Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Mike6960
Mike6960
Path Finder
Member since:
10-10-2017
03-21-2023
Community Statistics
| Posts | 192 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 2 |
| Member Since | 10-10-2017 |
Activity Feed
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 11:39 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 10:33 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:53 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:32 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:31 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:31 AM
- Posted How to use values from outputlookup file? on Splunk Search. 03-20-2023 04:02 PM
- Karma Re: How to create alternative for subsearch for gcusello. 12-14-2022 06:23 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 06:56 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 05:39 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 04:40 AM
- Posted How to create alternative for subsearch? on Splunk Search. 12-13-2022 03:28 AM
- Karma Re: How to make a field extraction with field with and without ':'? for ITWhisperer. 12-07-2022 05:18 AM
- Posted Re: How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 07:01 AM
- Posted Re: How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 06:51 AM
- Posted How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 04:51 AM
- Posted Is it possible to achieve a column chart with timechart showing days in every column? on Dashboards & Visualizations. 11-10-2022 02:51 AM
- Posted Re: How to create a single value withe panel_depends? on Dashboards & Visualizations. 11-06-2022 06:38 AM
- Posted Re: How to create a single value withe panel_depends? on Dashboards & Visualizations. 11-04-2022 11:22 AM
- Posted How to create a single value with panel_depends? on Dashboards & Visualizations. 11-04-2022 09:24 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-22-2017
02:55 AM
Sadly, still struggling. I used your code but isn't working yet. Is it possible to do this through the drilldowneditor? I tried to use this feature but somehow after saving the search is altered. Is this because the special characters?
... View more
11-20-2017
11:42 PM
I am trying to understand, so i can replicate it next time. How do you come by: !DATA in your search? Why did you use;
G_w <= 14&earliest=-15m&latest=now ?
I want the result that have <= 14 days. I dont understand what you posted
... View more
11-20-2017
11:26 PM
In the following search I want to have the average for the events where GB_w is < 15 days
| stats earliest(A_Z) AS A_Z earliest(D_A) AS D_A
| eval eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N")
| eval eD_A_I=coalesce(strptime(D_A, "%Y-%m-%d %H:%M:%S.%N"),now())
| eval GB_w=floor((eD_A_I-eA_Z)/86400)
| chart avg(GB_w) As GDA
| eval GDA=round(GDA,0)
I thought i could use something like this:
| eval GB_w=floor((eD_A_I-eA_Z)/86400)
|where GB_w <15
| chart avg(GB_w) As GDA
| eval GDA=round(GDA,0)
Somehow the result is 0. It also seems that the search always uses the 'now'time, even if there is a D_A time present in the event.
What am i doing wrong?
... View more
- Tags:
- splunk-enterprise
11-20-2017
10:39 PM
Hai Kamlesh, What does this do?
index="_internal" | stats count
Is this a dummy search where i have to put my own initial search? I dont understand the "_internal"
How do you come by the '25Y-%25m-%25d %25H' , what does the number 25 mean?
... View more
11-20-2017
04:54 AM
like this?
<drilldown>
<link target="_blank"><set token="tokDays">$click.value$</set> </link>
</drilldown>
... View more
11-20-2017
04:47 AM
Thank you, since last weekend we run version 7. But in the drilldowneditor its still required to work with tokens, this is quite challenging for me
... View more
11-20-2017
02:24 AM
Hai niketnilay,
Another question, what if i want to open a new page for the results instead of a panel
... View more
11-17-2017
06:16 AM
So in short, its not possible to render a basic search by clicking on a single-value without making a new dashboard?
... View more
11-17-2017
05:25 AM
Hi Giuseppe,
Because i have 8 single values in mu dashboard, by passing it down to an 'new' dashboard i would have to maken 8 new dashboards...
... View more
11-17-2017
05:06 AM
Hi,
I have a single value in my dashboard, i want users to be able to drilldown on this value. When they do a new search has to be executed. We run version 6.5.2 so we dont yet have the drilldowneditor.
I thougt i just could add this to the source:
drilldown>
search?q=index=zzz earliest=-h sourcetype= "xxx" OR sourcetype="yyyy"
| eval eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N")
| eval eD_A_I=coalesce(strptime(eD_A_I, "%Y-%m-%d %H:%M:%S.%N"),now())
| eval G_w =floor((eD_A_I-eA_Z)/86400)
| search G_w <= 14
But this does not work. Why not?
... View more
- Tags:
- splunk-enterprise
11-13-2017
11:27 PM
Yes, i tried that to, also all kind of different time spans. My events are getting in since the beginning of october through by an insert once every day, so _time is different in the events. Somehow i either dont get a trend or i get only data from one date (the earliest)
I think i will give up on this one.
... View more
11-13-2017
04:09 AM
But i dont want to plot on the eventtime, i want to plot on the dates mentioned in the events. In this case eA_Z and eD_A_I. This reults in a number of days: G_w. which i want to plot. Still, if use my own search it workts without adding _time, this is something i don't understand:
| eval eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N")
| eval eD_A_I=coalesce(strptime(D_A_I, "%Y-%m-%d %H:%M:%S.%N"),now())
| eval G_w=floor((eD_A_I-eA_Z)/86400)
| search G_w > 14
| timechart span=1w avg(G_w) As GDA
... View more
11-13-2017
03:45 AM
unfortunately i cant get it working. I used ;
| stats earliest(_time) AS _time earliest(AG_Z) AS A_Z earliest(D_AG) AS D_A_I
| eval
eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N"),
eD_A_I=coalesce(strptime(D_A_I, "%Y-%m-%d %H:%M:%S.%N"),now()),
G_w=floor((eD_A_I-eA_Z)/86400)
| search G_w > 14
| timechart span=1w avg(G_w) AS GDA
I get only one value and no trend. You say _time is only reported to use below, but below i dont see _time back?
... View more
11-13-2017
03:30 AM
In your first line _time does not really do anything, correct? I want to plot by G_w so then i use;
| stats earliest(_time) AS _time earliest(AG_Z) AS A_Z earliest(D_AG) AS D_A_I
| eval
eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N"),
eD_A_I=coalesce(strptime(D_A_I, "%Y-%m-%d %H:%M:%S.%N"),now()),
G_w=floor((eD_A_I-eA_Z)/86400)
| search G_w > 14
| timechart span=1w avg(G_w) AS GDA
? Strange thing is that i have searches with timechart without the _time
... View more
11-13-2017
03:09 AM
But if I use Chart, i cannot use a single value withe trendline....
... View more
11-13-2017
02:57 AM
Got this from you,
https://answers.splunk.com/answers/585581/how-to-calculate-the-days-between-earliest-date-an.html
... View more
11-13-2017
02:05 AM
I've got the followingsearch:
| stats values earliest(AG_Z) AS A_Z values earliest(D_AG) AS D_A_I
| eval eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N")
| eval eD_A_I=coalesce(strptime(D_A_I, "%Y-%m-%d %H:%M:%S.%N"),now())
| eval G_w=floor((eD_A_I-eA_Z)/86400)
| search G_w > 14
| timechart span=1w avg(G_w) As GDA
Somehow this does not give any results, when ik remove the first line
(| stats values earliest(AG_Z) AS A_Z values earliest(D_AG) AS D_A_I )
It does, but i need to use the earliest dates. How can i fix this so i use the earliest dates and generate a single value with trend?
... View more
- Tags:
- splunk-enterprise
11-06-2017
07:06 AM
The stats in my search i use to get the earliest dates, i would not know another way to accomplish this. Thank you for all your help. I will never really get splunk I am afraid. I am just getting by by google en splunk answers...
... View more
11-06-2017
02:49 AM
Ok, sorry, note to myself not to be impatient. I've used my own search, used your token answer and added a new panel. Is it possible to only show the panel when the token has a value, so only when the piechart is clicked?
... View more
11-06-2017
02:15 AM
Ok, so actually what you are saying is that it is not possible? "If following is your base search.. " , this is not my search, because i need a piechart with two values. Do i understand you correctly when i say that you suggest to make a new panel to show the results??
... View more
11-05-2017
11:21 PM
sadly, this does not work, i replaced my own link for your suggested one:
<drilldown>
<link target="_blank">search?earliest=$earliest$&latest=$latest$&q= index=_internal sourcetype="$click.value$" </link>
</drilldown>
But this does not work
... View more
11-02-2017
10:19 AM
Hi, i dont think i understand your answer. Where do i put my search and where do i define which search splunk needs to execute when i click on the piechart?
... View more
11-02-2017
09:56 AM
I have read a lot of other questions about this matter but i just can't get it running.
Ik have this search":
index=xxxx
| stats values earliest(G_S) AS G_S values earliest(A_Z) AS A_Z values earliest(D_A) AS D_A_I count by ZMV
| eval eG_S=strptime(G_S,"%Y-%m-%d %H:%M:%S.%N"), eA_Z=strptime(A_Z, "%Y-%m-%d %H:%M:%S.%N")
| eval eD_A_I=coalesce(strptime(D_A_I, "%Y-%m-%d %H:%M:%S.%N"),now())
| eval days=floor((eD_A_I-eA_Z)/86400)
| stats count as daycount by days |eval days = abs(days)
| eval days = if(days<=14,"Binnen KPI","Buiten KPI")
| stats sum(daycount) as daycount by days
The results are presented in a piechart, when i click i want to see the individual events. I have tried to do this with a token but i am stuck (again) . We are running version 6.5.2
... View more
- Tags:
- splunk-enterprise
10-25-2017
02:19 AM
We work with version 6.5.2 and i only see three options
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-21-2023
02:13 PM
|
