Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jhuysing
jhuysing
Loves-to-Learn
Member since:
11-03-2015
10-06-2023
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-03-2015 |
Activity Feed
- Posted time chart to show the number of widgets manufactured per reporting period on Splunk Search. 10-05-2023 09:23 PM
- Posted Re: trelli graph dynamic y axis label on Dashboards & Visualizations. 06-10-2021 04:15 PM
- Posted trelli graph dynamic y axis label on Dashboards & Visualizations. 06-10-2021 01:19 AM
- Posted Re: How to produce multiple values graphs on Splunk Search. 08-04-2019 08:50 PM
- Posted Re: How to produce multiple values graphs on Splunk Search. 07-23-2019 03:54 PM
- Posted Re: How to produce multiple values graphs on Splunk Search. 07-22-2019 08:57 PM
- Posted Re: How do I reverse/swap characters in a string value returned from a search? on Splunk Search. 07-22-2019 03:52 PM
- Posted How to produce multiple values graphs on Splunk Search. 07-22-2019 02:42 PM
- Tagged How to produce multiple values graphs on Splunk Search. 07-22-2019 02:42 PM
- Tagged How to produce multiple values graphs on Splunk Search. 07-22-2019 02:42 PM
- Tagged How to produce multiple values graphs on Splunk Search. 07-22-2019 02:42 PM
- Tagged How to produce multiple values graphs on Splunk Search. 07-22-2019 02:42 PM
- Tagged How to produce multiple values graphs on Splunk Search. 07-22-2019 02:42 PM
- Posted Hi I have a TLV on All Apps and Add-ons. 09-07-2016 09:42 PM
- Tagged Hi I have a TLV on All Apps and Add-ons. 09-07-2016 09:42 PM
- Posted Re: How to properly parse a CSV file with embedded double quotes on the end of a field before the file is indexed? on Splunk Search. 12-14-2015 04:09 PM
- Posted Re: How to properly parse a CSV file with embedded double quotes on the end of a field before the file is indexed? on Splunk Search. 12-14-2015 04:08 PM
- Posted Re: How to properly parse a CSV file with embedded double quotes on the end of a field before the file is indexed? on Splunk Search. 12-14-2015 04:04 PM
- Posted How to properly parse a CSV file with embedded double quotes on the end of a field before the file is indexed? on Splunk Search. 12-14-2015 03:45 PM
- Tagged How to properly parse a CSV file with embedded double quotes on the end of a field before the file is indexed? on Splunk Search. 12-14-2015 03:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-05-2023
09:23 PM
Have a log with related event One event has the number widgets made in the period and another event has the actual time taken to make the widgets in that period. i can do a search and get a time chart of number of widgets and time used . But, what I want is a timechart of the actualtime/number of widgets made.. How do i construct a search to do that.
... View more
06-10-2021
04:15 PM
Stripped back source | eval NewTime=strptime(BATCH_DATE, "%d/%m/%Y %H:%M:%S %Z")
| eval _time=NewTime
| rex field=ROW_SUB_HEADER ".*:\s(?P<Code>\d{3})"
| rename ROW_HEADER as Site, DATA_VALUE as Value
| lookup fault_codes Code OUTPUT Phrase
| eval CodePhrase = Code+" -- "+Phrase
| chart max(Value) as Value over _time by CodePhrase limit=100</query>
chart options removed
<drilldown>
<link target="_blank">/app/production/site_process_code?code=$trellis.value$</link>
</drilldown>
... View more
06-10-2021
01:19 AM
Using a lookup to enrich a trellis graph. initially added the text to the split by value which works ok. until you do a drilldown Is there someway inert the text as the y-axis title Or is the there a way in search on the linked drilldown dashboard to strip the text from the passed value
... View more
Labels
- Labels:
-
chart
-
drilldown
-
trellis layout
08-04-2019
08:50 PM
After a week of putting out other fires
Okay that works as long as you don't use the Trellis layout
... View more
07-23-2019
03:54 PM
okay that fixed it so I get all the counter types.
The lines were not being drawn. I found i had another problem with
| eval counters = split( results,",")
changed it to so there is a space after the comma and all the line get drawn
| eval counters = split( results,", ")
Now I need to figure out how to change the CounterType from a number to the correct name
... View more
07-22-2019
08:57 PM
| eval index_counters=mvzip(mvrange(0, mvcount(counters), 1), counters, "-")
| mvexpand index_counters
| eval index_counters=split(index_counters, "-")
| eval CounterType=mvindex(index_counters, 0)
| eval CounterValue=mvindex(index_counters, 1)
| fields _time CounterTypes CounterValue _raw | sort _time
| table CounterValue , CounterTypes, _time
When I run this query, I get a result of 21 counterTypes, starting a 0
When I replace the last line with
| timechart max(CounterValue) as CounterValue by CounterType
in the preview there is only 11 columns including others, the other counter types are missing
0 1 10 11 12 13 14 15 16 17 OTHER
and when look at the visualizations the legend only includes the value above and there is a diagonal line going up from left to right
... View more
07-22-2019
03:52 PM
This solution works for a fixed length string. Is there way of performing character reversal for variable length fields apart from have multiple regex's with different search and replacments lengths
|rex field=nbr mode=sed "s/(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d)/\10\9\8\7\6\5\4\3\2\1/"
| rex field=nbr mode=sed "s/(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d)/\9\8\7\6\5\4\3\2\1/"
| rex field=nbr mode=sed "s/(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d)/\8\7\6\5\4\3\2\1/"
... View more
07-22-2019
02:42 PM
We have a log of some metrics that look like this:
20:45:00 10.10.71.01 values : [12035313, 233658, 0, 0, 24249, 13058, 0, 229867, 0, 0, 0, 0, 24249, 0, 0, 0, 37307, 0, 257907, 42125, 320380, 0]
I can pull out each of the values and produce a table.
| rex field=_raw "\[(?.*)]"
| eval counters = split( results,",")
| eval Requests=mvindex(counters,1) etc
However, I want to produce a multiline graph, is this possible?
... View more
09-07-2016
09:42 PM
Is there any way to pre-proccess a Tag Length File before it gets indexed?
... View more
- Tags:
- splunk-enterprise
12-14-2015
04:09 PM
ok how do enter backslashes here so they don't get absorbed
... View more
12-14-2015
04:08 PM
try this again
field3 should look like this "field3-sdasds\"textdata blah blah\"", "field4-#$%232"
... View more
12-14-2015
04:04 PM
field3 should look like this "field3-sdasds\"textdata blah blah\"", "field4-#$%232"
... View more
12-14-2015
03:45 PM
The field ends with a protected quote followed by another quote
Ex:
"field1",field2", "field3-sdasds\"textdata blah blah\"", "field4-#$%232",
The embedded quotes are protected, but when the files are processed, it doesn't split the fields correctly and field 3 and 4 end up together.
I have experimented with adding a space between the protected quote and field terminating quote and it seems to work.
field1",field2", "field3-sdasds\"textdata blah blah\" ", "field4-#$%232"
Is there someway to do this automatically before the files are indexed?
... View more
11-03-2015
02:03 PM
Hi
I am a complete noob at all this Splunk stuff.
I have built a search that display results in a table.
What I would like to do is have a left click option to open a new search with only the results of that value in a table format, but not as a raw list like "view events" does.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-06-2023
02:27 AM
|
