About maayan

maayan · ‎09-14-2023

i added: | xyseries CT,foo,countE to my query i think its ok 🙂

maayan · ‎09-14-2023

Thanks but how to present that in a bar chart? (to add foo to my bar chart). I can present that only in a table | stats sum(CountEvents) by CT | rename "sum(CountEvents)" as "countE" | eventstats sum(countE) as Total | eval perc=round(countE*100/Total,2) | eval foo = countE . "(" . perc ."%" .")" | fields - Total perc

maayan · ‎09-13-2023

Can we show them in one row? for example: 223,229 (45%) it will look much better

maayan · ‎09-13-2023

Hi thanks not soo petty, but good enough as a workaround Do you know how can I add "%" to each value? current query: | stats sum(CountEvents) by CT | rename "sum(CountEvents)" as "CountEvents" | eventstats sum(CountEvents) as Total | eval percentages%=round(CountEvents*100/Total,2) | fields - Total

maayan · ‎09-13-2023

Hi, Too many hours to solve such a simple question...It is supposed to be a basic thing I want to present both percentages and regular values in bar chart (it can be in the tooltip, like it exists in a pie chart), If not possible to present only percentages but add the "%" symbol (when I tried to add % it converted the fields to string and nothing was shown in the chart) * I can't add a js script, no access to the server This is my query: | stats sum(CountEvents) by CT | rename "sum(CountEvents)" as "countE" | eventstats sum(countE) as Total | eval perc=round(countE*100/Total,2) | chart sum(perc) as "EventsPercentages[%]" over CT thanks a lot

maayan · ‎08-15-2023

Ok i understand, so what do you recommend me to do in my case to improve the performance? It takes too long time to load and run queries.. And how can I extract all the original fields from the index? in case I execute the report without aggregation (without stats) to pull data from index : index=summary source="SummaryIndex_Main" | table *

maayan · ‎08-13-2023

Hi , First query: I get the results. The error still exists but I get the data. The problem is that I need to extract the original fields, not sure that I get all of them i will check. in addition, it takes time to extract and i thought that the summary index supposes to improve the performance. Second query: The query stopped and the errors are: "DAG Execution Exception: Search has been canceled Search auto-canceled Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.The search job has failed due to an error. You may be able view the job in the" thanks!

maayan · ‎08-13-2023

But I have a problem extracting data from the index not writing to the index. (when I created the index I schedule a daily job on a range of 24 hours (data of 1.8, 2.8,..,6.8 separately). Now I need to use the data that was collected in the index and present data of 30 days

maayan · ‎08-13-2023

"Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk." i dont have permissions to change the config files, what am i doing wrong in my steps? i extracted on this case only 987,771 events

maayan · ‎08-13-2023

Hi, i tried to implement the summary index as you suggested but i had a problem to extract the original fields from the main query. i read that i might use stats and stats. i posted a new post. maybe you can help. thanks

maayan · ‎08-13-2023

Hi, I'm working with a large amount of data. I have a main report that extracts all data of the previous month and 5 additional small reports that filter by event type and take the only fields that are relevant for the event. For example: report 1 for event A, report 2 for event B, and so on.. In order to improve the performance I want to use a summary index. I read the documentation and I'm doing the following: Create a report in: "Searches, Reports, and Alerts" the query is : index=myIndex source=mySource sourcetype=_json | rename… | table … | stats values(*) as * by TimeStamp,source | lookup lookUp_table_toAdd_Fields.csv source AS source | sistats values(*) as * by TimeStamp,source Enable summary index Scheduled the report. Run daily for 24 hours. Create a new search to extract data saved in the index: index="summary" source="SummaryIndex_Main" | stats values(*) as * by TimeStamp,source | table * Data range- only 6 days (data between 1.8-6.8, only 987,771 events) Results: When it runs it looks like it collecting the data but when the run finish, the statistics tab contain no results and I get the error:" The following error(s) occurred while the search ran. Therefore, search results might be incomplete." I don’t have permission to change the config files and I'm not sure what I'm doing wrong. Please help!! *Note- I need to extract all the original fields from the main query this is why I use sistats and stats (and not collect). And I have no aggregation. Just need to extract the data and be aware of overlaps. * Relevant questions that I have posted: https://community.splunk.com/t5/Reporting/Summary-index-for-non-aggregated-data-How-to-read-only-delta/m-p/653550#M12166 https://community.splunk.com/t5/Reporting/Why-sistats-doesn-t-work-after-lookup/m-p/653864#M12170 Thanks, Maayan

maayan · ‎08-10-2023

stupid solution but works- write stats before and after lookup: | stats values(*) as * by TimeStamp,source | lookup mylookup_table.csv source AS source | stats values(*) as * by TimeStamp,source

maayan · ‎08-09-2023

Hi, I wrote a report that merge the result with lookup table to add fields (like machineName). the lookup table contain the field,source. then, I do sistats as the following: index=....search query... | lookup lk_table_name.csv source AS source | sistats values(*) as * by TimeStamp,source if I write sistats command after the lookup command the new fields from the lookup table disappear. if i write the sistats before the lookup command everything is ok but then i have other problem when i try to parse the summary index: index=summary search_name="query_SummaryIndex_Main" | stats values(*) as * by TimeStamp,source what should i do? why sistats doesnt work after lookup? thanks, Maayan

maayan · ‎08-08-2023

Thanks Gcusello! Can you explain more about: "you can calculate delta, global and partial sum, etc..." ? I didn't find documentation and also asked in other communities and nobody knows.

maayan · ‎08-07-2023

ok, I will try,thanks! And regarding my first question, is it something that I can do in Splunk? (read delta data) And which method do you recommend to use in my case? data model or summary index? thanks

maayan · ‎08-07-2023

Hi, I'm working with a large amount of data. I wrote a main report that extracts all events (let's call them events A,B,C,D) from the last 30 days and do some manipulations for fields. And then i wrote 5 reports that filter the main saved report by events type and get only the relevant fields for each event: For example- the report for event A contain all fields relevant for event A, report for event B contains all fields relevant for event B and etc. My dashboard contains 5 tabs, one for each event (tab 1 for report A, tab 2 for report B,..), and triggers the relevant saved search report (reports A/B/C,..) Problems- all the reports run very slow My questions: 1. How to read only delta data each time? i mean, how to not read 30 days each time at once, if the query was already run today and i execute it one more time it should read only new data and use the history data that have already read in the previous run. 2. i read a bit about summary index. my reports extract all fields and not aggregate data. how to create my 6 reports (main+5 others) with summary index? As i said, - i use table command and not functions like top,count,.. in my query (my reports just extract relevant fields with some naming manipulations) * in case that you would recommend to use summary index i will appreciate if you could provide me example code, because i have 6 reports and not sure how work with summary index thanks, Maayan

maayan · ‎07-18-2023

i'm also waiting for that. is there any update?

maayan · ‎07-18-2023

Hi, Great solution! I have an additional parameter to present (source). tokRow1 and tokRow2 work and i can see their values, but not tokRow3 values. What am I doing wrong? my code is attached below. (note- i don't care to add a table and present the values in a table when use click on a specific dot in the timeline visualization, but I don't know how) thanks a lot! <row> <panel> <viz type="timeline_app.timeline"> <search base="aa"> <query> | stats count by WinTimeStamp2,source,Name | eval EventName=Name | table WinTimeStamp2 Name EventName source </query> </search> <option name="drilldown">all</option> <option name="timeline_app.timeline.axisTimeFormat">SECONDS</option> <option name="timeline_app.timeline.colorMode">categorical</option> <option name="timeline_app.timeline.maxColor">#DA5C5C</option> <option name="timeline_app.timeline.minColor">#FFE8E8</option> <option name="timeline_app.timeline.numOfBins">6</option> <option name="timeline_app.timeline.tooltipTimeFormat">SECONDS</option> <option name="timeline_app.timeline.useColors">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <set token="tokRow1">$row.Name$</set> <set token="tokRow2">$row.WinTimeStamp2$</set> <set token="tokRow3">$row.source$</set> </drilldown> </viz> <html> <div>Event Name: $tokRow1$</div> <div>Time: $tokRow2$</div> <div>File: $tokRow3$</div> </html> </panel> </row>

maayan · ‎07-16-2023

Hi, I have a table of 3 columns: Event name, time(=when the event happened) and source (file name). I need to create a flow chart (similar to the attached picture) when X-axis represents time and Y axis binary (event happen or not). I need a line for each event name and a different color for each line. I also need to filter by time range (like the chart in the picture, to have the option to look on different time intervals). Also, click on a specific point and get its raw data (to know from which file it was taken). Can I do it in Splunk? How? I tried to create a timeline, but it doesn't look so good : | eval myTime=TimeStamp/10000000 - 11644473600 | eval WinTimeStamp2=strftime(myTime, "%Y-%m-%dT%H:%M:%S.%Q") | bin WinTimeStamp2 span=1d | stats count by WinTimeStamp2, Name example for timestamp=133265876804261336 Thanks, Maayan

maayan · ‎07-10-2023

ok, thanks a lot!! 🙂 finally, i used this one: https://community.splunk.com/t5/Dashboards-Visualizations/Is-there-a-way-to-implement-multiple-tabs-pages-for-a-single/m-p/649840/highlight/false#M53224

maayan · ‎07-10-2023

thanks but you didn't answer 🙂 what should I do if I switch between tabs I get the error: "Search was not dispatched. To adjust search dispatch settings, edit the dashboard XML"?

maayan · ‎07-10-2023

Great solution thank you! I added "depends" to my all charts search, it's loading only the data in the current tab, but when I click on another tab (after the current tab finish to run) error is written in all charts: " Search was not dispatched. To adjust search dispatch settings, edit the dashboard XML" Do you know why? thanks, Maayan

maayan · ‎07-09-2023

Hi, Thanks for your reply. I need to create a dashboard with tabs (tab for different topic) without connection to tokens (and without JS script). I also need that because my dashboard performance is too slow, so maybe tabs will help. I will try to set the token to "" (empty value) as you said. can you write me an example please of where to set the token to:"" ? and do you have an example maybe from a different post to my need? because now i need to add $toekn$ to my search when i don't need that. thanks a lot

maayan · ‎07-09-2023

Hi, great job it looks good. However, when i click on different tabs, the presented charts don't change. Can you post an example so if I click on tab : 'compenent', I would see a different chart compared to clicking on tab:source type? In addition, i do not really understand, can you explain please what is 'tokSplit'? and $tokSplit|s$? and how to define them? thanks a lot!

maayan · ‎07-09-2023

Hi, My search base takes 13 sec to run but it takes more than 1 min for the dashboard to run. I use savedsearch func and it's still very slow. here is part of my dashboard (there are more charts, more filters and variables). Can you help me to improve the performance, please? <form theme="light"> <label>Analysis Report</label> <search id="AllQueries_Base"> <query> | loadjob savedsearch="mpazchen:search:joinWithLookup_Base" | where $Mac_Address$ AND $WinTimeStamp$ </query> </search> <row> <panel> <input type="multiselect" token="WinTimeStamp" searchWhenChanged="true"> <label>Time</label> <choice value="%">All</choice> <default>%</default> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>(WinTimeStamp like("</valuePrefix> <valueSuffix>"))</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>WinTimeStamp</fieldForLabel> <fieldForValue>WinTimeStamp</fieldForValue> <search base="AllQueries_Base"> <query> | where ( $Mac_Address$ ) | dedup WinTimeStamp | sort WinTimeStamp</query> </search> </input> <input type="multiselect" token="Mac_Address" searchWhenChanged="true"> <label>Mac Address</label> <choice value="%">All</choice> <default>%</default> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>(Mac_Address like("</valuePrefix> <valueSuffix>"))</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>Mac_Address</fieldForLabel> <fieldForValue>Mac_Address</fieldForValue> <search base="AllQueries_Base"> <query> | where ( $WinTimeStamp$ ) | dedup Mac_Address | sort Mac_Address</query> </search> </input> </panel> </row> <row> <panel> <single> <search base="AllQueries_Base"> <query> | stats dc(HostName) as count_distinct_Machines </query> </search> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="height">133</option> <option name="rangeColors">["0xdc4e41","0x3c444d"]</option> <option name="rangeValues">[0]</option> <option name="trellis.enabled">0</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="underLabel">Machines</option> </single> </panel> <panel id="CSSPanel4"> <single> <search base="AllQueries_Base"> <query> | where Header_Type="Event" | stats count </query> </search> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="height">133</option> <option name="rangeColors">["0xdc4e41","0x3c444d"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="underLabel">Events</option> </single> </panel> <panel id="CSSPanel5"> <single> <search base="AllQueries_Base"> <query> | stats dc(source) </query> </search> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="height">133</option> <option name="rangeColors">["0xdc4e41","0x334457"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="underLabel">Files</option> </single> </panel> </row> <row> <panel id="CSSPanel3"> <title>General events type distribution by time</title> <chart> <search base="AllQueries_Base"> <query> | chart count over WinTimeStamp by Name | addtotals fieldname=total </query> </search><option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option> <option name="charting.axisTitleX.text">Day</option> <option name="charting.axisTitleY.text">Number of events</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisY.abbreviation">auto</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.backgroundColor">#f2f4f5</option> <option name="charting.chart">column</option> <option name="charting.chart.overlayFields">total</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel id="CSSPanel11"> <title>General events type distribution</title> <chart> <search base="AllQueries_Base"> <query> |stats count by Name |sort -count</query> </search> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="charting.backgroundColor">#f2f4f5</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel id="CSSPanel2"> <title>Top 10 events count by machine</title> <chart> <search base="AllQueries_Base"> <query> | chart count over HostName by Name | addtotals fieldname=total| sort -total | head 10 </query> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option> <option name="charting.axisTitleY.text">Number of events</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.backgroundColor">#f2f4f5</option> <option name="charting.chart">column</option> <option name="charting.chart.overlayFields">total</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel id="CSSPanel14"> <single> <search base="AllQueries_Base"> <query> | chart count over HostName| stats avg(count) AS AVERAGE_Events_Per_User</query> </search> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="height">137</option> <option name="numberPrecision">0.0</option> <option name="rangeColors">["0xdc4e41","0x334457"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="underLabel">Average Events by Machine</option> <option name="unitPosition">after</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel id="CSSPanel10"> <html> <center> <h1> </h1> </center> </html> </panel> </row> <row> <panel id="CSSPanel1"> <html> <center> <h1 style="color:white;"> WiFi Successful And Failed Connection Events</h1> </center> </html> </panel> </row> <row> <panel> <title>Connection Type</title> <chart> <search base="AllQueries_Base"> <query>  |stats count by "Connection_Type" |sort -count</query> </search> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form>

Posts	61
Solutions	1
Karma Given	15
Karma Received	0
Member Since	‎04-30-2023

Online Status	Offline
Date Last Visited	‎01-14-2024 04:43 AM

Alerts Dashboard

Chart- return all cell==0

Delta time between each row - calculate frequency ...

How to create a sensitive table?

Add time range filter based on specific column whe...

How to add tabs to studio dashboard?

How to improve the filter input?

How to show both values and percentages bar chart?

What am i doing wrong in summary index?

Why sistats doesn't work after lookup?

Re: Show both values and percentages bar chart

Re: Show both values and percentages bar chart

Re: Show both values and percentages bar chart

Re: Show both values and percentages bar chart

How to show both values and percentages bar chart?

Re: What am i doing wrong in summary index?

Re: What am i doing wrong in summary index?

Re: What am i doing wrong in summary index?

Re: What am i doing wrong in summary index?

Re: Summary index for non aggregated data

What am i doing wrong in summary index?

Re: Why sistats doesn't work after lookup?

Why sistats doesn't work after lookup?

Re: Summary index for non aggregated data

Re: Summary index for non aggregated data

Summary index for non aggregated data: How to read...

Re: Timeline Custom Visualization - Tooltip with i...

Re: Can't drill down specific column in TimeLine c...

Flow chart

Re: How can we create Tabs using Link List in Splu...

Re: Splunk Dashboard

Re: Splunk Dashboard

Re: How can we create Tabs using Link List in Splu...

Re: How can we create Tabs using Link List in Splu...

How can I improve dashboard time performance?