Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About h52huang
h52huang
Path Finder
Member since:
05-15-2018
06-05-2020
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 05-15-2018 |
Activity Feed
- Karma Re: Heatmap - Date column automatically append hour. How to format and remove for aljohnson_splun. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk Forced directed graph line color range meaning and example. 06-05-2020 12:49 AM
- Karma Re: duplicate values causing conflict for NOUMSSI. 06-05-2020 12:47 AM
- Posted Re: Forced directed graph Source and Destination node opposite arrow direction on All Apps and Add-ons. 06-13-2018 02:37 PM
- Posted Re: Heatmap - Date column automatically append hour. How to format and remove on All Apps and Add-ons. 06-11-2018 09:22 PM
- Posted Heatmap - Date column automatically append hour. How to format and remove on All Apps and Add-ons. 06-10-2018 12:01 AM
- Tagged Heatmap - Date column automatically append hour. How to format and remove on All Apps and Add-ons. 06-10-2018 12:01 AM
- Tagged Heatmap - Date column automatically append hour. How to format and remove on All Apps and Add-ons. 06-10-2018 12:01 AM
- Tagged Heatmap - Date column automatically append hour. How to format and remove on All Apps and Add-ons. 06-10-2018 12:01 AM
- Tagged Heatmap - Date column automatically append hour. How to format and remove on All Apps and Add-ons. 06-10-2018 12:01 AM
- Posted Re: Heatmap - Tool, Query, and visualization options. on All Apps and Add-ons. 06-08-2018 05:58 PM
- Posted Re: Combine and use query results contained in 2 other queries. on Splunk Search. 06-07-2018 09:41 PM
- Posted Re: Combine and use query results contained in 2 other queries. on Splunk Search. 06-07-2018 02:33 PM
- Posted Re: Combine and use query results contained in 2 other queries. on Splunk Search. 06-07-2018 02:29 PM
- Posted Re: Forced directed graph Source and Destination node opposite arrow direction on All Apps and Add-ons. 06-07-2018 12:43 PM
- Posted Re: Forced directed graph node color customization based on behaviour on All Apps and Add-ons. 06-07-2018 11:36 AM
- Posted Re: Forced directed graph Source and Destination node opposite arrow direction on All Apps and Add-ons. 06-07-2018 11:27 AM
- Posted Re: Forced directed graph Source and Destination node opposite arrow direction on All Apps and Add-ons. 06-07-2018 11:14 AM
- Posted Forced directed graph Source and Destination node opposite arrow direction on All Apps and Add-ons. 06-07-2018 11:08 AM
- Tagged Forced directed graph Source and Destination node opposite arrow direction on All Apps and Add-ons. 06-07-2018 11:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-13-2018
02:37 PM
@niketnilay
I did small patches. So, made the panel hidden which is the 'Destn, Source' order, and drills down the graph. Then added another panel with Source, Destn order to show the event table for now. 😄
... View more
06-11-2018
09:22 PM
@aljohnson_splunk @aljohnson
Thank you very much.
Date is strings of dates like "2018-05-07"
TimeWindow is string of fixed 20-min window for 24 hours.
TimeWindow 2018-05-07 2018-05-08 2018-05-09 2018-05-10 2018-05-11
00:00:00--00:20:00 0 3 1 6 4
00:20:00--00:40:00 0 1 2 4 0
00:40:00--01:00:00 0 0 2 1 4
01:00:00--01:20:00 0 0 2 4 0
01:20:00--01:40:00 0 8 1 2 4
01:40:00--02:00:00 0 9 2 1 2
02:00:00--02:20:00 0 3 2 2 4
... More windows...
The query I used for the heatmap is:
index="blabla" | chart sum(My_count_column) by TimeWindow Date | sort TimeWindow
When I hover on the heatmap, it shows as:
x: 02:00:00--02:20:00
y: May 08 00h ---> This has been converted from string '2018-05-05" to date with hour information. I want to keep it as '2018-05-08' please.
z: 3
... View more
06-10-2018
12:01 AM
Hi, I sent an question but seems like it was not delivered by my poor network.
I have a heatmap. For raw events, I have a column as Date where example values are like 2018-05-21 . my X contains all timewindow string, 01:00:00-01:00:20 for 24 hours. Z is a count value.
On heatmap, when I hover, it shows:
x: 01:00:00-01:00:20
y: 2018-05-21 06h (or 12h, or 00h)
z: 12
Is there a way to remove the automatically appended hour characters on the heatmap please? They are not in the raw data column. Do I do data formation and then hide? How to do it please? Could someone give an example please? Or, how can I resolve this in more straightforward ways please?
Thank you very much.
... View more
06-08-2018
05:58 PM
Hi @aljohnson 🙂
Thanks a lot for helping. I have a few more questions please.
I tried with both
... base search
| chart sum(something) by Date TimeWindow
and
... base search
| chart sum(something) by TimeWindow, Date
The results are totally different for axis values.
by TimeWindow Date gave me:
x: 01:00:00-01:20:00
y: April 2006 (The value is weird, I suspect it was calculated and converted from my 2018-05-07
z: 12
while by Date TimeWindow gave me:
x: May 7 12h
y: 01:00:00-01:20:00
z: 12
I checked how the values look like in a table, they are completely ok. but I don't know why Y axis date string is automatically calculated and then into a date.
Is there a way for me to:
- Remove 12h in the Date field, and reserve Y axis field please?
Thank you so much
... View more
06-07-2018
09:41 PM
@niketnilay
I seem figured out. 🙂
|union
[subsearch 1]
[subsearch 2]
... View more
06-07-2018
02:33 PM
index=bla field1=aaa field2=bbb (Source=A OR Destination=A)
[index=bla field1=aaa field2=bbb Source=A | top limit=15 Destination showperc=f showcount=f ]
[index=bla field1=aaa field2=bbb Destinatioe=A | top limit=15 Destination showperc=f showcount=f ]
Does this append the results? My desired it a total of 30 with 15 of Source=A and 15 of Destination=A.
Thank you very much. @niketnilay
... View more
06-07-2018
02:29 PM
@niketnilay
Could you share more knowledge on this please? I have been doing a few experiments locally and I am getting confused about the pipeline filtering in subsearches.
index=bla field1=aaa field2=bbb (Source=A OR Destination=A)
[index=bla field1=aaa field2=bbb Source=A | top limit=15 DestinationNode showperc=f showcount=f ] is returning 75 events (not 15 events).
... View more
06-07-2018
12:43 PM
@niketnilay
Thank you so much. I tried that but they dont like the mental twist.
I am thinking 1possible way to get around, could be:
creating another hidden panel to drill down the forced directed graph, while the displayed graph just shows as table Source Destination.
However, hidden requires a token. I don't know if I can create a invisible field with a token...
Thank you~
... View more
06-07-2018
11:36 AM
Thank you very much @dperre
I enabled arrows and the link direction are great. There are fancy color controls on it too.
I just noticed there are colors on node too!!! But I am not sure what each color means. Is there a way to have custom control on the node colors please? I can only find the 'Line Color' control from form visualization.
Thanks again!!! Great tool!!
... View more
06-07-2018
11:27 AM
I noticed on version 1.0.3, the directions are good. I copied over the same xml code to 2.0.0, and arrows are opposite. Could you please share ideas on if there's any tricks I can do from my side to have a fast fix on it? Appreciate 😄
@dperre_splunk
... View more
06-07-2018
11:14 AM
Where is the control for arrow directions please? @niketnilay @dperre_splunk Thank you
... View more
06-07-2018
11:08 AM
indexblabla | stats count by SourceNode DestinationNode | sort -count | table SourceNode DestinationNode count
So table renders
SourceNode DestinationNode count
But in the graph, the arrow comes from DestinationNode to SourceNode . If I swap query to ` indexblabla | stats count by DestinationNode SourceNode | sort -count then the direction comes to correct, but the table is showing DestinationNode and then SourceNode, which is not wanted.
<row>
<panel>
<title>Table title</title>
<table>
<title>Source data</title>
<search id="querysearchid">
<query>index=blabla | stats count by SourceNode DestinationNode | sort -count | table SourceNode DestinationNode count</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
</table>
</panel>
<panel>
<title>Logins to and from selected host graph by this user</title>
<viz type="force_directed_viz.force_directed">
<title>graph title</title>
<search base="querysearchid">
<query/>
</search>
<option name="drilldown">none</option>
<option name="force_directed_viz.force_directed.AttractDistanceMax">200</option>
<option name="force_directed_viz.force_directed.AttractDistanceMin">60</option>
<option name="force_directed_viz.force_directed.AttractForceStrength">-300</option>
<option name="force_directed_viz.force_directed.CollisionIterations">1</option>
<option name="force_directed_viz.force_directed.CollisionRadius">20</option>
<option name="force_directed_viz.force_directed.CollisionStrength">0.7</option>
<option name="force_directed_viz.force_directed.ColorRange1">100</option>
<option name="force_directed_viz.force_directed.ColorRange1Code">#65a637</option>
<option name="force_directed_viz.force_directed.ColorRange2">500</option>
<option name="force_directed_viz.force_directed.ColorRange2Code">#6db7c6</option>
<option name="force_directed_viz.force_directed.ColorRange3">1000</option>
<option name="force_directed_viz.force_directed.ColorRange3Code">#f7bc38</option>
<option name="force_directed_viz.force_directed.ColorRange4">10000</option>
<option name="force_directed_viz.force_directed.ColorRange4Code">#f58f39</option>
<option name="force_directed_viz.force_directed.ColorRange5">1000000</option>
<option name="force_directed_viz.force_directed.ColorRange5Code">#d93f3c</option>
<option name="force_directed_viz.force_directed.ForceCollision">20</option>
<option name="force_directed_viz.force_directed.LineColor">enabled</option>
<option name="force_directed_viz.force_directed.LinkDistance">100</option>
<option name="force_directed_viz.force_directed.LinkLength">1</option>
<option name="force_directed_viz.force_directed.RepelDistanceMax">50</option>
<option name="force_directed_viz.force_directed.RepelDistanceMin">10</option>
<option name="force_directed_viz.force_directed.RepelForceStrength">-140</option>
<option name="force_directed_viz.force_directed.StrokeWidth">1</option>
<option name="force_directed_viz.force_directed.arrows">enabled</option>
<option name="force_directed_viz.force_directed.circleSize">5</option>
<option name="force_directed_viz.force_directed.panzoom">enabled</option>
<option name="force_directed_viz.force_directed.theme">dark</option>
<option name="height">350</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">small</option>
</viz>
</panel>
</row>
... View more
06-07-2018
10:04 AM
My data model is like:
Key Source Destination
1 a b
1 b c
1 a c
1 a e
because the source result table is too large, I need to get top 30 results that have 15 most popular ones in each, for Source, and Destination.
I propose:
1. index=bla model=blala | top limit=15 Source as sourcegroup??
2. index=bla model=blala | top limit=15 Destination as destinationgroup?
3. index=bla model=blala where Source is contained in sourcegroup or Destination is contained in destinationgroup?
I don't know how to implement list item 3, and how to combine the results into 1. I searched and tried with multiplesearch, but it did not work. Or if the algorithm is slow, any efficient suggestions please?
Thank you so much.
... View more
06-05-2018
01:46 PM
@dperre
Thanks so much for answering this. Really appreciate. 🙂
In my case, I use the nodes to represent certain hosts in a network. It would be nice to distinguish visually among hosts that only has incoming traffic, outgoing traffic, or both.
Thanks again!!
... View more
06-05-2018
09:04 AM
Hi, is it possible to have more control on colors of node for forced directed graphs please?
For example,
if node A only has incoming edges, then I make it red;
if node B only has outgoing edges, I make it green;
and if node C has both incoming and outgoing edges, I make it black.
Thank you.
... View more
06-04-2018
06:29 PM
I want to compare date strings by splunk queries please. I have 2 dropdown inputs. StartDate and EndDate
I have below result set populated from a dropdown as 'StartDate'. If the user selects 2018-05-03 , then my EndDate should only have 2018-05-07 and 2018-05-16 available for users to pick.
Date
2018-05-01
2018-05-03
2018-05-07
201805-16
How do I do the comparison logic within the same query please? Can Splunk compare dates alphabetically like Java strings ? Thank you.
... View more
06-04-2018
06:06 PM
I currently have a sample data table as below. I want to put it into a heatmap, where Date, TimeWindow, Sum as X, Y, and Z in the heatmap.
Date TimeWindow Sum
3/1/2018 20:20:00—20:40:00 5
3/3/2018 14:40:00—15:00:00 3
3/9/2018 23:20:00—23:40:00 0
3/23/2018 00:40:00—01:00:00 1
I downloaded this heatmap: https://splunkbase.splunk.com/app/3159/
Query I used: source blabla | table Date TimeWindow Sum
The heatmap I got was weird.
I looked at its sample data from "| inputlookup marx_counts.csv", the input data structure looks completely diffirent.
I think my query is wrong, but I couldn't find examples to refer to. Am I using the right Heatmap app, or would anyone suggest me changing to another Heatwave, or change my input data models...?
Thank you.
... View more
05-29-2018
03:43 PM
1 Karma
Figured out from the code provided by @niketnilay ♦ in https://answers.splunk.com/answers/660492/splunk-web-how-to-generate-directed-graph-on-nodes.html
It's basically number of relationships linked between sourceNodeA to destinationNodeA.
... View more
05-29-2018
02:00 PM
Hey thanks so much for coming back and update. I just realized you might be the expert for my question here! link text 🙂 Please help to take a look when u have time. Thank you sooooo much.
https://answers.splunk.com/answers/662503/splunk-forced-directed-graph-line-color-range-mean.html
... View more
05-29-2018
01:56 PM
Hi, I haven't found a detailed explanation/documentation for the 'Line Color' menu under 'Format visualization'. For force directed graph on Splunk (Web).
I do not really understand what the line color represent. (Number of nodes from source to destination? ) With a dummy example, could someone please explain how I can use the line color range, and the meaning behind it please?
Thanks a lot.
... View more
- Tags:
- splunk-enterprise
05-19-2018
10:24 PM
This is fabulous!!! Thank you so much.
... View more
05-18-2018
05:14 PM
Hi experts, please help. I am using Splunk Web.
I am learning splunk. I want to have nodes visualized as directed graphs in splunk.
Dummy test data.
What I want to do:
- The right table is my source data. I want to render left graphs.
- And if further possible, if I click on node A, only B, D, E, C and the connected arrows will show, and any unconnected nodes to selected node A will fade out.
What I have done:
- I downloaded https://splunkbase.splunk.com/app/3767/#/details , and uploaded the zip on Splunk Web.
- Also created a dummy data csv file and uploaded.
- so, if I do query [source="nodes.csv"], events show:
5/18/18 11:17:50:000 PM | C, F
5/18/18 11:17:50:000 PM | A, E
5/18/18 11:17:50:000 PM | A, B
......
I am really confused on how to USE this app so that I can have directed graphs showing representing the nodes. I am unsure if my input data are of proper format. Any advice appreciated. Thank you.
... View more
- Tags:
- splunk-enterprise
05-15-2018
04:09 PM
Hi, I am 1 week old to splunk. Using web-version. Need any generous help please.
I have a chart1 that drills down to a table1, upon clicking, passes the $click.value$ from chart1.
An example of my goal: from chart1, the $click.value$=15, then I want to set the dateTimeRange picker for table1 to 15:00:000 to 16:00:000. Then table1 will filter and only show events between 15-16:00 of a day.
Is above possible please? If yes, could anyone share more information about it please?
If not, then we might have to use query. I checked this example with question id 438520, sorry no enough points to post links..., but since I do not have input boxes as the example does, how do I convert those fields into query please?
Thanks a lot for any help.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
