Hello, I have got a dashboard with more than one dropdown's in it. But I need to create a dropdown with following options. default countgt10 countgt20 countgt50 countgt100 <input type="dropdown" token="select_count"> <label>select_path_aggregation</label> <choice value=>countgt10</choice> <choice value=>countgt20</choice> <choice value=>countgt50</choice> <choice value=>countgt100</choice> </input> I have got a query index=main source=/opt/test/log/test.log | stats count by product If the query returns the count > 10 then results need to sent to the value of countgt10, if the count is greater than 20, it needs to be sent to the values of countgt20 and similarly to the other options. ... View more

I have following values for a field="Listdir". I want to get the only the values which contains 3 or more directories. /opt/test/class/ /opt/ /opt/test/learn/ /opt/test/ /opt/test/class/file/ /opt/ /opt/test/class/file/location/users/ /opt/test/class/ /opt/test/class/bin/ /opt/ The output should look like below: /opt/test/class/ /opt/test/learn/ /opt/test/class/file/ /opt/test/class/file/location/users/ /opt/test/class/bin/ ... View more

I'm fetching data by hitting an API, and the data I get will be a single event which consists of cpu_used and corresponding time(cpu_time). The cpu_time will be in the format (1531981800). I need to plot a timechart based on the cpu_used by cpu_time but not _time. While i'm running following query I'm getting _time in the x-axis but which should suppose to be cpu_used and cpu_used on the y-axis. x-axis values as follows: i531981800, 1531982400, 1531982700, 1531983000 1531983600 and corresponding y-axis values: 25, 40, 30, 55, 70 Query: index=sai_core source="saii" | eval mytime=strftime(cpu_time, "%Y-%m-%d %H:%M:%S") | timechart span=1h values(cpu_used) by mytime ... View more

I have a query to list out all the values of directory. index=main source="*test*" | stats count by directory This gives me all the directories that are present in the event and values of the directories in the event as follow: /opt/test/splunklog/testing/directory1/test1.log /opt/test/splunklog/testing/directory1/test2.log /opt/test/splunklog/testing/directory1/test3.log /opt/test/splunklog/testing/directory1/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test2.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test3.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test4.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test4.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test2.log /opt/test/splunklog/testing/directory1/directory2/testing1.log /opt/test/splunklog/testing/directory1/directory2/testing2.log /opt/test/splunklog/testing/directory1/directory2/testing3.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test3.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test4.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test2.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test3.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test3.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test4.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test4.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test2.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test1.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test2.log /opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test3.log I want to use this results as the values of a dropdown in the dashboard. I need to aggregate the results at different directory nesting level. And the nesting level should be selectable. By default aggregation should be done at 3 level (e.g. /opt/test/splunklog/testing). I should be able to select 4th, 5th or 6th level aggregation. Thanks in Advance ... View more

Hello, I have a script which runs every 4 hours and the output is written to Splunk, Everyday six are being written to Splunk. I need to restrict events based on the time range I select, For an instance, When I look for the last 24 hours I need only one event to be shown, but actually there are six events in the last 24 hours, Similarly when I check for the last 7 days I need to see only 7 events i.e., one event from each day need to be displayed. I'm not sure if it's possible. ... View more

Hello, I have a couple of dashboards which contains two pie charts of two nodes. I want to merge these dashboards into one. I want to group pie charts of one dashboard and put it in the drop down menu and similarly the other one. For an instance: I want to group node1 and node2 to the value of dashboard1 and node3 and node4 to the value of dashboard2 in the dropdown. When I choose dashboard1 the piecharts of node1 and node2 should only be displayed. When I choose dashboard2 the piecharts of node3 and node4 should only be displayed. Please find the source of one of my dashboards and the other dashboard content will also be similar to this. <dashboard> <label>UsedVsAvailable</label> <row> <panel> <title>PieChart</title> <chart> <title>Node1</title> <search> <query>index=sai_core source="*size*" Name="Sai Kumar" | head 1 | eval ConsumedSpace = TotalSpace - AvailableSpace | table ConsumedSpace AvailableSpace | transpose</query> <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <!--option name="width">50</option--> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.showLabels">0</option> <option name="charting.chart.showPercent">0</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">1</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">left</option> <option name="charting.lineWidth">2</option> <option name="height">250</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> <panel> <title>AvailableVsTotal</title> <chart> <title>Node2</title> <search> <query>index=sai_core source="*size*" Name="Sai Kumar" | head 1 | eval ConsumedSpace = TotalSpace - AvailableSpace | table TotalSpace AvailableSpace | transpose</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </dashboard> ... View more

I have written a query which produces a pie chart but I do not wish to display fields name in the pie chart. Can someone assist on this? ... View more

Hello, I have following content in the event and I want to display TotalSpace and ConsumedSpace in the single pie chart. For an instance: if the TotalSpace is 1000 and the ConsumedSpace is 250 then the 1/4th of the pie should display as ConsumedSpace over TotalSpace. Event: This is total space is TotalSpace=2000 This is Available space is AvailableSpace=1000 Name="Bollam" Query which I had written: index=sai_core source="size" Name="Bollam" | eval ConsumedSpace = TotalSpace - AvailableSpace | stats first(ConsumedSpace) as ConsumedSpace by TotalSpace ... View more

I have got multiple events in a log file which contains few key-value pairs and i want to look at only the existence of three key-value pairs (name and location) in all the events. Name="xyz", age="aa" and location="zzz" I want to find the percentage of events where "age" does not exist by location and all the "Name" by location I have following query which gives me the result but not what im expecting. Key "Name" is being in under location where the event "age" does not exist. The column should be blank under location if "age" does not exist. Also I need recent five "Name" in which age does not exist. index=main | stats count as Total, count(eval(NOT isnull(age))) as MATCHED count(eval(isnull(age))) as UNMATCHED by location | eval pctMatched = round(MATCHED/Total*100, 1) | eval pctUnmatched = round(UNMATCHED/Total*100, 1) | eval PercentExists = pctMatched + "%" | eval PercentDoesNotExist = pctUnmatched + "%" | table cluster percentTagged percentUntagged | appendcols [ search index=main | stats count by location, Name | sort -count | streamstats count as rank by location | where rank <= 5 | stats list(Name) as Name, list(count) as count by location | fields - location, count | table Name ] ... View more

I have got multiple events in a log file which contains few key-value pairs and i want to look at only the existence of three key-value pairs (name and location) in all the events. Name="xyz", age="aa" and location="zzz" I want to find the percentage of events where "age" does not exist by location and all the "Name" by location I have following query which gives me the result but not what im expecting. Key "Name" is being in under location where the event "age" does not exist. The column should be blank under location if "age" does not exist. Also I need recent five "Name" in which age does not exist. Sample event: The name of the person Name="xyz" The age of the person age="qq" The location of the person location="www" index=main | stats count as Total, count(eval(NOT isnull(age))) as MATCHED count(eval(isnull(age))) as UNMATCHED by location | eval pctMatched = round(MATCHED/Total*100, 1) | eval pctUnmatched = round(UNMATCHED/Total*100, 1) | eval PercentExists = pctMatched + "%" | eval PercentDoesNotExist = pctUnmatched + "%" | table cluster percentTagged percentUntagged | appendcols [ search index=main | stats count by location, Name | sort -count | streamstats count as rank by location | where rank <= 5 | stats list(Name) as Name, list(count) as count by location | fields - location, count | table Name ] ... View more

Hello, I have a multiple events in a log file which contains field A and field B but not in all the events, I need to compare the field B with field A, If field B does not exist in any of the events then I need to list out the field B values. ... View more