About wyang6

sideview · ‎05-27-2011

This sounds like a problem you should send in to support@splunk.com because you can send in those var/run/dispatch files as well as a diag (from running the splunk diag command), for them to analyze. Not that someone here might help too, but they'll sort you out.

bwooden · ‎05-27-2011

I had ... | fillnull value=0 'Los Angeles' 'New York' 'Boston' 'Washington D.C.' | eval x='New York'+'Boston'+'Washington D.C'

hazekamp · ‎04-18-2011

For the search, you can do "| top limit=0". On the dashboard side, if you are using simple XML try the showPager option.

dwaddle · ‎03-31-2011

Easiest way is probably to use | eval to go ahead and convert the units on your source data. Assuming your field is named foo , then something like this: | eval megafoo=foo/1000000 And then chart megafoo instead.

wyang6 · ‎04-06-2011

How do I find the maximum number in the 2D chart above?

svenwendler · ‎09-25-2013

I had the same issue. I fixed it by changing the default settings from [join] subsearch_maxout = 50000 subsearch_maxtime = 60 subsearch_timeout = 120 to [join] subsearch_maxout = 50000 subsearch_maxtime = 360 subsearch_timeout = 360 in limits.conf

wyang6 · ‎02-09-2011

Solution: Extract the .csv file before uploading it.

ftk · ‎12-03-2010

I don't believe that you can use the date range picker in simple XML dashboards. You will have to rewrite your dashboard in advanced XML. Check out the docs on this subject, they walk you through converting your simple dashboard to advanced XML, and how to add modules.

vvarghes6 · ‎02-14-2018

That worked Stephen!

wyang6 · ‎10-27-2010

I typed with the "space" and "vertical bar" character on the keyboard. If you meant in Splunk, I just used the commands below.

Genti · ‎10-28-2010

then there is something wrong with the way your browser is rendering the page.

sideview · ‎09-15-2010

Check out the "UI Examples for 4.1" app on Splunkbase. It has numerous example views in both the simplified and advanced XML format. Underneath 'Advanced XML', and then underneath 'Drilldown Examples' you'll see several examples of the config you're describing. It generally goes by the name "inline drilldown" or "paned viewer" configuration. In brief, you can only do this configuration in the Advanced XML, and if you're already familiar with the advanced XML it amounts to just finding the relevant ViewRedirector module and replacing it with a different module or a different set of modules. But look at the examples in the downloadable app because they'll make more sense. And if you arent familiar with the advanced XML yet, that app can walk you through it from a simple Hello World level.

Stephen_Sorkin · ‎10-27-2010

If you have a CSV file that enumerates all cities, than before the "| chart" you can add "| inputlookup append=t .csv" where .csv is in etc/apps/ /lookups.

Posts	23
Solutions	1
Karma Given	0
Karma Received	6
Member Since	‎09-07-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Quick Question: Dashboard with saved search

Quick Question: eval

Quick Question: Charting maximum values

Quick Question: Chart Scale

Quick Question: Chart Scale

Search: time limit

Quick Question: Field Lookups

Quick Question: Button for Date Range Selection

Quick Question: Sum Across Rows and Columns

Sort Fields in Charts

Re: Quick Question: Dashboard with saved search

Re: Quick Question: eval

Re: Quick Question: Charting maximum values

Re: Quick Question: Chart Scale

Re: Quick Question: Chart Scale

Re: Search: time limit

Re: Quick Question: Field Lookups

Re: Quick Question: Button for Date Range Selectio...

Re: Quick Question: Sum Across Rows and Columns

Re: Sort Fields in Charts

Re: Quick Question: Print or PDF

Re: Drilldown Chart

Re: Create a Pivot Table