About anooshac

vhharanpositka · ‎11-22-2021

Yes, You can do like that

anooshac · ‎11-11-2021

Hi all, I got the solution for this. Added the multiselect token like this in the query. index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)|chart distinct_count(task) as Tasks by group index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

anooshac · ‎10-26-2021

yes.. I got them.. Once again thank you so much for the help!!

anooshac · ‎10-25-2021

yes.. Got it.. Thank you so much..

anooshac · ‎10-21-2021

Hi all, I have a xml file as below. <?xml version="1.0" encoding="UTF-8"?> <suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0"> <case name="a" time="626" classname="x"> <failure message="failed" /> </case> <case name="b" time="427" classname="x" /> <case name="C" time="616" classname="y" /> <case name="d" time="626" classname="y"> <error message="error" /> </case> <case name="e" time="621" classname="x" /> </suite> The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this? |spath output=cases path=suite.case{@name}| table cases This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

anooshac · ‎09-24-2021

Yeah.. Thank you.. Forgot to put a semicolon 🙂

bowesmana · ‎09-23-2021

Try this | rex field=URL "https://(?<server_name>[^/]*)/(?<project_name>[^/]*)/job/(?<task_name>[^/]*)"

ITWhisperer · ‎08-09-2021

8/4/21 is not older than 7/30/21 Can you share some of your raw events as it doesn't look like your transaction command is working.

anooshac · ‎08-03-2021

Hi Sir, Thanks for the response. I tried like this. source="abc_data1_*" index="testing" sourcetype="_json" | transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS") And i am able to get the events. But the search is not considering the data from the beginning, instead it is considering latest data first. It affects the results. How to make the transaction to read the data from the beginning? Like the order should be from old to new. I tried to sort by _time but its not changing.

anooshac · ‎07-29-2021

yeah.. Got it! Thanks once again!!

anooshac · ‎07-21-2021

okay.. Thank you so much!

anooshac · ‎05-26-2021

It worked properly.. Thank you so much for the help!!

anooshac · ‎05-25-2021

I am sorry for that... Just asked if there are any methods for that.. Thank you so much for the help.. I'll try this only and implement it..

anooshac · ‎05-24-2021

Hi, I have a similar problem. I want to assign all the values to a token. <condition label="All"> <set token="Tok_all">"All the values should be should be assigned here"</set> </condition> also the values should be delimited with double quotes. (eg: "a","b","c")I tried a lot and i am not able to reach to the solution. do you have any solution for this?

niketn · ‎03-12-2020

If data does not have overlap, keep null values as null and keep the chart disconnected. You should see dots and not line. But even if chart line is connected you can use CSS Override to hide the line drawn for series.

harshpatel · ‎03-07-2020

Did you check if the query generated after replacing both tokens has valid condition(which should satisfy the condition on event)?

anooshac · ‎03-03-2020

Hi @woodcock , i'm sorry, there was some issue with the data. Thanks a lot for the response!!

nickhills · ‎02-27-2020

CSV Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usefieldlookupstoaddinformationtoyourevents External Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineanexternallookupinSplunkWeb KV Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/DefineaKVStorelookupinSplunkWeb Good luck!

to4kawa · ‎02-18-2020

This is sample. try spath with your query.

anooshac · ‎02-10-2020

hi @manjunathmeti , thank you so much!!! It is working, and i am getting all the fields of the json file.

anooshac · ‎02-12-2020

HI @vnravikumar , can i use where command to print the fields which of $max_num$? I have tried it and not getting any result. My file is in json format.

anooshac · ‎02-03-2020

Hi, @to4kawa , thanks a lot for the answer, i'm getting the results properly by your query as well as @kamlesh_vaghela s query. Thank you so much for the help!!

kamlesh_vaghela · ‎01-29-2020

@anooshac Can you please share search you implemented in drilldown? please mask confidential values if there.

anooshac · ‎01-28-2020

Hi @jscraig2006, thank you for the response. I changed TRUNCATE to 999999 and restarted the system. The problem got solved now!!

renjith_nair · ‎11-26-2019

@anooshac , Are you trying something similar to <dashboard> <label>Merge Rows</label> <row> <panel> <table> <search> <query>|makeresults|eval field1="A A A B B B"|makemv field1|mvexpand field1 |appendcols [|makeresults|eval field2="1 1 2 3 3 2"|makemv field2|mvexpand field2] |stats values(field2) as field2 by field1|nomv field2</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="count"> <colorPalette type="list">[#FFFFFF,#D93F3C,#D93F3C]</colorPalette> <scale type="threshold">2,1000</scale> </format> <format type="color" field="Merged"> <colorPalette type="list">[#FFFFFF,#D93F3C]</colorPalette> <scale type="threshold">2</scale> </format> <format type="color" field="field2"> <colorPalette type="map"></colorPalette> </format> <format type="color" field="field1"> <colorPalette type="map">{"A":#65A637,"B":#A2CC3E}</colorPalette> </format> </table> </panel> </row> </dashboard>

Posts	306
Solutions	2
Karma Given	10
Karma Received	1
Member Since	‎11-26-2019

Online Status	Offline
Date Last Visited	‎03-19-2025 02:12 AM

How to download the result of a search in csv usin...

timechart count and stats count are not matching

how to color a column with custome value?

Combine 2 events by a matching field without using...

Find the difference between 2 tables.

How to calculate the count of a field for multival...

Create a table with Json data

Macro not working while used in dashboard, while i...

what is the alternative command to use for mvzip?

how to change the width of a column in a table?

Re: How to customize dropdown option to select som...

Re: Pass tokens from multiselect dropdown to chart...

Re: Append fields to table after using xyseries.

Re: XML field extraction

XML field Extraction

Re: pass a value from a dashboard as token along w...

Re: extract names from URL using regex

Re: how to make transaction to consider the data f...

Re: Calculate time taken from each failed task to ...

Re: How to get the value from the json file using ...

Re: change the table header alignment

Re: Change the one label name in the dynamic dropd...

Re: pass all the values of a dropdown to a token

Re: How to Combine multiple rows into comma separa...

Re: is it possible to remove line from a line char...

Re: is it possible to use tokens from 2 different ...

Re: how to find the immediate next passed build fr...

Re: is it possible to use json file with csv looku...

Re: how to perform a search with multiple files an...

Re: how to set TIME_PREFIX for a json file?

Re: How to initialize a token value

Re: How to "group by" in JSON

Re: How to group by in nested JSON?

Re: Json file is getting truncated while uploading

Re: Merge the rows and give different colors

Are you a member of the Splunk Community?