follow the order I list. As you can see, the column name does not in alphabetical order. But I don't know which command I can use to assign the column name and sequence as expectation. Do any one know how to set the column name and its sequence as well ? Thank you. Log ID Log index TIME_TOTAL BEFORE_B_PROC AFTER_B_PROC AFTER_R_T AFTER_R BEFORE_BEGIN_G BEFORE_M AFTER_M Proc_END

Jouman · ‎11-29-2022

Hi Yuan, Thank you so much! I try the method and it works. The original data you listed is correct. The "Example No." field from my original data is to represent these Scenario_Start, and Scenario_IDx comes from the same experiment. Therefore, they should be analyzed together. It is also correct to use "sequence" from your table to categorize the data.

Jouman · ‎11-29-2022

Hi all, I would like to use bin command to make the demo data sets into 10 bins according to Exe_time and list Substage_time along with it. Do anyone have ideas about how to use bin command correctly? I use these commands, but the output isn't as my expectation. |bin Exe_time as time_bin bins=10 |stats values(Substage_time) by time_bin Demo data sets are listed below: Exe_time Substage_time Count 10 8 11 2 21 9 12 2 32 8 1 43 9 19 4 54 9 12 3 65 8 11 6 66 9 19 7 67 8 11 6 70 9 12 6 71 8 11 5 80 7 4 81 9 12 11 95 7 8 108 11 3 220 8 11 5 Thank you.

Jouman · ‎11-23-2022

Hi all, I would like to know how to write a SPL code to solve the issue that is to pick the scenarios follow the 3 logic. (1) pick the Scenario_IDx whose time tag is later than its previous Scenario_IDy. (x is bigger than y) Any Scenario_IDx whose time tag is ealier than its previous Scenario can be ignored. Ex. Scenario_ID1 time tag should bigger than Scenario_Start. (In Ex.1: Scenario_ID1: 103 > Scenario_Start: 101) Scenario_ID2 time tag should smaller than Scneario_ID1 and Scenario_Start. (In Ex.1: Scenario_ID2: 104 >Scenario_Start: 101 and Scenario_ID2: 104 > Scenario_ID1: 103) (2) If there are multiple same scenario later than previous Scenario time tag, pick the one with the earliest time tag. Ex. Take Ex. 2 as an example. For Scenario_ID3, pick Scenario_ID3: 204 only. Scenario_Start: 201 Scenario_ID1: 202 Scenario_ID2: 203 Scenario_ID3: 204 Scenario_ID3: 205 (3) If for the Scenario_IDy, there is no Scenario_IDx later than Scenario_IDy time tag. Then no need to list anything for Scenario_IDx. (x>y) Ex. Take Ex. 3 as an example. All time tag of Scenario_ID5 is earlier than the one of Scenario_ID1. So in "Expected sequence", no need to list Scenario_ID5. Here are the sample original scenario sequence, the corresponding information sequence and the expected scenario sequence and the corresponding information sequence as well. Both of them are multi-value fields. Does anyone have suggestion on SPL code to compose the "Expected sequence" and "Expected information sequence" output? Example no. Original sequence (in time tag) Original information sequence (in time tag) Expected sequence (in time tag) Expected information sequence (in time tag) 1 Scenario_Start: 101 Scenario_ID1: 103 Scenario_ID1: 105 Scenario_ID2: 102 Scenario_ID2: 104 Scenario_Start_info:AAA Scenario_ID1_info:BBB Scenario_ID1_info:CCC Scenario_ID2_info:DDD Scenario_ID2_info:EEE Scenario_Start: 101 Scenario_ID1: 103 Scenario_ID2: 104 Scenario_Start_info:AAA Scenario_ID1_info:BBB Scenario_ID2_info:EEE 2 Scenario_Start: 201 Scenario_ID1: 202 Scenario_ID2: 203 Scenario_ID3: 204 Scenario_ID3: 205 Scenario_Start_info:AAA Scenario_ID1_info:BBB Scenario_ID2_info:CCC Scenario_ID3_info:DDD Scenario_ID3_info:EEE Scenario_Start: 201 Scenario_ID1: 202 Scenario_ID2: 203 Scenario_ID3: 204 Scenario_Start_info:AAA Scenario_ID1_info:BBB Scenario_ID2_info:CCC Scenario_ID3_info:DDD 3 Scenario_Start: 301 Scenario_ID1: 305 Scenario_ID5: 302 Scenario_ID5: 303 Scenario_ID5: 304 Scenario_Start_info:AAA Scenario_ID1_info:BBB Scenario_ID5_info:CCC Scenario_ID5_info:DDD Scenario_ID5_info:EEE Scenario_Start:301 Scenario_ID1:305 Scenario_Start_info:AAA Scenario_ID1_info:BBB Thank you so much.

Jouman · ‎11-13-2022

Hi Yuanliu and all, Thank for Yuanliu's help. I modify from his code ; therefore I am able to solve the issue, "Only the "Test Response Time" field is used to compare, after choosing the max "Test Response Time", the Procedure-1/-2/-3 field come from that corresponding row instead of comparing Procedure-1/-2/-3 itself." , whichi I listed earlier by the code in green highlight. | stats max(*) as max* avg(*) as avg* list(*) as * | eval avg = "Avg", max = "Max" ``` avg, max initial value ``` | foreach Total* [eval max=max.":".'max<<FIELD>>'."(from Test-".tostring(mvfind(<<FIELD>>,'max<<FIELD>>')+1).")", max_index=tostring(mvfind(<<FIELD>>,'max<<FIELD>>'))] | foreach Procedure* [eval max=if(isnotnull(mvindex(<<FIELD>>,max_index)), max.":".mvindex(<<FIELD>>,max_index),max)] | foreach Total* Procedure*``` actual order depends on real name of Procedure_1, 2, 3, etc ``` [eval avg = avg . ":" . 'avg<<FIELD>>' . "=(" . mvjoin(<<FIELD>>, "+") . ")/3"] | eval maxavg = mvappend(max, avg) | fields + maxavg | mvexpand maxavg | eval maxavg = split(maxavg, ":") | eval header = mvappend("(in sec)", "Total Response Time", "Procedure-1", "Procedure-2", "Procedure-3") | foreach "(in sec)", "Total Response Time", "Procedure-1", "Procedure-2", "Procedure-3" [eval <<FIELD>> = mvindex(maxavg, mvfind(header, "<<FIELD>>")) ] | fields - header maxavg This really helps me a lot. Thank you

Jouman · ‎11-13-2022

Hi Yuanliu and all, Thank you for the help, it helps a lot. I correct my example data in Table 2 for maximum Test Response Time description. The purpose for the analysis is to find the the row which leads to maximum Test Response Time field. So the Procedure-3 in Table 2 shall be 150 (from Test-3) instead of 333 (from Test-1). Is there any way to fulfill this ? Only the "Test Response Time" field is used to compare, after choosing the max "Test Response Time", the Procedure-1/-2/-3 field come from that corresponding row instead of comparing Procedure-1/-2/-3 itself. Thank you so much.

Jouman · ‎11-10-2022

Hi all, I am working on calculating the response time (for max, PR99, and avg value) from Table 1. I would like to list the detail procedure duration (Procedure-1/-2/-3) and name the ROW1 as max/PR99/AVG, the output would be similar as Table 2. Do anyone have idea about how to implement this to include max response time and the corresponding Procedure time as well, instead of list maximum value in each field? Moreover, is there any way to include average response time and average Procedure-1/-2/-3 time into the same table as well? Table 1: (in sec) Procedure-1 Procedure-2 Procedure-3 Total Response Time Test-1 111 222 333 666 Test-2 200 100 300 600 Test-3 250 350 150 750 Table 2: (in sec) Total Response Time Procedure-1 Procedure-2 Procedure-3 Max 750 (Test 3) 250 (come from Test 3) 350 (come from Test 3) 150 (come from Test 3) Avg (666+600+750)/3=672 (111+200+250)/3=187 (222+100+350)/3=224 (333+300+150)/3=261 Thank you so much. #table #chart #stats #max

Jouman · ‎11-09-2022

Hi all, I already find the solution for my questions. Thanks for all the reply you provided.

Posts	55
Solutions	1
Karma Given	15
Karma Received	0
Member Since	‎07-31-2022

Online Status	Offline
Date Last Visited	‎02-17-2024 02:45 PM

How to associate two data set when one set need to...

How can I make the column content align to right w...

How to use a list of output as the input parameter...

How to display dynamic values in the panel title?

How to display panels dynamically depends on selec...

How to use stats() by one value, "all" and stats()...

How to assign the 2 start_time and stop_time of on...

How to extract the element from a structure?

How to use two related tokens to create as two con...

How to transfer decimal value into ASCII code in t...

How to set different background colors to differen...

Re: The spl code to use the output of Panel_1 to o...

What is the spl code to use the output of Panel_1 ...

Re: How to display panels dynamically depends on s...

Re: How to display panels dynamically depends on s...

Re: How to assign the value to contain all events ...

Re: How to display panels dynamically depends on s...

How to assign the value to contain all events if u...

How to write condition check for conditional panel...

Re: How to display panels dynamically depends on s...

Can I input multiple percentage value and list the...

Re: How to display panels dynamically depends on s...

How to display panels dynamically depends on selec...

Re: How to calculate through bin command ?

Re: How to calculate through bin command ?

Can I assign a color to a column but not related t...

Re: How to get max and average response time and t...

Assign the column name in a specific order?

Re: How to compose the output in time and Scenario...

How to calculate through bin command ?

How to compose the output in time and Scenario_ID ...

Re: How to get max and average response time and t...

Re: How to get max and average response time and t...

How to get max and average response time and their...

Re: How to compose a table with one search word is...

Join the Conversation