×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
cxs6345
Engager
Member since: ‎07-18-2018
‎12-05-2024
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎07-18-2018
View All

Fill field with first value

by in Splunk Search
‎08-05-2024 11:35 AM
‎08-05-2024 11:35 AM
I have a data set for web traffic.  A sessionID ties all traffic for an individual browsing session together - all events from the time you open a new tab until you close it.  There is also a memberID field.  Some records do NOT have a value populated for memberID, so I want to return each record for the sessionID with the FIRST non-null value found in the sessionID.  For instance time sessionID memberID evalField 12:01 1 <NULL> abc 12:02 1 <NULL> abc 12:03 1 abc abc 12:04 1 <NULL> abc Can someone help me out with how to get this evalField column?  Thanks so much! ... View more
Labels

Re: Dashboard line chart with dynamic time interva...

by in Dashboards & Visualizations
‎04-22-2021 05:47 AM
‎04-22-2021 05:47 AM
Thanks so much.  With a little tinkering this turned out great!  My only remaining question is around the last period being displayed.  I always get an empty last entry on the X axis.  Any thoughts?  Wondering if it has anything to do with the "snap to" start of week option? <panel> <title>XXX</title> <chart> <search> <query>index=XXX earliest=$time_token.earliest$ latest=$time_token.latest$ ... | rename http.request.queryParameters.authIndexValue{} as "Successful Logins" | timechart span=$time_span$ count("Successful Logins") as "Successful Logins"</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisY.abbreviation">auto</option> <option name="charting.chart">area</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.drilldown">none</option> <option name="charting.legend.placement">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <input type="radio" token="time_span" searchWhenChanged="true"> <label>Time Span</label> <choice value="w@w1">By Week</choice> <choice value="d@d1">By Day</choice> <choice value="h@h1">By Hour</choice> <search> <query/> <earliest>-7d</earliest> <latest>now</latest> </search> <default>w@w1</default> <initialValue>w@w1</initialValue> </input> <input type="time" token="time_token" searchWhenChanged="true"> <label>Date Range</label> <default> <earliest>-6w@w</earliest> <latest>now</latest> </default> </input>   ... View more

Dashboard line chart with dynamic time interval

by in Dashboards & Visualizations
‎04-20-2021 10:58 AM
‎04-20-2021 10:58 AM
I have a search roughly equivalent to this: ... | eval TimeHour=strftime(_time,"%Y-%m-%d %H:00:00") | eval TimeDay=strftime(_time,"%Y-%m-%d") | eval TimeWeek=strftime(_time,"%Y-%V") | stats dc(transactionId) as "Users" by TimeHour, TimeDay, TimeWeek I want to create a line chart that allows the user to choose to group by hour, day, or week.  What's the best way to achieve that?  Maybe a string "date" isn't the right way to go.  In any event, can I change which field from a search is the X axis rather than defaulting to something random?  I'm frustrated with the lack of flexibility in visualizations. Thanks! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎12-05-2024 05:56 PM
Karma given to
View All