About HattrickNZ

HattrickNZ · ‎02-04-2016

that gives the following: meansInfold is an empty column, and measInfoId appears randomly in this column c_meansInfold meansInfold c_meansInfold 1 c1907473350 2 c1907473351 3 c1907473352 4 measInfoId 5 c1907466983 6 c1907466984 ... 93 c1907466996 94 measInfoId 95 c1907466983 96 c1907466984 97 c1907466985 98 c1907466986 99 c1907466987 100 c1907466988

HattrickNZ · ‎02-04-2016

I will try to explain by example If i do ...| chart list(measInfoId) by c* this says no results found If I do ...| chart list(measInfoId) by c1907466990 ,just looking at 1 specific c* value, I get the below: c1907466990 list(measInfoId) 1 0 1907425342 1907425342 1907425342 1907425342 1907425342 2 1 1907425342 1907425342 1907425342 1907425342 ... 98 104 1907425342 99 105 1907425342 1907425342 1907425342 100 106 1907425342 If i do ...| chart list(measInfoId) by measObj* this says no results found , the wild card does not seem to work, it seems I have to specify the whole name. UI will see if this might be a rights issue. If I do ...| chart list(measInfoId) by measObjLdn ,specify the whole measObjLdn name, I get the below, which is what i am originally trying to achieve: measObjLdn list(measInfoId) 1 object1 1907425301 1907425280 1907425335 1907425301 1907425280 1907425335 1907425301 2 object2 1907443286 1907443286 1907443286 1907443286 1907443286 ... 100 object100 1907425341 1907425341 1907425341 1907425341

HattrickNZ · ‎02-03-2016

tks but that presents the same problem ... | stats list(measInfoId) gives output in 1 column with the values ... | stats list(c*) gives output with the values in many columns headers (e.g. list(c1x) list(c2x)...) the problem I think is to do with the c* fields, they should show up as the measInfoId does but they don't. I have tried transpose which which puts the kpi values(c*) in the left most column but I get other columns that I don't really want. ...| table c* | transpose | rename column as kpis then I try to see the values in measInfoId after doing the transpose but this says no results found | table c* | transpose | rename column as kpis | table measInfoId

HattrickNZ · ‎02-03-2016

I have a search ...|table measInfoId that gives output in 1 column with the values e.g. measInfoId 1x 2x 3x ... I have the same search, but slightly different different ...| table c* gives output with the values in many columns e.g. c1x c2x c3x ... What I am trying to to is get something like this (group the c1x's by the 1x's): measInfoId c* 1x c1x 2x c2x c3x 3x c4x c5x ... I think this has something to do with the way the data is imported (the c is prefixed in front of the values c1x ), which is why I am getting the difference. But given these conditions, can I achieve what I want? I may have to add more details to get this question answered as I try and solve this answer.

HattrickNZ · ‎12-15-2015

beautiful answer, 1 pet hate I have is that date format %m/%d/%Y but thats just me. tks

HattrickNZ · ‎12-15-2015

I think this can be done, but I am having some troubles... This is what i am starting with, but not sure how to get it more like what I want below: |gentimes start=-1 | eval temp=100 | eval count="ColumChart2" | table temp count | append [|stats count|eval count="END OF FILE"] What I am hoping for is something like (excuse my code, it is more an explanation at this stage): eval x = 100 | where date >=1/1/2014 AND date <=9/1/2014 | eval y = 150 | where date >=10/1/2014 AND date <=16/1/2014 which I would hope would give me something like this graph: And then ultimately I am holing for something like

HattrickNZ · ‎12-06-2015

tks, as you say not great for visualisation but looks good it the stats tab. How do I control the _time granularity using this way?

HattrickNZ · ‎12-06-2015

Using stats with a by on 2 fields works: ...| stats max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1 field2 but can I do the same using timechart? (so far I don't think I can) ...| timechart max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1 field2 A work around I have is to use strcat which would be something like: ...| strcat field1 "-" field2 field1_2 | timechart max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1_2 Just wondering what other people do?

HattrickNZ · ‎10-29-2015

the 1st option gives a broken line and add faded colour between the predict line and it. I guess this is what upperbound and lowerbounds do. For some reason it does not show the upperbound in the legend in the graph but I can see it in the stats tab. with the 2nd option: assuming val is constant e.g. 80,000 this gives me a straight line into the future ... | timechart span=d max(val) as val_lic | predict val_lic future_timespan=216 adding the following makes no real difference, except I just get a bit of faded colour ... | timechart span=d max(val) as val_lic | predict val_lic future_timespan=216 upper90=upperbound | eventstats max(val_lic) as upperbound tks the 1st option is worth noting but the 2nd not add anything extra for me. My main prlem is getting the horizontal line to cover the dates into the future, which I already addressing, but I was just looking for a better way. For instance if val was an available field, and it was equal to 80, I want to be able to draw that 80 as a horizontal line accross the complete time chart, that is past and future using the predict function.

HattrickNZ · ‎10-28-2015

sorry maybe I was not clear, I want something more like eval val=max(val) and then be able to use this in the predict function

HattrickNZ · ‎10-28-2015

How do i assign a value to a variable in a splunk search and then use that variable in the search? something like val=1000 | timechart span=d max(val) I am trying to produce a straight horizontal line that would represend some a limit in a graph. I am using the predict function at present to help me achive this, but because the val changes sometimes this is when I have to fiddle with the date. So i am looking for a better way. index=core ... earliest=-2d@d latest=+216d@d |... |timechart span=d max(val) as val_lic | predict val_lic as val_lic future_timespan=216 |

HattrickNZ · ‎10-19-2015

think this is what i am looking for from here http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/tokens Token Description click.name Name of the leftmost field that appears in the table. This is always _time, if present. click.value Value of the leftmost column in the row. click.name2 Name of the column. click.value2 Value of the column. row.<fieldname> All field values for the table row, including those fields that are not displayed. earliest/latest Time range of the table row, or if not applicable, the time range of the search.

HattrickNZ · ‎10-15-2015

this is slightly related and may be useful http://i-splunk.blogspot.co.nz/2014/03/toggle-splunk-panels.html - has more to do with panels in html

HattrickNZ · ‎10-15-2015

How many tokens can I pass from one panel to another? Below is my thinking, but not sure if I am right? panel 1 is a table with 3 values I want to pass to panel 2: <drilldown> <set token="mytoken">$click.name$</set> <set token="mytoken2">$click.name2$</set> <set token="mytoken3">$click.value$</set> </drilldown> This is panel 2 which receives these tokens: <row> <panel depends="$mytoken$" depends="$click.name2$" depends="$click.value$"> <chart> .... </chart> </panel> </row>

HattrickNZ · ‎10-14-2015

I have the below very simple dashboard for illustration. (assume a chart would be in row 2 and row 3) My question is, do panels in row 2 and row 3 run when I visit the dashboard? What I mean is, if there was a chart in row 2 and row 3, do the charts get built when I visit the dashboard, thereby on ticking the selectbox will open the charts that are already running? Or does the search for the charts in row 2 and 3 not run until the selectbox is ticked after visiting the dashboard? This is what I would like to achieve. <form> <label>shoing and hiding rows Clone</label> <description>showing and hiding rows description https://answers.splunk.com/answers/298909/is-there-a-tagname-i-can-use-in-simple-xml-that-i.html</description>; <row> <panel> <html> <h1>this is a h1</h1> </html> </panel> </row> <row> <panel> <input type="checkbox" token="show_token" searchWhenChanged="true"> <choice value="show">show rows 2 and 3</choice> </input> </panel> </row> <row depends="$show_token$"> <panel> <html> <h2>this is a h2 </h2> </html> </panel> </row> <row depends="$show_token$"> <panel> <html> <h3>this is a h3 </h3> </html> </panel> </row> </form> Maybe I have to use fieldset to offer more control? <fieldset autoRun="true" submitButton="true"> <input type="checkbox" token="show_token" searchWhenChanged="true"> <choice value="show">show rows 2 and 3</choice> </input> </fieldset> NOTE similar/related question here

HattrickNZ · ‎10-13-2015

have splunk 6.3 now and this seems to have fixed this.

HattrickNZ · ‎10-06-2015

tks,see my edit1 above which hopefully explains it better.

HattrickNZ · ‎10-06-2015

tks got it to work but just after noticing that it does not sort the dates left to right for each daily value. it would be good if I could control this ordering?

HattrickNZ · ‎10-05-2015

if i change the span=d to span=h a line chart is drawn normally with lines and dots.

HattrickNZ · ‎10-05-2015

DST was the issue as mentioned above.

HattrickNZ · ‎10-05-2015

in your original search should you not change this earliest =-7@d to earliest =-7d@d

HattrickNZ · ‎10-05-2015

I am trying to show daily values for the last x weeks, using the timewrap command to overlap the weeks (i.e. weekX, weekX-1,...) The line chart is not showing lines, it is just showing the dots. Not sure if this is an issue or my issue. Can anyone advise? maybe my search is incorrect? This is my search: index=core .... earliest=-5w@w1 latest=+w@w1 | timechart span=d sum(c140509343) as "kpi1" | timewrap w series=exact Below is what I am getting: EDIT1 using the answer below makes the lines join up. however if i seleect a column chart, the date order of the values are not correct. For example if i look at wednesday below I get the following order from left to right (hopefully it is clear in the picture) wednesday from week beginning sep20th wednesday from week beginning sep13th wednesday from week beginning sep06th wednesday from week beginning aug30th a gap wednesday from week beginning oct05th wednesday from week beginning sep28th Ideally I would like these to be left to right, oldest date to newest.

HattrickNZ · ‎09-23-2015

exporting data into a csv file in splunk i have a search that gives me data as follows in the stats tab. _time ABC1-OUT-MB ABC2-OUT-Mbps 2015-09-15 00:00:00 24144.1990 603.604974 2015-09-15 00:05:00 23642.2730 591.056826 2015-09-15 00:10:00 22453.5770 561.339425 2015-09-15 00:15:00 20894.8522 522.371305 2015-09-15 00:20:00 20389.8815 509.747037 2015-09-15 00:25:00 19339.4728 483.486819 when I export it to a csv file the _time column gets this funky formatting 2015-09-15T00:00:00.000+1200 _time ABC1-OUT-MB ABC2-OUT-Mbps 2015-09-15T00:00:00.000+1200 24144.199 603.604974 2015-09-15T00:05:00.000+1200 23642.273 591.056826 2015-09-15T00:10:00.000+1200 22453.577 561.339425 2015-09-15T00:15:00.000+1200 20894.8522 522.371305 2015-09-15T00:20:00.000+1200 20389.8815 509.747037 2015-09-15T00:25:00.000+1200 19339.4728 483.486819 Is there a way I can export it into csv so that it looks liket the below format in the csv? 2015-09-15 00:00:00 my workaround at the minute is to fiddle with it inexcel

HattrickNZ · ‎09-01-2015

tks, that's exactly what I want and just for my reference and if you would like to clarify/comment. the 2 searchs below give similar outputs, but i guess using the bucket option with stats gives more flexibility that timechart in this regard index=_internal sourcetype=splunkd | bucket span=d _time | stats count(series) as t count(file) as t2 by _time,sourcetype _time sourcetype t t2 2015-08-31 00:00:00 splunkd 13891 42 2015-09-01 00:00:00 splunkd 25797 21 2015-09-02 00:00:00 splunkd 10881 17 index=_internal sourcetype=* sourcetype=splunkd | timechart span=d count(series) as t count(file) as t2 by sourcetype _time t2: splunkd t: splunkd 2015-08-31 42 13891 2015-09-01 21 25797 2015-09-02 17 10698

HattrickNZ · ‎08-31-2015

If I have the following, the max per day per sourcetype: index=_internal sourcetype=* sourcetype=splunkd | timechart span=d count(series) as t count(file) as t2 by sourcetype _time t2: splunkd t: splunkd 2015-08-28 0 949 2015-08-29 0 0 2015-08-30 0 0 2015-08-31 42 13891 2015-09-01 17 13497 Then I want to apply the percentile function to these daily maxes (there might be a better way of doing this): index=_internal sourcetype=* sourcetype=splunkd | timechart span=d count(series) as t count(file) as t2 by sourcetype | stats perc90(*) as * t2: splunkd t: splunkd 42 13891 Then I want to somehow get it to this because I want to create more fields e.g. t3=t*100/t2 sourcetype t2 t splunkd 42 13891 Can this be done?

Posts	515
Solutions	13
Karma Given	181
Karma Received	55
Member Since	‎10-29-2012

Online Status	Offline
Date Last Visited	‎07-03-2021 08:06 AM

Can i control the height of a input type ?

how do I show a blank panel as nothing but still f...

Commented code moves in splunk Dashboard

Trellis view - toggle between timechart view of 3 ...

use the heat map option and highlight the max and ...

how do you comment in splunk?

Can I do a timewrap and use partial=false (part of...

download many csv files from one dashboard all in ...

Checkbox - when 1 box is selected another(default ...

I want to do `latest=-10m@5m`

Re: How do I group one field's values by another f...

Re: How do I group one field's values by another f...

Re: How do I group one field's values by another f...

How do I group one field's values by another field...

Re: How to create a timechart using eval to create...

How to create a timechart using eval to create the...

Re: Using stats with a by on 2 fields works, but h...

Using stats with a by on 2 fields works, but how c...

Re: How do i assign a value to a variable in a spl...

Re: How do i assign a value to a variable in a spl...

How do i assign a value to a variable in a splunk ...

Re: How many tokens can I pass from one panel to a...

Re: When viewing a dashboard, how to control what ...

How many tokens can I pass from one panel to anoth...

When viewing a dashboard, how to control what pane...

Re: using depends + tokens + chart not spaning the...

Re: Using Timewrap to show the last X weeks of dai...

Re: Using Timewrap to show the last X weeks of dai...

Re: Using Timewrap to show the last X weeks of dai...

Re: timewrap bug + last N Fridays

Re: How to use Timewrap to create comparative grap...

Using Timewrap to show the last X weeks of daily d...

exporting data into a csv file in splunk + _time f...

Re: After applying the stats percentile function t...

After applying the stats percentile function to th...

Join the Conversation