About bowesmana

bowesmana · ‎06-25-2024

Something like index=your_index earliest=-1d@d latest=now | eval day=if(_time>=relative_time(now(), "@d"), "today", "yesterday") | eval fieldcount = 0 | foreach * [ eval fieldcount=fieldcount+1 ] | stats count max(fieldcount) as fieldcount by day will give you event count and field count per day, but not totally sure if the foreach will count correctly for fieldcount and it will very much depend on your data whether this is suitable or not. This assumes you ingest the data both yesterday and today. But there are many open area - what's the relevance of field order - there's not concept of field order in Splunk - what if new rows are added or removed 'today', what do you want to see

bowesmana · ‎06-25-2024

Here's one way of doing it index=anIndex sourcetype=aSourceType aString earliest=-481m@m latest=-1m@m | eval age=now() - _time | eval age_ranges=split("1,6,11,31,61,91,121,241",",") | foreach 0 1 2 3 4 5 6 7 [ eval r=tonumber(mvindex(age_ranges, <<FIELD>>))*60, zone=if(age < 14400 + r AND age > r, <<FIELD>>, null()), z=mvappend(z, zone) ] | stats count by z what this is effectively doing is set up the base age, which are your right hand minute values. Then as each gap is 4 hours, (14400 seconds) use a foreach loop to go round each of the 8 age bands and see if the age is in that band. The output is a multivalue field that contains the bands it is found it. Then stats count by, will count for each band, so that should give you the counts in each of your bands. Does this give you what you want

bowesmana · ‎06-25-2024

So how are you expecting to correlate the 2 data sets? How do you find events with RELATED_VAL that are related to the row containing REFERENCE_VAL i.e. if the data is reference_val_1 related_val_1 reference_val_2 related_val_2 related_val_3 reference_val_3 related_val_4 how do you expect to correlate related_val_3 with any of the 3 reference vals is it simply time proximity and if so, can you have interleaved reference_vals that may be in the same time window? Can you give an example of data - otherwise the requirements are too vague

bowesmana · ‎06-25-2024

Basic search for doing this is index... | eval isInWindow = if (_time > relative_time(now(),"-241m@m") AND _time < relative_time(now(),"-1m@m"),1,0) | stats sum(isInWindow) as A which sets isInWindow to be 1 or 0 depending on whether it's in or out then just summing the field. As for calculating sliding windows, streamstats is a way to do that, but you could also just do maths to set various counters using the same relative_time logic and then sum those counters. There are other ways, but it depends on what you want to do with that

bowesmana · ‎06-25-2024

What are you changing, by custom reporting commands do you mean you've written some python extension? You don't need to restart Splunk generally, but depends what you have changed Are you running on-prem - if so, highly recommend this app https://splunkbase.splunk.com/app/4353 If you are changing Javascript, you can run the bump command https://hostname/en-GB/_bump or there is the refresh option https://hostname/en-GB/debug/refresh depending on whether you can access these.

bowesmana · ‎06-24-2024

Panel B is part of dashboard X, but you say that the export works for dashboard X but not for panel B? When you say popup, do you mean a modal dialog box on top of the underlying dashboard or just a panel hidden by depends="$token$". I expect it will not export a modal popup generated through JS.

bowesmana · ‎06-24-2024

And you can also add a <change> element in the multiselect, which although officially unsupported, does work, i.e. this <change> <eval token="selections">mvcount($form.element$)</eval> </change> Note that you don't need the split here as the $form.element$ is only flattened in the token assignment in the SPL

bowesmana · ‎06-24-2024

As @ITWhisperer , you should use $form.element$ - the $form.element$ variant of the token is the one that holds the values of the selections, whereas the base $element$ holds the final full expanded token with all the prefixes, suffixed and delimiter, see your slightly modified example. <form version="1.1" theme="light"> <label>test2</label> <fieldset submitButton="false"> <input type="multiselect" token="element" searchWhenChanged="true"> <label>Fruit Select</label> <choice value="a">Apple</choice> <choice value="b">Banana</choice> <choice value="c">Coconut</choice> <choice value="d">Dragonfruit</choice> <choice value="e">Elderberry</choice> <choice value="f">Fig</choice> <choice value="g">Grape</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>, </delimiter> </input> </fieldset> <row> <panel> <title>Form element::$form.element$, Element::$element$</title> <single> <title>Number of selected fruit</title> <search> <query>| makeresults | eval selected_total=mvcount(split($form.element|s$,",")) | table selected_total</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> </form> I am not sure if the| eval selected_total=mvcount(split($form.element|s$,",")) would work also in dashboard studio also.

bowesmana · ‎06-24-2024

First question - is the output a single row or are there multiple rows expected, in which case, what is the entity that separates the rows - is it REFERENCE_VAL and if so, how does one correlate REFERENCE_VAL to RELATED_VAL? This is the ONE row solution index=someIndex searchString OR someSearchString | rex field=_raw "stuff(?<REFERENCE_VAL>)$" | rex field=_raw "stuff(?<RELATED_VAL>)$" | stats min(eval(if(isnotnull(REFERENCE_VAL), _time, null()))) as EVENT_TIME min(eval(if(isnotnull(RELATED_VAL), _time, null()))) as RELATED_TIME | eval timeBand=RELATED_TIME-EVENT_TIME | where abs(timeBand)<2000 which will only give a result if the time range is less than 2 seconds, but I suspect you are expecting more than one row...

bowesmana · ‎06-23-2024

Are you using XML dashboard or Dashboard Studio XML documentation is here https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML What have you got so far?

bowesmana · ‎06-21-2024

At the very basic level you are producing a timechart with a span=1h and you want a time chart with a daily set of numbers, so that's wrong. However, it's impossible to say what is going on here, you have so much going on in the search. You have to go back to basics, which means start with the basic data and at EACH step of your SPL make sure the data is giving you what you expect. So, take a very small sample set of data and run the SPL line by line, check the output after each line. When you are happy that the data is giving you the correct output from 1 line of SPL, add in the next line.

bowesmana · ‎06-20-2024

This is what you need #linked_list.input-link{ width: 400px !important; } where your input is <input id="linked_list" type="list"... Here's some more useful ways of changing linked list input types - this shows a tab style selection <row depends="$AlwaysHideCSS$"> <panel> <html> <style> #linked_list.input-link{ width: 400px !important; } #linked_list label{ display:none !important; } #linked_list.input-link div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ display: -webkit-box !important; } #linked_list.input-link button{ min-width: 100px !important; max-width: 130px !important; border-top-color: #E1E6EB; border-top-style: solid; border-top-width: 1px; border-right-color: #E1E6EB; border-right-style: solid; border-right-width: 1px; border-left-color: #E1E6EB; border-left-style: solid; border-left-width: 1px; border-top-left-radius: 10px; border-top-right-radius: 10px; } #linked_list .splunk-choice-input-message{ display: none !important; } #linked_list.input-link button[role="radio"][aria-checked="true"]{ background-color: #62B5E5 !important; color: #000 !important; } #linked_list.input-link button[role="radio"][aria-checked="false"]{ background-color: #005587 !important; color: #fff !important; } </style> </html> </panel> </row> Hope this is usefulk

bowesmana · ‎06-20-2024

bin command also needs snap to, i.e. | bin _time span=1w@w or | bin _time span=1w aligntime=@w+1d otherwise it just gives you 7 day chunks.

bowesmana · ‎06-20-2024

Saw your thread on Slack, but I wonder if this is useful https://community.splunk.com/t5/Reporting/How-to-run-a-savedsearch-with-the-owner-permission/m-p/213229 so using the ref= would give you access to search results which you perhaps could post-process with your vars you would pass to the search. However, that still doesn't really solve the partitioning issue you're looking for. Do search filters for roles give you a workable solution - I suspect that may be too broad though.

bowesmana · ‎06-19-2024

Is that a field in Splunk that is a string. You can do this by swapping the characters around - for your first example | eval date=replace(date, "(\d{4})-(\d{2})", "\2-\1") and your second | eval date=replace(date, "(\d{4})\/Q(\d)", "Q\2/\1") where your data field is called date

bowesmana · ‎06-19-2024

P_vandereerden's reply is a good starting point, but there are two things to consider 1. The use of a subsearch to constrain an outer search may not perform well if there are a large number of requests ids with that log line. If you are expecting a large number of hits for "log_line" then you may need to consider a different approach. 2. The use of transaction has limitations and although it has use cases, it's options should be understood in relation to your data set, particularly when your data set is large. Very often the stats command can be used to achieve the same thing as transaction without the limitations, so it very much depends on what you want to do with the resultant grouped data. For example this is generally a simple replacement for transaction | stats values(_raw) as _raw range(_time) as duration count by requestId which will give you the raw events, the duration from first to last and the number of events for any given request id.

bowesmana · ‎06-19-2024

I would generally recommend setting the token to the submitted token model as well as the default, i.e. var submittedTokenModel = mvc.Components.getInstance('submitted'); and submittedTokenModel.set('clickedButtonValue', value); I'm also not entirely sure how the <dashboard> or <form> structure of a dashboard changes how tokens are managed, because the token models effect how the tokens are used when clicking submit buttons in a dashboard, where the dashboard will always be a <form> dashboard. So, first change the dashboard to <form> and then try the changed JS - hopefully one will make the difference.

bowesmana · ‎06-19-2024

What is the x-axis you need. You have 3 fields output in your search | table StatisticalId Value Unit and there is a lot of mvexpand logic going on... and that seems like you are going to multiple your data significantly as there's no correlation between each of the MV values you are expanding. That aside, the basic command to create the chart would be something like | chart max(Value) over Unit by StatisticalId which would put Unit on the x-axis. Swap Unit and StatisticalId to make StatisticalId the x-axis

bowesmana · ‎06-18-2024

This timeline viz https://splunkbase.splunk.com/app/4370 does support a fixed top and/or bottom x-axis timeline. Not sure how much mileage you will get with it - how many rows do you have in your table?

bowesmana · ‎06-18-2024

Your data has a lower case 'a' for atmtransaction and your like statement as 'A' If you want to use like() then add in lower(), i.e. | eval Status=if(like(lower(message),"%work flow passed | for endpoint atmtransaction%"),"SUCCESS", "FAIL") NB: match(message, regex) is an alternative to like, so you only need to match the part you are interested in, not the entire string, the match equivalent would be | eval Status=if(match(message,"(?i)work flow passed \| for endpoint atmtransaction"),"SUCCESS", "FAIL")

bowesmana · ‎06-17-2024

@kmjefferson42 if that dashboard was made with Splunk 7, then you probably would have to add version="1.1" to the <form> header. I don't think there's anything problematic with copy/pasting the old dashboard XML to a new dashboard

bowesmana · ‎06-17-2024

@leykmekoo A tip for the future 😀 | inputlookup your_lookup | eval your_wildcard_field=your_wildcard_field."*" | outputlookup your_lookup

bowesmana · ‎06-16-2024

Start here | rest "/servicesNS/-/-/saved/searches" splunk_server=local search="is_scheduled=1" | rename eai:* as * acl.app as app | fields title app author type search that will give you the data, then do what you need to do with it

bowesmana · ‎06-16-2024

I understood, but you can't do what you want to do and it's unlikely to get supported, but by all means create a new idea in that ideas link I posted.

bowesmana · ‎06-16-2024

Yes, you can just say | eval behindfirewall=max(behindfirewall) however, I am not sure if that will totally work, because if something in my example is attached to LoadBalancer-B, then it will assume it's behind the firewall, so not totally sure if my suggestion is valid

Posts	3484
Solutions	752
Karma Given	298
Karma Received	1355
Member Since	‎09-05-2011

Online Status	Offline
Date Last Visited	Wednesday

Windows TA not extracting key_path as registry_pat...

Why does FIELDALIAS work or doesn't depending on t...

How can I write this regex for rex to extract mult...

How to rename fields in a table without changing c...

Why doesn't drilldown eval token statement work un...

Performance fields/stats/table

Infoblox TA not extracting response code

Is there any way to create CSS that can be dynamic...

How to break up groups of <input> elements onto th...

tokenlinks.js in Splunk 8.24 broken- working dashb...

Re: How to validate the data before and after the ...

Re: How to count based upon relative_time ?

Re: Find event in one search, get related events b...

Re: How to count based upon relative_time ?

Re: custom reporting command

Re: How to export a popup panel on dashboard to pd...

Re: Count selected items in Multiselect

Re: Count selected items in Multiselect

Re: Find event in one search, get related events b...

Re: Dashboard and Tokens

Re: Splunk query for Visualization

Re: CSS for link list button align button horizont...

Re: Converting Date to first day of the week

Re: User(s) limited search to indexes they don't h...

Re: data

Re: How do I search for all events in the same "re...

Re: Using SplunkJs, by clicking button, token valu...

Re: Splunk query for Visualization

Re: Splunk Timeline - Custom Visualization - Get t...

Re: Conditional Success/Fail

Re: How to create dashboard with clickable hyperli...

Re: How to Match the First three characters of a M...

Re: saved searches

Re: How to change the green color of the timeline ...

Re: how to improve eventstats efficiency

Join the Conversation