Hi 🙂 We are using Splunk 5.0.2 and have a requirement to show peak bandwidth usage over time. Here is the search that we are using over the Last 30 days: index=mediacap ( hostname="cha-cdn6506-*" OR hostname="cht-cdn6506-*" ) ( metric="ifInOctets_Port-channel10" OR metric="ifInOctets_Port-channel11" ) | eval metric=hostname.":".metric | streamstats current=t global=f window=2 earliest(value) as curr latest(value) as next by metric | eval delta=next-curr | eval inkilobits=(delta*8/1000/1000/1000) | timechart span=5m per_second(inkilobits) as in_kbps useother=f limit=0 by metric | addtotals *Octets* | fields + Total | timechart span=1d max(Total) as Usage It shows a line graph of peak usage with a span of 1 day between data points, however splunk displays those data points snapped to midnight (ie. beginning of each day). Is it possible to show the actual time in a day or hour that a peak occurred? Could it be put in a table and/or on the chart? Thanks in advance, Luke 🙂 ... View more

Hi 🙂 I am using Sideview Utils 2.4 with Splunk 5.0.2 and I am having an issue with the Lookup Updater. I have copied the update_lookup dashboard from the sideview_utils app and put it in my SplunkForMedia app and I can successfully update & delete rows, and add new rows. However when I try to re-upload a csv file, it redirects me to the update_lookup dashboard in the sideview_utils app: I start here: https://splunk/en-GB/app/SplunkForMedia/s4m_lookup_updater2#lookupName=group_elements.csv&autoRun=True Click on the Reupload tab Choose a new copy of the csv file Click Update It does upload the csv file successfully but it redirects to the sideview_utils app: https://splunk/en-GB/app/sideview_utils/update_lookup?app=SplunkForMedia&lookupName=group_elements.csv&success=true&message=The%20group_elements.csv%20lookup%20has%20been%20successfully%20updated The group_elements.csv lookup has been successfully updated Is this a bug or is there a workaround to keep the user in the SplunkForMedia app when they Reupload a csv file? Thanks in advance, Luke 🙂 ... View more

Hi 🙂 I have setup a dashboard to allow users to optionally draw a trendline on a graph. The user should be able to enter the number of days into the future for extending the trendline, but when I try to pass a token from the TextField module to a Pulldown module with a couple of staticOptions listed, the $daysFuture$ token does not get interpreted 😞 Is there a workaround that we can use to pass a token downstream to a value in a Pulldown? We are using Sideview Utils 2.3 and Splunk 5.0.1. Example code below: <module name="TextField" layoutPanel="panel_row2_col1"> <param name="name">daysFuture</param> <param name="template">$value$</param> <param name="label">Trend Days:</param> <param name="width">20px</param> <param name="float">left</param> <param name="default">30</param> <module name="Pulldown"> <param name="name">calctrendLine</param> <param name="label">Calculate Trendline:</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="label">Off</param> <param name="value"></param> </list> <list> <param name="label">On</param> <param name="value">| `lineartrend(_time, Total)` | `lineartrendextend(_time, Total, $daysFuture$)`</param> </list> </param> <module name="Checkbox"> <param name="name">drawtrendLine</param> <param name="label">Draw Trendline:</param> <param name="onValue">max(newY) as Linear_Trend</param> Thanks in advance, Luke 🙂 ... View more

Hi, I am trying to craft a search to chart bandwidth utilization across multiple switches and multiple interfaces, however I have run into a few issues: 1/ I can chart one switch with multiple interfaces, as per the example below... however if I want to add some additional fields to chart (eg. capacity, engineering_limit, & augmentation_limit) they are plotted multiple times per metric 😞 ie. those additional fields should only be plotted once, not for each interface (aka metric). 2/ Following on from above, I actually want to chart multiple switches with multiple interfaces, however timechart cannot accept multiple split-by-clause's 😞 I have tried using xyseries (as per http://docs.splunk.com/Documentation/Splunk/latest/Search/Chartmultipledataseries ) but I can't figure out how to use it with streamstats and at the same time plot the delta for the interface usage with a per_second calculation. 3/ The interfaces should actually be stacked, but this doesn't seem to work when using timechart with a split-by-clause 😞 I am running on Splunk 5.0.1. Any help is greatly appreciated 🙂 index=mediacap ( hostname="cht-cdn6506-1" ) ( metric="ifInOctets_port-channel2" OR metric="ifInOctets_port-channel3" ) | streamstats current=t global=f window=2 earliest(value) as curr latest(value) as next by metric | eval delta=next-curr | eval inkilobits=(delta*8/1000) | eval capacity=(( 47.3 )*1024*1024) | eval eng=(capacity*(( 90 )/100)) | eval aug=(capacity*(( 70 )/100)) | timechart span=5m per_second(inkilobits) as in_kbps max(capacity) as capacity max(eng) as eng max(aug) as aug by metric Thanks in advance, Luke 🙂 ... View more

Hi Nick 🙂 I'm using Sideview Utils 2.2.10 and loving it! I have written a dashboard to display charts of cisco switch interface usage and have added pulldowns with multiple selections. The user can choose multiple interfaces to chart inbound bps, outbound bps, inbound discards, and outbound discards. The dashboard is working but there are a couple of things I'd like to be able to change: 1/ The charts are drawn automatically as there are auto populating drilldowns. How do I change it so that the user has to select an interface then click the submit button to initiate the underlying searches? Without this behaviour, all interfaces are drawn on the four charts upon initial load of the dashboard as no interface has been selected. 2/ There are four multiple selection pulldowns, ie. one pulldown for each chart. Is it possible to use just one multiple selection pulldown that feeds all four charts, noting that each chart is drawing a different metric? Here is the dashboard: <view autoCancelInterval="90" decomposeIntentions="false" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html"> <label>Interface Multiple Usage</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="maxSize">2</param> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> </module> <module name="Search" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search"> | inputlookup mediacap_function.csv | dedup devicefunctioncategory | sort devicefunctioncategory </param> <param name="earliest">-5m</param> <param name="latest">now</param> <module name="Pulldown"> <param name="name">selectedFunction</param> <param name="label">Function</param> <param name="float">left</param> <param name="staticOptions"/> <param name="valueField">devicefunctioncategory</param> <module name="Search"> <param name="search"> | inputlookup mediacap_function.csv | search devicefunctioncategory="$selectedFunction$" | stats count by hostname </param> <param name="earliest">-5m</param> <param name="latest">now</param> <module name="Pulldown"> <param name="name">selectedHostname</param> <param name="label">Hostname</param> <param name="staticOptions"/> <param name="valueField">hostname</param> <module name="Search"> <param name="search">hostname=$selectedHostname$ group="interface" metric="ifInOctets_*" | rex field=metric "_(?&lt;intname&gt;.*)" | dedup intname | sort intname</param> <param name="earliest">-1h</param> <param name="latest">now</param> <module name="Pulldown"> <param name="name">selectedMetrictype</param> <param name="label">Inbound</param> <param name="float">left</param> <param name="staticOptions"/> <param name="size">5</param> <param name="template">metric="ifInOctets_$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="valueField">intname</param> <module name="Pulldown"> <param name="name">selectedMetrictype2</param> <param name="label">Outbound</param> <param name="float">left</param> <param name="staticOptions"/> <param name="size">5</param> <param name="template">metric="ifOutOctets_$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="valueField">intname</param> <module name="Pulldown"> <param name="name">selectedMetrictype3</param> <param name="label">In Discards</param> <param name="float">left</param> <param name="staticOptions"/> <param name="size">5</param> <param name="template">metric="ifInDiscards_$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="valueField">intname</param> <module name="Pulldown"> <param name="name">selectedMetrictype4</param> <param name="label">Out Discards</param> <param name="staticOptions"/> <param name="size">5</param> <param name="template">metric="ifOutDiscards_$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="valueField">intname</param> <module name="Pulldown"> <param name="name">selectedSpan</param> <param name="label">Span Granularity</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="label">5m</param> <param name="value">5m</param> </list> <list> <param name="label">10m</param> <param name="value">10m</param> </list> <list> <param name="label">15m</param> <param name="value">15m</param> </list> <list> <param name="label">30m</param> <param name="value">30m</param> </list> <list> <param name="label">1h</param> <param name="value">1h</param> </list> <list> <param name="label">2h</param> <param name="value">2h</param> </list> <list> <param name="label">4h</param> <param name="value">4h</param> </list> <list> <param name="label">1d</param> <param name="value">1d</param> </list> </param> <module name="Search"> <param name="earliest">-24h</param> <param name="latest">now</param> <module name="TimeRangePicker"> <param name="default">Last 24 hours</param> <param name="searchWhenChanged">True</param> <module name="Button"> <param name="allowSoftSubmit">True</param> <module name="Search" layoutPanel="panel_row2_col1"> <param name="search"> index=mediacap hostname="$selectedHostname$" $selectedMetrictype$ | streamstats current=t global=f window=2 earliest(value) as curr latest(value) as next by metric | eval delta=next-curr | eval inkilobits=(delta*8/1000) | timechart span=$selectedSpan$ per_second(inkilobits) as in_kbps by metric </param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="charting.chart.nullValueMode">connect</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">kbps</param> <module name="JobProgressIndicator" /> <module name="JSChart"> <param name="width">100%</param> <param name="height">200px</param> </module> <module name="Search" layoutPanel="panel_row2_col2"> <param name="search">index=mediacap hostname="$selectedHostname$" $selectedMetrictype2$ | streamstats current=t global=f window=2 earliest(value) as curr latest(value) as next by metric | eval delta=next-curr | eval outkilobits=(delta*8/1000) | timechart span=$selectedSpan$ per_second(outkilobits) as out_kbps by metric </param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="charting.chart.nullValueMode">connect</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">kbps</param> <module name="JobProgressIndicator" /> <module name="JSChart"> <param name="width">100%</param> <param name="height">200px</param> </module> <module name="Search" layoutPanel="panel_row3_col1"> <param name="search">index=mediacap hostname="$selectedHostname$" $selectedMetrictype3$ | timechart span=$selectedSpan$ avg(value) as indiscards by metric </param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="charting.chart.nullValueMode">connect</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Discards</param> <module name="JobProgressIndicator" /> <module name="JSChart"> <param name="width">100%</param> <param name="height">200px</param> </module> <module name="Search" layoutPanel="panel_row3_col2"> <param name="search">index=mediacap hostname="$selectedHostname$" $selectedMetrictype4$ | timechart span=$selectedSpan$ avg(value) as outdiscards by metric </param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="charting.chart.nullValueMode">connect</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Discards</param> <module name="JobProgressIndicator" /> <module name="JSChart"> <param name="width">100%</param> <param name="height">200px</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view> Thanks in advance, Luke 🙂 ... View more