Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About HattrickNZ
HattrickNZ
Motivator
Member since:
10-29-2012
07-03-2021
Community Statistics
| Posts | 515 |
| Solutions | 13 |
| Karma Given | 181 |
| Karma Received | 55 |
| Member Since | 10-29-2012 |
Activity Feed
- Got Karma for Re: Can I press enter in a splunk search and not do a search it just moves the text to a new line.. 01-17-2025 03:15 PM
- Got Karma for Is there a way to remove the `Real-time` part that appears from the drop down time picker. 06-19-2024 02:16 PM
- Got Karma for In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?. 09-12-2022 01:38 AM
- Got Karma for declaring a variable in splunk dasboard and make available to all searches. 08-29-2022 08:58 AM
- Karma Re: calculating values in new rows/columns and appending based on values in existing rows/columns for martin_mueller. 07-03-2021 02:24 AM
- Posted Re: How to convert epoch time with milliseconds into splunk at indexing time on Splunk Search. 07-02-2021 08:56 PM
- Karma Re: How to restart a splunk on windows through Command Prompt and control panel? for kamlesh_vaghela. 07-02-2021 03:18 PM
- Got Karma for Commented code moves in splunk Dashboard. 06-17-2020 12:40 PM
- Karma Re: the way fields are arranged in a timechart / join combination particularily the 2nd search being joined for woodcock. 06-05-2020 12:50 AM
- Karma Re: stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host. for jkat54. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for nareshinsvu. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for nvanderwalt_spl. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for MuS. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for maheshsn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for niketn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
01-30-2018
05:25 PM
Tks that works for me.
... View more
01-25-2018
05:23 PM
This is my search:
| makeresults
| eval data = "
1 2017-12 A 155749 131033 84.1;
2 2017-12 B 24869 23627 95;
3 2017-12 C 117618 117185 99.6;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<serial>\d)\s+(?<date>\d+-\d+)\s+(?<type>\w)\s+(?<attempts>\d+)\s+(?<successfullAttempts>\d+)\s+(?<sr>\d+)"
| fields + date serial type attempts successfullAttempts sr
| rename date as _time
| search serial=*
| appendpipe [stats avg(sr) as sr | eval sr=round(sr,1) | eval successfullAttempts="average sr"]
| appendpipe [stats sum(sr) as sr | eval sr=round(sr,1) ]
| appendpipe [ where type="A" | stats sum(sr) as sr ]
| appendpipe [ where type="B" | stats sum(sr) as sr ]
| appendpipe [ where type="C" | stats sum(sr) as sr ]
| appendpipe [ stats sum(sr) as sr | eval sr="want 84*95*99 to go here" ]
This is my result:
_time serial type attempts successfullAttempts sr
1 2017-12 1 A 155749 131033 84
2 2017-12 2 B 24869 23627 95
3 2017-12 3 C 117618 117185 99
4 average sr 92.7
5 370.7
6 84
7 95
8 99
9 want 84*95*99 to go here
What I want is in row 9 column sr the result fo 84*95*99
_time serial type attempts successfullAttempts sr
1 2017-12 1 A 155749 131033 84
2 2017-12 2 B 24869 23627 95
3 2017-12 3 C 117618 117185 99
4 average sr 92.7
5 370.7
6 84
7 95
8 99
9 790020
How can I do this?
How do I multiply 3 row values from 1 column and do it in one cell using append pipe.
... View more
01-24-2018
12:37 PM
tks.
this was a followon question from here
... View more
01-24-2018
12:36 PM
tks, great thinking.A beautiful mind!
note for my reference: the 2nd last line I have changed as in your example the _time is in a string format, whereas with my real data _time is in date format. tks again.
| eval _time=relative_time(_time,"-1d")
| fields + _time delivery_diff sent_diff
... View more
01-23-2018
12:05 PM
1 Karma
I have the following:
_time condition delivery sent
1 21/01/2018 0:00 0:00 264464 331477
2 22/01/2018 0:00 0:00 271339 339201
what I want is the delta value which is 6875 and 7724
_time condition delivery delivery_d sent sent_d
1 21/01/2018 0:00 0:00 264464 331477
2 22/01/2018 0:00 0:00 271339 6875 339201 7724
But my question is how do I store the delta of 6875 and 7724 in the previous row 21/01/2018 0:00
This is my full search:
| makeresults | eval data = "
801 20/01/2018 18:40 262719 329507;
863 20/01/2018 23:50 264437 331450;
864 20/01/2018 23:55 264454 331467;
865 21/01/2018 0:00 264464 331477;
1151 21/01/2018 23:50 271316 339177;
1152 21/01/2018 23:55 271328 339189;
1153 22/01/2018 0:00 271339 339201;
1154 22/01/2018 0:05 271354 339221;
1155 22/01/2018 0:10 271365 339232;
1156 22/01/2018 0:15 271373 339240" |
makemv delim=";" data |
mvexpand data |
rex field=data "(?<serial>[\d]*)\s+(?<_time>\d{2}\/\d{2}\/\d{4}\s+\d{1,2}\:\d{1,2})\s+(?<delivery>\d+)\s+(?<sent>\d+)" |
fields - data serial |
rex field=_time "(?<condition>\d{1,2}:\d{1,2})" |
where condition="0:00" OR condition="00:00" |
delta delivery as delivery_d |
delta sent as sent_d |
... View more
01-23-2018
11:07 AM
wow, tks
| makeresults | eval data = "
801 20/01/2018 18:40 262719 329507;
863 20/01/2018 23:50 264437 331450;
864 20/01/2018 23:55 264454 331467;
865 21/01/2018 0:00 264464 331477;
1151 21/01/2018 23:50 271316 339177;
1152 21/01/2018 23:55 271328 339189;
1153 22/01/2018 0:00 271339 339201;
1154 22/01/2018 0:05 271354 339221;
1155 22/01/2018 0:10 271365 339232;
1156 22/01/2018 0:15 271373 339240" |
makemv delim=";" data |
mvexpand data |
rex field=data "(?<serial>[\d]*)\s+(?<_time>\d{2}\/\d{2}\/\d{4}\s+\d{1,2}\:\d{1,2})\s+(?<delivery>\d+)\s+(?<sent>\d+)" |
fields - data serial |
rex field=_time "(?<condition>\d{1,2}:\d{1,2})" |
where condition="0:00" OR condition="00:00" |
delta delivery as delivery |
delta sent as sent |
fields - condition
Tidied it up a bit and get the following:
_time delivery sent
1 21/01/2018 0:00 264464 331477
2 22/01/2018 0:00 6875 7724
But how do I get the values 6875 and 7724 to be in the same _time row as 21/01/2018 0:00??
... View more
01-22-2018
05:27 PM
I have the following table from my search:
index=core ... |
timechart span=5m
sum(deliverySucceeded) as deliverySucceeded
sum(sentMessage) as sentMessage |
gives this table:
_time deliverySucceeded sentMessage
801 20/01/2018 18:40 262719 329507
… … … …
863 20/01/2018 23:50 264437 331450
864 20/01/2018 23:55 264454 331467
865 21/01/2018 0:00 264464 331477
… … … …
1151 21/01/2018 23:50 271316 339177
1152 21/01/2018 23:55 271328 339189
1153 22/01/2018 0:00 271339 339201
1154 22/01/2018 0:05 271354 339221
1155 22/01/2018 0:10 271365 339232
1156 22/01/2018 0:15 271373 339240
What I want is:(I want it to this for every day in the time range)
_time deliverySucceeded sentMessage
21/01/2018 6875 7724
Which are the midnight values subtracted from each other
e.g. 271339 - 264464 = 6875, 339201 - 331477=7724
1153 22/01/2018 0:00 271339 339201
865 21/01/2018 0:00 264464 331477
6875 7724
Is there a way to do this? Do I have to sue delta or is there a better way?
note: you would think that the max value would always be at midnight but there are instances where this is not the case
these are accumulated values every 5mins. What I want is the daily total of delivery and sent messages.
... View more
- Tags:
- day
- day-over-day
- delta
12-04-2017
12:22 PM
can I put the css in the xml code like @paramagurukarthikeyan mentions below? That would be the ideal.
... View more
12-04-2017
11:30 AM
tks but would like to do it in the simple xml if possible.
... View more
12-04-2017
11:29 AM
tks, css is the kind of solution I am looking for but I could not get this to work but see my edit1, I have included the html code, in the Question. As maybe the css can be slightly edited to work on that html?
... View more
12-03-2017
06:49 PM
2 Karma
Is there a way to remove the realtime search option from my dropdown time picker.
example of code:
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default>
<earliestTime>-24h@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
<input type="dropdown" token="time_span">
<label>Time Span:</label>
<choice value="5m">5m</choice>
<default>5m</default>
</input>
</fieldset>
Example of time-picker: Is there a way to remove the Real-time part that appears from the drop down time picker(highlighted in red)?
EDIT1 - This is the html code(when I do an inspect element on the dropdown) for the "Real-time" part of my pic above(The bit highlight in red). This is what I would like to remove, and as suggessted below, maybe css is the way to do it. Just not sure of the css to remove it.
<div class="accordion-inner presets-container shared-timerangepicker-dialog-presets" data-cid="view112564" data-view="views/shared/timerangepicker/dialog/Presets" data-render-time="0.002">
<ul class="unstyled presets-group">
<li>Real-time</li>
<li><a href="#" data-earliest="rt-30s" data-latest="rt">30 second window</a></li>
<li><a href="#" data-earliest="rt-1m" data-latest="rt">1 minute window</a></li>
<li><a href="#" data-earliest="rt-5m" data-latest="rt">5 minute window</a></li>
<li><a href="#" data-earliest="rt-30m" data-latest="rt">30 minute window</a></li>
<li><a href="#" data-earliest="rt-1h" data-latest="rt">1 hour window</a></li>
<li><a href="#" data-earliest="rt" data-latest="rt">All time (real-time)</a></li>
</ul>
<div class="presets-divider-wrap">
<div class="presets-divider"></div></div>
<ul class="unstyled presets-group">
<li>Relative</li>
...
... View more
- Tags:
- part
- timepicker
11-29-2017
01:07 PM
1 Karma
tks, what I was looking for. just saw there it is missing the closing html tag.
... View more
11-28-2017
06:02 PM
tks, I did not try your way but I found this worked. probs very similar
untable _time field count | eventstats avg(count) as field_avg by field | where field_avg > 1 | xyseries _time field count | timechart max(*) as *
... View more
11-28-2017
01:42 PM
tks this is it. and as above don't think I need the eventstats.
But the time axis seems to change as the below pics hopefully show. Any way I can keep it the same
before
[IMG]http://i63.tinypic.com/iw82vd.png[/IMG]
after
[IMG]http://i66.tinypic.com/35laogl.png[/IMG]
... View more
11-28-2017
01:14 PM
tks for this attempt. it looks valuable.
Although I want to filter by the value in the fields e.g. 1,2,0,6, not the actual field name e.g. P-CSCF-02.
hope that explains it. have edited my Q with my desired output.
... View more
11-28-2017
01:14 PM
tks for this attempt. it looks valuable.
Although I want to filter by the value in the fields e.g. 1,2,0,6, not the actual field name e.g. P-CSCF-02.
hope that explains it. have edited my Q with my desired output.
... View more
11-28-2017
01:00 PM
tks for this attempt. it looks valuable.
Although I want to filter by the value in the fields e.g. 1,2,0,6, not the actual field name e.g. P-CSCF-02.
hope that explains it. have edited my Q with my desired output.
... View more
11-28-2017
12:27 PM
I have edited my Q with the desired output if that helps.
Of the options you propose, the OR option might be a solution, but the AND option I am not sure what that would achieve.
... View more
11-27-2017
05:50 PM
<form hideFilters="true"> to hide the filters
... View more
11-27-2017
05:45 PM
tks both answers are good
... View more
11-27-2017
05:45 PM
tks both answers are good
... View more
11-27-2017
12:35 PM
I want to dynamically remove a number of columns/headers from my stats.
So my thinking is to use a wild card on the left of the comparison operator.
But this does not work
... | where "P-CSCF*">4
Sample Output: Say for example I just wanted to remove the columns P-CSCF-02 & P-CSCF-06 and have P-CSCF-05 and P-CSCF-07 showing. I would like to do it with something like ... | where "P-CSCF*">1 for example. I could use fields + option but that is static I want something dynamic.
_time P-CSCF-02 P-CSCF-05 P-CSCF-06 P-CSCF-07
2017-11-27T18:30:00.000+1300 1 2 0 6
2017-11-27T18:35:00.000+1300 0 2 0 6
2017-11-27T18:40:00.000+1300 0 2 0 6
EDIT1
This is my Desired Output with only 2 columns showing, the others omitted because they do not have any values > 1:
_time P-CSCF-05 P-CSCF-07
2017-11-27T18:30:00.000+1300 2 6
2017-11-27T18:35:00.000+1300 2 6
2017-11-27T18:40:00.000+1300 2 6
Should I be using something like ... | WHERE like(source,"/logs/%/camel-audit.log")]
Not what I want but this is wildcarding on the RHS of the comparison operator ...|search version=*10_2*
... View more
11-27-2017
11:51 AM
Maybe you need to manually remove/add the columns you desire fields - colnames ?
... View more
11-20-2017
02:58 PM
sorry just saw ur answer after answering it myself. tks
... View more
