Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About HattrickNZ
HattrickNZ
Motivator
Member since:
10-29-2012
07-03-2021
Community Statistics
| Posts | 515 |
| Solutions | 13 |
| Karma Given | 181 |
| Karma Received | 55 |
| Member Since | 10-29-2012 |
Activity Feed
- Got Karma for Re: Can I press enter in a splunk search and not do a search it just moves the text to a new line.. 01-17-2025 03:15 PM
- Got Karma for Is there a way to remove the `Real-time` part that appears from the drop down time picker. 06-19-2024 02:16 PM
- Got Karma for In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?. 09-12-2022 01:38 AM
- Got Karma for declaring a variable in splunk dasboard and make available to all searches. 08-29-2022 08:58 AM
- Karma Re: calculating values in new rows/columns and appending based on values in existing rows/columns for martin_mueller. 07-03-2021 02:24 AM
- Posted Re: How to convert epoch time with milliseconds into splunk at indexing time on Splunk Search. 07-02-2021 08:56 PM
- Karma Re: How to restart a splunk on windows through Command Prompt and control panel? for kamlesh_vaghela. 07-02-2021 03:18 PM
- Got Karma for Commented code moves in splunk Dashboard. 06-17-2020 12:40 PM
- Karma Re: the way fields are arranged in a timechart / join combination particularily the 2nd search being joined for woodcock. 06-05-2020 12:50 AM
- Karma Re: stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host. for jkat54. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for nareshinsvu. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for nvanderwalt_spl. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for MuS. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for maheshsn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for niketn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
05-18-2015
07:02 PM
With a search like ....| eval Field3=Field1+Field3
I have data as follows(in the stats tab):
_time Field1 Field2 Field3
2015-05-11 00:00 915.426122 698.086667 217.33945530
2015-05-11 01:00 593.966923 462.311111 131.65581163
2015-05-11 02:00 403.424360 319.715556 83.708804253
2015-05-11 03:00 327.785973 261.006667 66.779305556
.
.
.
how do I get the max of each column?
I am thinking something like addcoltotalsbut that gets the sum of the columns but I want the max.
... View more
Labels
- Labels:
-
eval
05-18-2015
06:47 PM
tks jsut confirming that
earliest=-1w@w1 latest = @w1 will give me last week values for Mon - Sun
hmm, I can't seem to upload a picture file.
... View more
05-18-2015
04:54 PM
How do I use earliest and latest to show last week Mon - Sun inclusive.
I have tried this earliest=-1w@w latest = @w but this is giving me Sun to Sat inclusive.
I would like to do it using this type of method earliest=-1w@w latest = @w
... View more
05-18-2015
04:03 PM
90 worked for me in version 6.1
... View more
05-14-2015
02:20 PM
..| eval lic_hit2=if(min(predict1)<max(hLicLimit),4502,5002) this works but is not what I want, but maybe this expains how the if function works.
what I want is if the value of predict1 is < LicLimit I want lic_hit to have a zero value for that row, else if the value of predict1 is => LicLimit I want lic_hit to have a zero value for that row
E.G.
_time ThrputMbps Limit lic_hit predict1
2015-05-05 367.79 290 0 289
2015-05-06 334.07 290 500 290
2015-05-07 377.12 290 500 300.35
2015-05-08 290 500 375.072319312
2015-05-09 290 500 333.495
... View more
05-14-2015
01:05 PM
Yes I thinkit is, if my understaning of the if function is right?
I added this to my search
...| | eval test=if(isnum(predict1),"T","F")
And this is a sample of the out put I get.
_time ThrputMbps Limit lic_hit predict1 test
2015-05-05 367.79 410 500 F
2015-05-06 334.07 410 500 F
2015-05-07 377.12 410 500 300.35 T
2015-05-08 328.83 410 500 375.072319312 T
2015-05-09 312.21 410 500 333.495 T
2015-05-10
... View more
05-13-2015
08:53 PM
It worked first time 🙂
... View more
05-13-2015
08:49 PM
this actually worked 🙂
... View more
05-13-2015
08:19 PM
test 1 - pasted html code
<row>
<html>
<h1>
HTML Panels
</h1>
<p>Easily add content to clarify use of a dashboard.</p>
</html>
<html src="html/html_tags.html">
</html>
</row>
test 2 - pasted html code and pressed the code button after highligting the selected code
<row>
<html>
<h1>
HTML Panels
</h1>
<p>Easily add content to clarify use of a dashboard.</p>
</html>
<html src="html/html_tags.html">
</html>
</row>
test3 - more tests --
... View more
05-13-2015
08:16 PM
<dashboard>
<label>dynamic_gauges</label>
<description>these are dynamic gagues
want to see how many I can fit in a row without further code.
And would alos like to add percentages</description>
<row>
<panel>
<table>
<title>first1</title>
<search>
<query>index=_internal earliest=-5m sourcetype=splunkd | stats count | gauge count [search sourcetype=splunkd index=_internal earliest=-20m latest=-10m | stats count as max | eval first=0 | eval second=10 | eval third=max/2 | eval fourth=max | eval range=first+" "+second+" "+third+" "+fourth | return $range]</query>
<earliest></earliest>
<latest></latest>
</search>
</table>
</panel>
</row>
<label>THIS IS A LABEL</label>
<row>
<panel>
<chart>
<title>1st gauge</title>
<search&
TESTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT
<dashboard>
<label>dynamic_gauges</label>
<description>these are dynamic gagues
want to see how many I can fit in a row without further code.
And would alos like to add percentages</description>
<row>
<panel>
<table>
... View more
05-13-2015
08:09 PM
Ahhhh... finally got that to work, so then I tried yours again and it worked....ahhh...oh well
Here is the snippet of my code between an ending row tag and open row tag
</row>
<row>
<html>
<h1>
HTML Panels
</h1>
<p>Easily add content to clarify use of a dashboard.</p>
</html>
</row>
<row>
</row>
<row>
<html>
<h1>
HTML Panels
</h1>
<p>Easily add content to clarify use of a dashboard.</p>
</html>
</row>
<row>
this is a test
<html>
<h1>
HTML Panels
</h1>
<p>Easily add content to clarify use of a dashboard.</p>
</html>
<html src="html/html_tags.html">
</html>
</row>
this is another test
<h1>
HTML Panels
</h1>
<p>Easily add content to clarify use of a dashboard.</p>
... View more
05-13-2015
08:02 PM
I have a search using the predict function
index=core eventtype="Device" DeviceName=Device1 earliest=-10d@d latest=+10d@d | timechart span=d max(ThrputMbps) as ThrputMbps | predict ThrputMbps as predict1 future_timespan=10 holdback=1 | eval LicLimit=410 | fields - upper* lower* | eval lic_hit=if(predic1>=LicLimit,0,500)
What I want to do is somehow capture where the licenc is being hit.
I was thinking of doing something like:
eval lic_hit=if(predic1>=LicLimit,0,500) -- 0 until it is hit and 500 there after
but I cant get this to work. I'm thinking I need a where but I am not sure of the syntax to do this, something like
where predict is >= to Liclimit, create a field called lic_hit from that point, else the field called lic_hit will be zero
PIC:
... View more
05-13-2015
07:16 PM
I have a search in splunk that uses the predict function that looks something like:
index=core ...$token1$ | fields - upper* lower*
This basically creates a chart that I have other tokens/inputForms being used to control the chart (e.g. timespan, granularity, elements...)
So I want to be able to toggle the search between this:
index=core ...$token1$ |
and this:
index=core ...| fields - upper* lower*
I am thinking I can do something like this:
<input type="radio" token="toggle" searchWhenChanged="true">
<label>Toggle On/Off:</label>
<default>On</default>
<choice value="fields - upper* lower*">On</choice>
<choice value="">Off</choice>
</input>
with my search looking like:
index=core ...$token1$ | fields - upper* lower*
and then the On will give index=core ...$token1$ | fields - upper* lower*
and the Off will give index=core ...$token1$ |
Hmm this seems logical will see how I go
... View more
05-12-2015
07:37 PM
@ tks that is useful
I just used this to have the legend appear in this order error,warn,info, so this is what you would do with whatever labels you are working for. It is very statis as I was looking for something more dynamic based on the values in the graph.
<option name="charting.legend.labels">[error,warn,info]</option>
Also I was looking at this, anyone know what this does?
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
... View more
05-11-2015
03:53 PM
Comment on Edit3
need to add span=d timechart max(field2) as f2 to handle the ability to predict furter into the future
this also enables interactivity on the graph so all good.
But there must be a better way, I will wait...
... View more
05-11-2015
03:36 PM
put holdback=1 in both predict functions so they line up.
... View more
05-11-2015
03:33 PM
my EDIT3 answer is the best I can do.
But surely there is a better way where the interactivity is not lost, I will await someone clever 🙂
... View more
05-11-2015
03:06 PM
could not get that to work, am i doing something wrong?
... View more
05-11-2015
02:17 PM
think this is what I want
http://answers.splunk.com/answers/94614/how-to-extract-date-yyyymmdd-from-time.html
... View more
05-11-2015
01:43 PM
Ah maybe I am not clear, I understand how to comment out code or add comments like you say.
What I want is to insert text into the dashboard between 2 rows like I do below: but i want to do it in my XML dashboard that I have created.
<row>thsi is row1</row>
<h1>thsi is Label</h1>
<row>thsi is row2</row>
<!- this is a comment->
http://jsfiddle.net/14fdep15/1/
... View more
05-11-2015
01:28 PM
This search is ok
... | stats max(fieldname1) as fn1 by _time
but I want to control the format of the _time field to be format to be YYYY-MM-DD
How can I do this?
I know i can do ... | timechart span=d max(fieldname1) as fn1 but i am looking for another way as it relates to something I am working on and the timechart option won't work.
I am think something like
... | eval time_field=(_time,"YYYY-MM-DD")| stats max(fieldname1) as fn1 by time_field
Can this be done?
... View more
05-11-2015
12:58 PM
@aljohnson_splunk
I can't get that to work, I edit source XML and i can't save it it says "Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 20: Couldn't find end of Start Tag more line 20"
Here is the snippet of my code between an ending row tag and open row tag
</row>
<normal xml tag>
<!-- Ayy, Nice Label Bro -->
<more normal xml>
<row>
... View more
05-10-2015
03:26 PM
can you show a picter of what your expierncing? have you tried playing with earlies and latest in your search, this seemed to be importatnt to me what i was using the predict function.
... View more
05-10-2015
03:22 PM
I don't know but what I have come to conclude is that you can only do by 1 location at a time, so you have to filter out the others before doing your predict.
It probably isn't what you want but 1 prediction graph per location might be clearer to the end user, as with 3 predictions in one graph would be very unclear, unless you could turn different locations on/off as you wish.
... View more
