Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About HattrickNZ
HattrickNZ
Motivator
Member since:
10-29-2012
07-03-2021
Community Statistics
| Posts | 515 |
| Solutions | 13 |
| Karma Given | 181 |
| Karma Received | 54 |
| Member Since | 10-29-2012 |
Activity Feed
- Got Karma for Is there a way to remove the `Real-time` part that appears from the drop down time picker. 06-19-2024 02:16 PM
- Got Karma for In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?. 09-12-2022 01:38 AM
- Got Karma for declaring a variable in splunk dasboard and make available to all searches. 08-29-2022 08:58 AM
- Karma Re: calculating values in new rows/columns and appending based on values in existing rows/columns for martin_mueller. 07-03-2021 02:24 AM
- Posted Re: How to convert epoch time with milliseconds into splunk at indexing time on Splunk Search. 07-02-2021 08:56 PM
- Karma Re: How to restart a splunk on windows through Command Prompt and control panel? for kamlesh_vaghela. 07-02-2021 03:18 PM
- Got Karma for Commented code moves in splunk Dashboard. 06-17-2020 12:40 PM
- Karma Re: the way fields are arranged in a timechart / join combination particularily the 2nd search being joined for woodcock. 06-05-2020 12:50 AM
- Karma Re: stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host. for jkat54. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for nareshinsvu. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for nvanderwalt_spl. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for MuS. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for maheshsn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for niketn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: Checkbox - when 1 box is selected another(default only) is unselected for diogofgm. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-16-2015
06:07 PM
1 Karma
tks got this search to work when i installed splunk on my own machine index=_internal sourcetype="splunk_web_access" | stats values(uri_path) by user
... View more
03-16-2015
03:55 PM
how do I use populated saved searches or summary indexes to power the dashboards?
If i run a search and then i want to save it i only have the option to save it as a panel or a report.
index=core host="host" userLabel=*UL* elementType=ET1 measInfoId=1693 duration=15min | timechart span=15m max(KPI1) by measObjLdn
... View more
03-16-2015
03:12 PM
If i open up multiple dashboards on my machine, some panels show "waiting for data".
Basically, I am getting the below for certain panels i have in my dashboards. but there is no indication to me that there was a limit hit.
I am trying to understand what this is. Is it a licensing issue? if so how do I find out what it is? And is there away around it? Or at lease is there a way i can notify the user that a limit has been hit?
is there a general rule about how many panels to have in dashboards based on this restriction?
... View more
03-15-2015
03:40 PM
many thanks @stephanefotso Can i include the code in the simple xml? or can i only have xml in that?
For example is there some way I can use tags to enclose my js or css code?
... View more
03-15-2015
01:09 PM
If i donwload splunk onto my machine, can i upload a csv file into splunk just for testing purposes on the data?
... View more
03-15-2015
01:05 PM
tks @stephanefotso, but i have access to the files of Custom Link Switcher dashboard in Splunk 6.x Dashboad Example but that is on my own macine where I have splunk installed, but it is out of indexing licence. Can i uninstall and reinstall? Will this give me a new licence so I can use this for testing?
On the splunk server i am working on I can't have access to the live splunk server at present. So I can't put all the files on where I want. Not sure the best way around this? Can you advise?
... View more
03-15-2015
12:50 PM
1 Karma
tks but that did not work. I did find a way to do what i wanted, and the search looks something like below. I basically have to subtract Limit from Usage and then stack limit4Graph oon top of Usage.
... | stats max(c117492014) as Usage max(limit2) as Limit by userLabel | eval percent=Usage/Limit*100 | eval limit4Graph=Limit-Usage | fields userLabel Usage limit4Graph percent
This gives me something like this.
NOTE I have add a precent column as I awat to overlay the percent value on top of this and not have this percent line present.This is something else I am working on.
... View more
03-12-2015
06:37 PM
I have a field with values like this "NENAME1/Some text:romc"
I would like to somethink like this eval field= , but this might not necessarily be the way to do it, to end up with a field like this "romc". So effectively everything after the last : .
What is the best way of achieving this? Do I use rex or is there some other clever way?
... View more
03-12-2015
05:54 PM
If I create a search in verbose mode and then save it as a panel in a dashboard, does the dashboard then display it in fast mode , by default, when viewing the dashboard?
Is this a way for getting the dashboard to render more quickly?
kind of related Q here
... View more
03-12-2015
03:53 PM
tks @stephanefotso I also need these files for it to work. autodiscover.js link_switcher.js linkswitcher.js
$ pwd
/cygdrive/c/Program Files/Splunk/etc/apps/simple_xml_examples
$ find . -name autodiscover.js
./appserver/static/autodiscover.js
$ find . -name 'link_switcher.js'
./appserver/static/link_switcher.js
$ find . -name 'linkswitcher.js'
./appserver/static/components/linkswitcher/linkswitcher.js
... View more
03-12-2015
01:20 PM
@gpradeepkumarreddy tks but what premissions do i need to access that? I can't see anything under my current profile?
... View more
03-11-2015
07:51 PM
I have a dashboard with 4 panels, 1 is shown below. my search is not that intense i don't think something like ... | timechart span=h max(c10099) by measObjLdn . the underlying rawdata is in hourly chunks. I am using the timepicker and selecting realtime 2 days ago to now
What is happening intermittantly but quite alot, is the graph is not showing all the data.
This happens on all panels and can vary which one it happens to on loading the dashboard.
I never see it when i run the search in its own search window.
The dashboard just sits there and I have no idea if it is finished or not.
Is this my computer/browser that does not have the resources? I am using firefox
Or is it the splunk server?
Can anyone advise how I can debug this?
EDIT1
I just tried it there again on Firefox and chrome. And it happened again.
1st time openened in firefox, it happened on 2 of the pannels
2nd time on firefox(after a refresh), it did not happen
3rd time on firefox, I am now getting waiting for data, this is another related question I have asked here.
1st time on chrome it happened on 2 panels
2nd time on chrome it happened on 1 panel
3rd time on chrome, I am now getting waiting for data on 2 panels
I am thinking it might be my PC resources,Browser resources, or splunk resources.
It may also be my maximum numbe of concurrent realtime searches has been reached, something i will look into.
below is my xml code
<dashboard>
<label>MGW_CPU Occupation Rate Statistics</label>
<description>MGW_CPU Occupation Rate Statistics</description>
<row>
<panel>
<chart>
<title>MGWSJH-FN-SN-BP</title>
<searchString>index=core host="snzclakl598" elementType=MGW measInfoId=100666003 duration=PT3600S userLabel=MGWSJH | strcat userLabel "-" FN "-" SN "-" BP measObjLdn_formatted |timechart span=h max(c100991561) by measObjLdn_formatted</searchString>
<earliestTime>rt-2d</earliestTime>
<latestTime>rtnow</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<chart>
<title>top 10 for yesterday - MGWSJH-FN-SN-BP</title>
<searchString>index=core host="snzclakl598" elementType=MGW measInfoId=100666003 duration=PT3600S userLabel=MGWSJH earliest=-1d@d latest=@d |strcat userLabel "-" FN "-" SN "-" BP measObjLdn_formatted |stats max(c100991561) as max by measObjLdn_formatted | sort 10 -max</searchString>
<earliestTime>-1d@d</earliestTime>
<latestTime>@d</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>MGWKPR</title>
<searchString>index=core host="snzclakl598" elementType=MGW measInfoId=100666003 duration=PT3600S userLabel=MGWKPR | timechart span=h max(c100991561) by measObjLdn</searchString>
<earliestTime>rt-2d</earliestTime>
<latestTime>rtnow</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.axisY.maximumNumber">100</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>MGW02KPR</title>
<searchString>index=core host="snzclakl598" elementType=MGW measInfoId=100666003 duration=PT3600S userLabel=MGW02KPR | timechart span=h max(c100991561) by measObjLdn</searchString>
<earliestTime>rt-2d</earliestTime>
<latestTime>rtnow</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>MGW01HAM</title>
<searchString>index=core host="snzclakl598" elementType=MGW measInfoId=100666003 duration=PT3600S userLabel=MGW01HAM | timechart span=h max(c100991561) by measObjLdn</searchString>
<earliestTime>rt-2d</earliestTime>
<latestTime>rtnow</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</dashboard>
... View more
03-11-2015
03:29 PM
1 Karma
I have the below code and this is a panel in a dashboard that shows a chart.
What I want to be able to do is add a tab so that I can have 2 tabs in the one panel. For example, Tab1 will be the view below a chart and Tab2 will be the same but it will be in a table visualization and not a chart. How can i achieve this?
<row>
<panel>
<chart>
<title>title_123</title>
<searchString> <MY_SEARCH_STRING_GOES_HERE> </searchString>
<earliestTime>rt-2d</earliestTime>
<latestTime>rtnow</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">100</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
... View more
03-11-2015
03:15 PM
1 Karma
if i have a list of dashboards, is there a way that I can view how many times each dashboard was viewed?
Is this something that is available for every dashboard that is created or do you have to do some configuration first?
I would like to know how often certain dashboards where viewed, yesterday or last week or other.
I would also like to know who is viewing them.
... View more
03-10-2015
04:22 PM
hi @Ayn
I hope i am clear here so here goes:
I have the below panel, and what I want to do is add a tab so that I can 2 tabs, in total, and I can switch between, tab1 and tab2. The below panel is a chart but for example I would want tab2 to be a table for the same search. Can you advise based on your comment above?
<panel>
<chart>
<title>usage_licence_wanttoAddTabsHere</title>
<searchString>index=core host="snzclakl598" elementType=USN measInfoId=117490527 duration=PT1800S earliest=-1d@d latest=@d| eval limit2=if(userLabel=="SGSN02KPR",77777,if(userLabel=="USN01HAM",88888,"NULL")) | stats max(c117492014) as whatever max(limit2) as "whatever with a space" by userLabel</searchString>
<earliestTime/>
<latestTime/>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
... View more
03-10-2015
02:23 PM
tks again @tlagatta_splunk
so can i control how many past values it will predict for calibrartion? Is there a min defalult setting of the number of past values it will predict for calibration? And is this the holdback or something else?
From a visual point of view it would be good to be able to do the calibration and then have the option to remove it also. but hey 🙂
... View more
03-10-2015
02:09 PM
tks @tlagatta_splunk very helpful
default algorithm is LLP5...oops should have read that from the docs
in my example i used holdback =0 to use all values in my model but it does not seem to do that, it always seems to predict for values I already have, hence the yellow line overlapping the blue line above.
how would i do justa simple linear forecast?
Other observations
in your search the future timespans need to line up ... latest=+100d@d ... future_timespan=100
holdback also has something to do with the last date in your timespan e.g. if you use future_timespan=100 the last date will be 100 minus the holdback value....
... View more
03-10-2015
12:56 PM
oh how silly of me 🙂 is it code under // Js CODE: goes into custom_chart.js
and code under // CSS CODE: goes into custom_chart.css
... View more
03-10-2015
12:51 PM
@stephane_cyrille where do i get custom_chart.js and custom_chart.css from?
... View more
03-10-2015
12:37 PM
1 Karma
tks all, the one below by ramdaspr works also.
... View more
03-08-2015
08:45 PM
I am trying to control how many of the top results are shown.
I have the following search
stats max(c1693801001) as MaxCPU by measObjLdn | sort - MaxCPU
which gives me the following in the stats view:
measObjLdn MaxCPU
Object1 13
Object2 11
Object3 8
Object4 7
Object5 4
Object6 4
Object7 3
Object8 3
How do i just show the top 3 that would look like
measObjLdn MaxCPU
Object1 13
Object2 11
Object3 8
I have tried top but no joy, it just keeps showing them all
....| top limit=5 showcount=f showperc=f MaxCPU by measObjLdn | sort - MaxCPU
... View more
03-08-2015
08:23 PM
this does not show me anything in stats or visualisation, am i missing something?
... View more
03-08-2015
04:27 PM
I have the following search
...| eval limit4Graph=Limit-Usage | fields userLabel limit4Graph Usage percent
Note: Limit-Usage here is because I have to use a stacked chart to get what I want in the visualisation part
this give me stats like this
userLabel limit4Graph Usage percent
PR 23478 54299 69.813698
AM 71864 17024 19.152192
THis is the visualization i get to (this is a stacked chart)
But I would like to display the percentages as lables like below (excel example)
Can this be done? with simple xml or in the search or some other?
I would also like to be able to control the order of the x-axis.
... View more
03-08-2015
01:24 PM
@stephane_cyrille maybe I don't understand. But I want all columns with one column overlapping the other column. I do not want any line chart. Does this make sense? maybe i will edit my answer to show exactly what i want.
... View more
03-05-2015
05:46 PM
@Patrick the answer was very close but I am still looking for a closer answer see EDIT1, but if this is the best that can be done I I will accept accordinly.
... View more
- « Previous
- Next »
