Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vbumgarner
vbumgarner
Contributor
Member since:
09-13-2010
06-05-2020
Community Statistics
| Posts | 121 |
| Solutions | 9 |
| Karma Given | 6 |
| Karma Received | 89 |
| Member Since | 09-13-2010 |
Activity Feed
- Got Karma for Re: Change y axis scale to logarithmic scale. 08-12-2021 01:35 PM
- Got Karma for Is there a REST endpoint that allows replacing a static resource?. 06-29-2021 09:14 AM
- Got Karma for Using streamstats to track currently active values. 06-05-2020 12:49 AM
- Got Karma for Using streamstats to track currently active values. 06-05-2020 12:49 AM
- Got Karma for Using streamstats to track currently active values. 06-05-2020 12:49 AM
- Got Karma for Re: xmlutils app in clustered environment?. 06-05-2020 12:49 AM
- Got Karma for Any way to use _time with a bubble or scatter chart?. 06-05-2020 12:48 AM
- Got Karma for Any way to use _time with a bubble or scatter chart?. 06-05-2020 12:48 AM
- Got Karma for Any way to use _time with a bubble or scatter chart?. 06-05-2020 12:48 AM
- Got Karma for Is there a REST endpoint that allows replacing a static resource?. 06-05-2020 12:48 AM
- Karma Re: How to use the concurrency command to timechart the top 10 concurrencies by field sourceip? for sideview. 06-05-2020 12:47 AM
- Karma In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior? for gcusello. 06-05-2020 12:47 AM
- Got Karma for Re: In all my forms with post process search, the Export in CSV button is disabled. Is this expected behavior?. 06-05-2020 12:47 AM
- Got Karma for Re: How to write a search to only return data from a set time range (8:00 to 16:00) each day?. 06-05-2020 12:47 AM
- Got Karma for Re: How to write a search to only return data from a set time range (8:00 to 16:00) each day?. 06-05-2020 12:47 AM
- Got Karma for Re: How to write a search to only return data from a set time range (8:00 to 16:00) each day?. 06-05-2020 12:47 AM
- Got Karma for Re: How do you define custom field at index time. 06-05-2020 12:47 AM
- Got Karma for Re: Why can't I find the JDBC Scripted Input app in splunkbase?. 06-05-2020 12:47 AM
- Karma Re: Disable Sources.data for yannK. 06-05-2020 12:46 AM
- Karma Parsing JSON keys containing dots with SPATH for gcsolaroli. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 |
07-13-2019
09:28 AM
Add as “as avg_ping” to your time chart command, or reference the results as 'latest(avg_ping)'
timechart latest(avg_ping) as avg_ping
or
'latest(avg_ping)' = round('latest(avg_ping)',0)
... View more
04-06-2019
10:13 AM
I think you just need to use OR.
...
| search bbfnn=xxxxx OR bbnbnfnn=xxxxx OR bbkenan=xxxxx
If your data is actually in a lookup, inputlookup does support filters, which will be more efficient that piping through search.
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Inputlookup
If your data is NOT in a lookup, then a query that contains the bare word can help your query efficiency, as well.
index=foo (xxxxx AND ( bbfnn=xxxxx OR bbnbnfnn=xxxxx OR bbkenan=xxxxx ) )
... View more
10-22-2018
04:20 PM
Sure would be nice if this was discoverable!
... View more
08-23-2018
01:17 PM
Yes, that’s what I do now, but it has an added delay, extra overhead, etc.
... View more
08-23-2018
09:41 AM
It would be really cool to be able to have all of the fields in a summary index automatically converted to indexed fields. You could then use tstats against a summary index directly with significant speed increases.
Has anyone attempted this?
... View more
06-27-2018
05:38 PM
Though these answers are all interesting and full of great tricks, they don't quite get to where I was headed. I ended up writing some python to accomplish what is needed -- adding and removing values from a streaming set based on other field values.
... View more
06-27-2018
05:23 PM
The ultimate goal is to get at a non-displayed piece of information and use it for a drilldown. The issue is that the column names are dynamic, so you can't simply reference $row.x$.
What I ended up doing is running another query based on the visible value and populating an HTML block with other information, including a link, which the user can then follow.
What's missing currently in the token syntax is something like this:
$tokens[$other_token_name$]$
Or even the ability to get at the value of a cell before fieldformat is applied.
... View more
06-13-2018
11:17 AM
I added a sample dashboard to illustrate the problem.
... View more
06-12-2018
05:09 PM
If I have a table, with columns a and _a, when the user clicks on a, I want to get the value of _a
The problem is that a is completely dynamic.
I can get the value of a using $click.name2$, which is fine, but I cannot figure out how to convince set or eval to reference the value of _a. For instance:
<set token="foo">$row._$click.name2$$</set>
or
<eval token="foo">row._$click.name2$</eval>
or
<eval token="foo">'row._$click.name2$'</eval>
Any ideas?
Here's a sample dashboard that illustrates. The goal is to set the token "right" where the column name is completely unknowable.
<dashboard>
<label>trash me testing dynamic drilldown</label>
<row>
<panel>
<html>
y=$y$ <br/>
x=$x$ <br/>
left=$left$ <br/>
right=$right$ <br/>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>
<![CDATA[
| makeresults count=10
| eval x=substr("x"+md5(tostring(random(),"commas")),0,10)
| eval y=substr("y"+md5(tostring(random(),"commas")),0,10)
| eval v="left"+y+":right"+y
| chart last(v) by y x
| filldown
| foreach x* [rex field="<<FIELD>>" ".*?:(?<_<<FIELD>>>.*)"]
| foreach x* [rex field="<<FIELD>>" "(?<<<FIELD>>>.*):.*"]
]]>
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="y">$row.y$</set>
<set token="x">$click.name2$</set>
<set token="left">$click.value2$</set>
<set token="right">$row._$click.name2$$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
04-20-2018
10:17 AM
Wow, I didn't know | eval {action}=id either. That's golden!
Okay, to throw another wrench into this... I can't count on remove or add not being called multiple times for the same id, nor that I won't encounter removes before adds.
Add these two lines at line 3:
| eval r=mvappend(r,"id=2 action=destroy message=Remove_this_other_thing")
| eval r=mvappend(r,"id=2 action=destroy message=Remove_this_other_thing")
... View more
04-19-2018
10:16 AM
And by “right”, I mean “you’re absolutely right, the eval statements AFTER the streamstats are irrelevant.”
... View more
04-19-2018
10:15 AM
Right. What I need is for the eval statements to run per row as it’s going along. My latest attempt is to try to shove the eval statements inside the last() on the streamstats command, but it doesn’t seem to honor the field just created by itself, and a fillnull beforehand doesn’t make any difference.
... View more
04-18-2018
04:44 PM
Take a look at the example query.
... View more
04-18-2018
03:44 PM
3 Karma
Given input like this:
id, action, message
1, add, Adding this thing
2, add, Adding this other thing
, , I am a different message
1, destroy, Remove this thing
, , I am yet a different message
2, destroy, Remove this other thing
, , And I am yet a different message
I want to get:
activeids, id, action, message
1, 1, add, Adding this thing
1;2, 2, add, Adding this other thing
1;2, , , I am a different message
2, 1, destroy, Remove this thing
2, , , I am yet a different message
, 2, destroy, Remove this other thing
, , , And I am yet a different message
I've been fighting with streamstats global=false current=false window=1 last(activeids) as activeids and a load of eval statements, but streamstats doesn't seem to calculate the values when I think it should (in order of execution per event).
When does streamstats actually do its work vs. other statements in the pipeline?
Here's a query that illustrates what I'm trying to do:
| stats count
| eval r="message=No_id_yet"
| eval r=mvappend(r,"id=1 action=add message=Adding_this_id")
| eval r=mvappend(r,"id=2 action=add message=Adding_this_other_id")
| eval r=mvappend(r,"message=Im_a_different_message")
| eval r=mvappend(r,"id=1 action=destroy message=Remove_this_thing")
| eval r=mvappend(r,"message=Im_yet_a_different_message")
| eval r=mvappend(r,"id=2 action=destroy message=Remove_this_other_thing")
| eval r=mvappend(r,"message=And_Im_yet_a_different_message")
| mvexpand r | rename r as _raw | extract
| table id action message
| streamstats window=1 current=false last(activeids) as activeids_prev
| fillnull activeids_prev
| eval add=if(action=="add", id, null)
| eval remove=if(action=="destroy", id, null)
| eval activeids=if(isnotnull(add), mvdedup(mvappend(activeids_prev,add)), activeids_prev)
| eval activeids=if(isnotnull(remove),split( replace( mvjoin(activeids, "IMPOSSIBLEDELIMITER") , remove, "") , "IMPOSSIBLEDELIMITER" ), activeids )
What I see in the results is that the last(activeids) as activeids_prev doesn't actually match anything. It seems that the eval statements are happening before the streamstats.
What am I missing?
... View more
04-04-2018
02:02 PM
This is still an issue today.
Could this function, even if it has to run the search again? Perhaps a dashboard option to enable it, which is off by default? Please?
... View more
04-04-2018
01:57 PM
This is still an issue today, except now the icon is grayed out instead of returning an error.
Could this function, even if it has to run the search again? Perhaps a dashboard option to enable it, which is off by default? Please?
... View more
03-22-2018
05:25 PM
That appears to have been added in Splunk 6.3. Good to know it’s an option now.
... View more
09-15-2017
03:32 PM
It does just pretty print one field, either the field "xml" or the field "_raw", in that order.
So, if you did something like:
query... | table _time ap xml | xmlprettyprint
The field xml would be pretty printed.
Unfortunately, you can't see it in a table in Splunk, because all white space is collapsed in a table view. You'd need to put the table on a dashboard and add some css to preserve the whitespace. The whitespace should survive in an export, though.
... View more
08-25-2017
08:51 PM
1 Karma
You'll need to either install it on the indexers, or use localop to force it to run on the search head. Assuming you're only formatting a small number of events, this second option should be fine.
... View more
08-04-2017
11:19 AM
Right. I've tried this before with the simple xml. You get the same behavior.
What I actually want to do is change the TimePicker used for the overall query, based on what the user selects, but since it changes on its own to some timescale that lines up with buckets, and then fires that event again, it does the search at least twice. Now, throw more than one graph on the page with this selection event, and it gets really funky. You can end up with a page that never stops redrawing.
I'm using the javascript because I'm drawing multiple graphs and tables dynamically based on user input.
... View more
08-02-2017
05:19 PM
What is the HTML checker that Splunk uses?
... View more
08-02-2017
11:29 AM
Is there any way to tell that the selection event on ChartElement fired right after render wasn't initiated by the user? I'd like to do a bunch of stuff if the user has dragged a new selection, but not when Splunk is figuring out how it's going to draw the graph.
Here's a code snippet:
var ce = new ChartElement({ ... }, {}).render();
ce.on('selection', function(e) {
e.preventDefault();
// determine if this event actually happened because a user did something.
});
My end goal is to modify the values of a timepicker based on what the user chose. Unfortunately, this event fires A LOT, and I can't figure out if the user initiated the change.
... View more
07-11-2017
05:18 PM
Interesting. If I handed it to map, I'm afraid I'd be pinned to the limits of a subsearch, but it's an interesting idea.
I ended up doing something much like your example, but it's a pain, and certainly not easy to explain to anyone else.
What you absolutely can't do is something like this:
search ... | eval _time=fieldX | timechart fixedrange=false bins=100 count by fieldY
I believe it bins everything at some range relevant to the original query, which in my case ends up being a bin size of a second. So, you end up with thousands of bins.
I think I'd be set if I could do something like...
search ... | eval _time=fieldX | eventstats min(_time) as _search_earliest max(_time) as _search_latest | timechart fixedrange=100 bins=20 count by fieldY
... View more
06-27-2017
11:16 AM
So... side question...
Is there any way to "reset" the "search timeframe" so that all the "commands that bin" will honor a new "search timeframe" instead of the timeframe used in the original query?
... View more
06-23-2017
02:02 PM
I am dependent on time data, but the time data isn't in the timeframe of the original query. The timeframe of the original query isn't relevant.
... View more
