Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jvmerilla
jvmerilla
Path Finder
Member since:
09-12-2017
04-03-2023
Community Statistics
| Posts | 58 |
| Solutions | 0 |
| Karma Given | 15 |
| Karma Received | 4 |
| Member Since | 09-12-2017 |
Activity Feed
- Karma Re: WinEvenLog for Security EventCode IN (4768) missing parts after Certificate Thumbprint for diogofgm. 04-03-2023 03:35 AM
- Posted Re: WinEvenLog for Security EventCode IN (4768) missing parts after Certificate Thumbprint on All Apps and Add-ons. 04-03-2023 03:34 AM
- Posted WinEvenLog for Security EventCode IN (4768) missing parts after Certificate Thumbprint on All Apps and Add-ons. 04-03-2023 02:30 AM
- Karma Re: When converting time to epoch, why am I getting weird results? for FrankVl. 06-05-2020 12:50 AM
- Karma Does the Splunk Enterprise Security license expire? for jadengoho. 06-05-2020 12:50 AM
- Got Karma for When converting time to epoch, why am I getting weird results?. 06-05-2020 12:50 AM
- Karma Re: eval command after stats command not working for kamlesh_vaghela. 06-05-2020 12:49 AM
- Karma Re: eval command after stats command not working for niketn. 06-05-2020 12:49 AM
- Karma Re: Converting date to epoch time for harsmarvania57. 06-05-2020 12:49 AM
- Karma Re: Overlay in column chart not showing for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: using bin command and span for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Issue with stats count(eval()) command for Yunagi. 06-05-2020 12:49 AM
- Karma Re: Issue with stats count(eval()) command for mayurr98. 06-05-2020 12:49 AM
- Got Karma for How to reset or hide a drilldown panel. 06-05-2020 12:49 AM
- Got Karma for Re: using bin command and span. 06-05-2020 12:49 AM
- Got Karma for How to convert the values of multiple fields to number?. 06-05-2020 12:49 AM
- Karma Re: How to reference a scheduled report for a base search for byu168168. 06-05-2020 12:48 AM
- Karma How to close a drilldown panel in dashboard without refresh? for abhijitnath89. 06-05-2020 12:48 AM
- Karma Re: How to close a drilldown panel in dashboard without refresh? for adayton20. 06-05-2020 12:48 AM
- Karma Re: Dynamic value display in the Panel Title for russellliss. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
01-17-2018
02:01 AM
Hi All,
I just want to know how to add the visualizations from Web Framework Toolkit into an XML dashboard. I have read some of the tutorials online but it always suggests to convert the dashboard to HTML.
Is their a way to do this without converting to HTML?
Thanks in advance! 🙂
... View more
01-16-2018
11:38 PM
Hi mayurr98 ,
This is my query:
index="pcmm" sourcetype="sampledata_intervention.csv"
| stats count by "Intervention Class"
Temporarily, I used pie chart as a visualization.
... View more
01-16-2018
11:21 PM
Hi All!
Just want to ask if it is possible to do this kind of Bubble Chart in Splunk without converting to HTML?
Thanks in advance! 🙂
... View more
01-09-2018
05:56 PM
Here is my code on this dashboard:
<form>
<label>Online News Popularity_v2.0</label>
<fieldset submitButton="false" autoRun="false">
<input type="text" token="popularity" searchWhenChanged="true" depends="$hidden$">
<label>Popularity</label>
</input>
</fieldset>
<row>
<panel>
<title>Total Published Online News by Popularity (w/drilldown)</title>
<chart>
<search>
<query>index="online_news"
| apply "online_news_popularity" as predicted_popularity
| stats count by predicted_popularity</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.showPercent">1</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<set token="form.popularity">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<title>Popularity: $popularity$</title>
<table depends="$popularity$">
<search>
<query>index="online_news"
| apply "online_news_popularity" as predicted_popularity
| search predicted_popularity=$popularity$
| stats values(url) as "Article's URL" by shares
| sort -shares
| eval Shares = tostring(shares,"commas")
| table "Article's URL", Shares</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
... View more
01-09-2018
05:52 PM
1 Karma
Hi everyone,
I need some help here.
I have a panel with a pie chart and it has a drilldown panel.
When the pie chart is clicked, the drilldown panel shows.
Now what I want to happen is that the user can reset or hide the drilldown panel when it is not needed anymore.
How is it possible?
Thanks in advance.
... View more
12-26-2017
05:59 PM
Hi,
I have multiselect input and here's the code"
<label>Type</label>
<delimiter> </delimiter>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>Ticket Type</fieldForLabel>
<fieldForValue>Ticket Type</fieldForValue>
<search base="baseSearch">
<query>| stats count by "Ticket Type"</query>
</search>
It generates to values, "Incidents" and "Service Request". And using the token, I was able to pass the value to the title of a panel. Now, what I'm trying to do is to pass the static label, which is the "All" to the title of the panel as well.
How will I able to do that?
... View more
Labels
- Labels:
-
panel
12-20-2017
01:47 AM
Hi,
I have a chart with this query:
index="sample_data" sourcetype="analytics_sampledata.csv" Status="*" "Ticket Type"="*" Priority="*"
| fields *
| rename "Reported_Assigned Date" as Reported_Assigned_Date
| eval _time = strptime(Reported_Assigned_Date, "%m/%d/%Y") | rename "Application Name" as Application
| timechart span=1mon count by Application
This is the visualization:
The span here is dynamic. It is being set by a "drop-down input"
What I want to happen is that to pass this span to the drilldown so that I the result I will get in the drilldown is only the data within that time span.
How will I do this?
... View more
12-18-2017
12:59 AM
Hi,
I'm trying to create a dropdown form input named "Span" where the values are "Daily", "Weekly", and "Monthly".
The idea is that when I choose one of the values, the panels under it will be populated base on their "Daily", "Weekly" or "Monthly" count.
I don't know if I made myself clear but I hope someone can help me with this.
Thank you.
... View more
12-17-2017
10:55 PM
Hi @kamlesh_vaghela,
I tried your code and I also tried something similar to this. The problem with this is that when I use the accum command, it returns wrong values.
I'm not sure but I think it is because the time it is using is already in a human-readable format.
... View more
12-17-2017
10:25 PM
Hi @MousumiChowdhury,
I just want to clarify, where should I put the code? Is it before or after the "eval _time"?
I tried it and put it to the last part of my code but when I hover over my chart it shows "Invalid timestamp".
... View more
12-17-2017
10:23 PM
Hi @kamlesh_vaghela,
Thank you for your response.
I tried it but the problem is that it shows months in number like 05, 06, instead of the name like May, and June. I need the date to show like this "May 2017" and "Jun 2017".
... View more
12-17-2017
09:21 PM
Hi,
Is it possible to reformat the _time, for example, remove the day so only the month and the year will remain?
I have a query here:
index="sample_data" sourcetype="management_sampledata.csv"
| fields*
| search Status="*" "Ticket Type"="*" Priority="*" Ticket_No=*
| rename "Reported Date" as Reported_Date
| eval _time = strptime(Reported_Date, "%m/%d/%y") | timechart span=1mon count(eval(Status="Closed" OR Status="Cancelled")) as Closed/Cancelled, count as Inflow
| eval Backlog_Total = Inflow - 'Closed/Cancelled'
| accum Backlog_Total as Backlog_Total(acccumulation)
| fields - Backlog_Total
This code is good, but my problem with this is when I visualize it into a chart.
If you notice, if I hover over the chart, it shows the date, now what I want is for the month and the year to show only.
Is there any possible way to do this?
... View more
12-13-2017
01:09 AM
Hi @mayurr98,
It also works.
Thank you. 🙂
So the main cause of the error is the * , and also the format of the code?
... View more
12-13-2017
12:46 AM
Hi,
I have this query:
index="sample_data" sourcetype="analytics_sampledata.csv"
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval(Status="Closed" AND Resolution_Code="Not Resolved *")) as "Closed/Not Resolved Tickets"
And this is the result:
I don't know what could be wrong with query but the second eval is not returning any value.
I hope anyone would shed a light on this.
Thank you.
... View more
12-12-2017
12:21 AM
1 Karma
Hi @mayurr98,
It took me a while to figure out what you mean but I get it now. And I already check the data using stats count(eval) , and you're right, there's no overlapping. The 180-210 were actually the sum of 180-209.
Thank you for your help. 🙂
... View more
12-11-2017
02:12 AM
Hi @mayurr98,
I'm sorry but I did not understand. How would I check if there's no overlap?
... View more
12-10-2017
10:21 PM
HI,
I have this query:
index="sample_data" sourcetype="management_sampledata.csv" | fields* | search Status!=Closed "Ticket Type"="*" Priority="*"
| rename "Reported Date" AS Reported_Date
| eval reported_date = strptime(Reported_Date, "%m/%d/%y %H:%M")
| eval date_today = now()
| eval duration = round((date_today-reported_date)/86400)
| bin duration span=30
| chart count as "Open Tickets" by "Support_ Assigned Group", duration
and this is what it shows:
My question is why it returns 180-210 and 210-240? Is it possible that there will be overlaps, like if there's a data with the value of 210, then it will be in both 180-210 and 210-240?
Also is there a way where I can my make it like 180-210, 211-240?
I hope someone can help me with this.
Thank you.
... View more
12-07-2017
11:55 PM
Hi,
Is it possible to add a "%" character/symbol to a number without converting it to a string?
I tried to use this code:
| eval percentage = round((On_time/Total)*100)."%"
But it converted the number into a string, so when I try to use the "percentage" field as an overlay in a Column Chart, it does not show anything. It has to be an integer.
I want it to have the "%" character so that when I hover over the overlay, the value would have the "%" sign so that it would be easy to know that it is a percentage, not just any number.
Is this possible?
I hope anyone can help me with this.
Thank you.
... View more
12-06-2017
06:41 PM
Hi @HiroshiSatoh,
I tried it but it doesn't work the way I want it.
It does not get the exact value of the field. It only got 180 instead of 183.
... View more
12-06-2017
05:43 PM
Hi,
I'm working with an old data where I need to get the value of a field for the 'supposed' previous month.
Here's my query:
index="sample_data" sourcetype="management_sampledata.csv" "Ticket Type"=* Priority=* Ticket_No=*
| eval _time = strptime(Date, "%m/%d/%y")
| timechart span=1mon count(eval(Status="Closed")) as Closed/Cancelled, count as Inflow
| eval Backlog_Total = Inflow - 'Closed/Cancelled'
And here's the result:
What I'm trying to do is to get the value of Backlog_Total of the supposed previous month which is '2017-05'.
How would I be able to do it? And also it needs to be dynamic.
I hope you can help me with this.
Thank you.
... View more
12-05-2017
07:20 PM
It works!
I didn't realize that I just have to remove the "%" character.
Thank you! 🙂
... View more
12-05-2017
06:04 PM
Hi,
I'm trying to create a column chart with overlay but when I set the overlay it is not showing in the chart.
Here's my query:
index="sample_data" sourcetype="management_sampledata.csv" date_month=* Status=* "Ticket Type"=* Priority=*
| eval _time = strptime(Date, "%m/%d/%y")
| eval Month = strftime(_time, "%b")
| stats count(Ticket_No) as Total by Month
| appendcols
[search index="sample_data" sourcetype="management_sampledata.csv" SLAResolution=Met
| eval _time = strptime(Date, "%m/%d/%y")
| eval Month = strftime(_time, "%b")
| stats count(Ticket_No) as On_time by Month]
| eval percentage = round((On_time/Total)*100)."%"
| table Month, On_time, Total, percentage
And here's the result:
The percentage is the overlay but it does not show anything.
What could be the problem with this?
Best regards!
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-03-2023
08:34 PM
|
