Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ramesh12345
ramesh12345
Explorer
Member since:
11-13-2018
06-05-2020
Community Statistics
| Posts | 48 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-13-2018 |
Activity Feed
- Got Karma for Why I am getting this error ? every credential is correctly provided?. 06-05-2020 12:50 AM
- Posted Re: How to do custom visualization? on Dashboards & Visualizations. 04-18-2019 02:24 AM
- Posted Re: How to do custom visualization? on Dashboards & Visualizations. 04-18-2019 01:31 AM
- Posted Re: How to do custom visualization? on Dashboards & Visualizations. 04-16-2019 02:41 AM
- Posted How to do custom visualization? on Dashboards & Visualizations. 04-16-2019 02:15 AM
- Tagged How to do custom visualization? on Dashboards & Visualizations. 04-16-2019 02:15 AM
- Posted Re: How to create custom dashboard? on Dashboards & Visualizations. 04-09-2019 04:47 AM
- Posted Re: How to create custom dashboard? on Dashboards & Visualizations. 04-02-2019 05:21 AM
- Posted Re: How to create custom dashboard? on Dashboards & Visualizations. 04-01-2019 02:34 AM
- Posted How to create custom dashboard? on Dashboards & Visualizations. 04-01-2019 01:08 AM
- Tagged How to create custom dashboard? on Dashboards & Visualizations. 04-01-2019 01:08 AM
- Posted How to get the latest name from the data? on Splunk Search. 03-25-2019 01:58 AM
- Tagged How to get the latest name from the data? on Splunk Search. 03-25-2019 01:58 AM
- Posted Re: How to retrieve names from comments and assign values to those names? on Splunk Search. 03-13-2019 07:42 AM
- Posted Re: How to retrieve names from comments and assign values to those names? on Splunk Search. 03-13-2019 07:11 AM
- Posted How to retrieve names from comments and assign values to those names? on Splunk Search. 03-13-2019 05:27 AM
- Tagged How to retrieve names from comments and assign values to those names? on Splunk Search. 03-13-2019 05:27 AM
- Posted Re: How do you retrieve names in comments using regex? on Splunk Search. 03-11-2019 12:26 AM
- Posted How do you retrieve names in comments using regex? on Splunk Search. 03-08-2019 06:43 AM
- Tagged How do you retrieve names in comments using regex? on Splunk Search. 03-08-2019 06:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-18-2019
02:24 AM
Thank you very much for your help.
... View more
04-18-2019
01:31 AM
Thanks You very much,it's working fine with my requirement with some modifications.I have small doubt,i installed Scalable Vector Graphics - Custom Visualization app and i created separate dashboard for my Bulb Visualization,when i disabled the app then in my dashboard showing SVG error.Is this because of ?.how to make dashboard work without the original app.What are the changes i need to do.
... View more
04-16-2019
02:41 AM
Xml File:
Bulb Visualization Sample
<panel>
<html>
<style>
/* CSS for table response_time_highlight_icon
#response_time_highlight_icon tr{
width: 40px;
height: 40px;
float: left;
}*/
#response_time_highlight_icon td.icon img{
text-align: center;
width: 100px;
height: 100px;
}
#response_time_highlight_icon td.icon i {
font-size: 25px;
text-shadow: 1px 1px #aaa;
}
#response_time_highlight_icon td.icon .severe {
color: indianred;
}
#response_time_highlight_icon td.icon .elevated {
color: orange;
}
#response_time_highlight_icon td.icon .low {
color: #lightgreen ;
}
/* CSS for table response_time_highlight_cell */
#response_time_highlight_cell td.range-low {
background-color: lightgreen !important;
}
#response_time_highlight_cell td.range-elevated {
background-color: orange !important;
font-weight: bold;
}
#response_time_highlight_cell td.range-severe {
background-color: indianred !important;
font-weight: bold;
}
/* CSS for table response_time_highlight_row */
#response_time_highlight_row tr td {
background-color: lightgreen !important;
}
#response_time_highlight_row tr.range-elevated td {
background-color: orange !important;
}
#response_time_highlight_row tr.range-severe td {
background-color: indianred !important;
}
#response_time_highlight_row .table td {
border-top: 1px solid #fff;
}
</style>
<table id="response_time_highlight_icon">
<search>
<query>index=_internal|stats count by name| eval "Total Count"=case('count'>2800,"severe_".'count','count'<2800 AND 'count'>=2000,"elevated_".'count',true(),"low_".'count')|fields - count,name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
JavaScript File:
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function(, $, mvc, TableView) {
// Translations from rangemap results to CSS class
var ICONS = {
severe: 'alert-circle',
elevated: 'alert',
low: 'check-circle'
};
var RangeMapIconRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Only use the cell renderer for the "Total Count" field
return cell.field === 'Total Count';
},
render: function($td, cell) {
var icon = 'check-circle';
// Fetch the icon for the value
var cellArray = cell.value.split("");
var cellValue = cellArray[1];
var range = cellArray[0];
if (ICONS.hasOwnProperty(cellArray[0])) {
icon = ICONS[cellArray[0]];
}
// Create the icon element and add it to the table cell
/* $td.addClass('icon').html(.template(' <%- cellValue %> ', {
icon: icon,
range: cellArray[0],
cellValue:cellValue
}));
}
});
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for 'Total Count'
return _(['Total Count']).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var strSLA = cell.value;
if (strSLA!==undefined){
strSLA=strSLA.trim();
$td.addClass('range-cell').addClass("range-"+strSLA);
}
$td.text(strSLA).addClass('string');
}
});
mvc.Components.get("response_time_highlight_icon").getVisualization(function(tableView){
// Register custom cell renderer, the table will re-render automatically
tableView.addCellRenderer(new RangeMapIconRenderer());
});
mvc.Components.get("response_time_highlight_cell").getVisualization(function(tableView){
tableView.on("rendered", function() {
console.log("Table Rendered");
setTimeout(function(){
$("#response_time_highlight_cell tr").each(function() {
var strSLA=$(this).find("td:last").html();
if (strSLA!==undefined){
strSLA=strSLA.trim();
$(this).find("td:nth-child(3)").addClass("range-cell").addClass("range-"+strSLA);
}
});
},100);
});
});
mvc.Components.get("response_time_highlight_row").getVisualization(function(tableView) {
tableView.on('rendered', function() {
setTimeout(function(){
// Apply class of the cells to the parent row in order to color the whole row
tableView.$el.find('td.range-cell').each(function() {
$(this).parents('tr').addClass(this.className);
});
},100);
});
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
... View more
04-16-2019
02:15 AM
<search>
<query>index=_internal|stats count by name| eval "Total Count"=case('count'>2800,"severe_".'count','count'<2800 AND 'count'>=2000,"elevated_".'count',true(),"low_".'count')|fields - count,name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
My requirement is to display different bulbs based on count.It's working fine but i want to display bulbs horizontally.But output is showing something like this.i want to display bulbs side by side.How to do this?
... View more
04-09-2019
04:47 AM
Bulb Visualization Sample
<panel>
<html>
<style>
/* CSS for table response_time_highlight_icon
#response_time_highlight_icon tr{
width: 40px;
height: 40px;
float: left;
}*/
#response_time_highlight_icon td.icon img{
text-align: center;
width: 100px;
height: 100px;
}
#response_time_highlight_icon td.icon i {
font-size: 25px;
text-shadow: 1px 1px #aaa;
}
#response_time_highlight_icon td.icon .severe {
color: indianred;
}
#response_time_highlight_icon td.icon .elevated {
color: orange;
}
#response_time_highlight_icon td.icon .low {
color: #lightgreen ;
}
/* CSS for table response_time_highlight_cell */
#response_time_highlight_cell td.range-low {
background-color: lightgreen !important;
}
#response_time_highlight_cell td.range-elevated {
background-color: orange !important;
font-weight: bold;
}
#response_time_highlight_cell td.range-severe {
background-color: indianred !important;
font-weight: bold;
}
/* CSS for table response_time_highlight_row */
#response_time_highlight_row tr td {
background-color: lightgreen !important;
}
#response_time_highlight_row tr.range-elevated td {
background-color: orange !important;
}
#response_time_highlight_row tr.range-severe td {
background-color: indianred !important;
}
#response_time_highlight_row .table td {
border-top: 1px solid #fff;
}
</style>
<table id="response_time_highlight_icon">
<search>
<query>index=_internal|stats count by name| eval "Total Count"=case('count'>2800,"severe_".'count','count'<2800 AND 'count'>=2000,"elevated_".'count',true(),"low_".'count')|fields - count,name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
Java Script Code is:
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function(, $, mvc, TableView) {
// Translations from rangemap results to CSS class
var ICONS = {
severe: 'alert-circle',
elevated: 'alert',
low: 'check-circle'
};
var RangeMapIconRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Only use the cell renderer for the "Total Count" field
return cell.field === 'Total Count';
},
render: function($td, cell) {
var icon = 'check-circle';
// Fetch the icon for the value
var cellArray = cell.value.split("");
var cellValue = cellArray1;
var range = cellArray[0];
if (ICONS.hasOwnProperty(cellArray[0])) {
icon = ICONS[cellArray[0]];
}
// Create the icon element and add it to the table cell
/* $td.addClass('icon').html(.template(' <%- cellValue %> ', {
icon: icon,
range: cellArray[0],
cellValue:cellValue
}));
}
});
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for 'Total Count'
return _(['Total Count']).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var strSLA = cell.value;
if (strSLA!==undefined){
strSLA=strSLA.trim();
$td.addClass('range-cell').addClass("range-"+strSLA);
}
$td.text(strSLA).addClass('string');
}
});
mvc.Components.get("response_time_highlight_icon").getVisualization(function(tableView){
// Register custom cell renderer, the table will re-render automatically
tableView.addCellRenderer(new RangeMapIconRenderer());
});
mvc.Components.get("response_time_highlight_cell").getVisualization(function(tableView){
tableView.on("rendered", function() {
console.log("Table Rendered");
setTimeout(function(){
$("#response_time_highlight_cell tr").each(function() {
var strSLA=$(this).find("td:last").html();
if (strSLA!==undefined){
strSLA=strSLA.trim();
$(this).find("td:nth-child(3)").addClass("range-cell").addClass("range-"+strSLA);
}
});
},100);
});
});
mvc.Components.get("response_time_highlight_row").getVisualization(function(tableView) {
tableView.on('rendered', function() {
setTimeout(function(){
// Apply class of the cells to the parent row in order to color the whole row
tableView.$el.find('td.range-cell').each(function() {
$(this).parents('tr').addClass(this.className);
});
},100);
});
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
Output is showing like this,But i want to display horizontally.Bulbs should display sided by side.How to do this.
... View more
04-02-2019
05:21 AM
For example my query
index=_internal|stats count by name
it will display all count with the names. now i want to display different color bulbs based on count value for each individual item.
whenever i executed query above query by your example it is showing only one row,but i need to display all the names count with different bulb colors based on range.
Please help how to do this
... View more
04-01-2019
02:34 AM
I just want to display bulb(it should be dynamically changes color as per the percentage) instead of Gauge.
Red,Green,Orange colors.how to do this.
... View more
04-01-2019
01:08 AM
Hi,
I have a query which displays max percentages.i am displaying with default splunk provided radial gauge.But i want to display the same in with an image. i need to display in bulb(red,green,orange) as per the percentages defined,it automatically needs to change according to the percentages.(>80 green,<80 and >60 orange <60 red)
How to do this custom dashboard?
... View more
- Tags:
- splunk-enterprise
03-25-2019
01:58 AM
Hi,
index=os sourcetype=Service status=* (Group="Data" OR Group="Secur") AND (Section="Local" OR Section="data health") AND (Component="connectivity" OR Component=" care health")
| dedup _time| where Created_ON=Updated_ON
| eval days = (Now() - _time) /86400|eval days_ago = case(days>60, "2-3months",days< 60 AND days > 30, "1-2 months",days< 28 AND days > 14, "2-4 weeks",days< 14 AND days > 7, "1-2 weeks",days< 7 AND days > 5, "5-7days", days < 5 AND days > 2, "2-5 days", days < 2 AND days > 1, "2 Days", days < 1, "Less than 1 Day")
| eventstats latest(Group) as LatestGroup by Case | chart count by days_ago,LatestGroup | sort days_ago
I want to display the latest group name,but it is not displaying the latest group name.How to do this?
... View more
03-13-2019
07:42 AM
But my problem is whenever we write the condition eval is_resolved=if(assignment="Sustaining" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL).it is showing only one person name.i want to assign that case to all who worked on that case.
... View more
03-13-2019
07:11 AM
Could you please send me the final query.
... View more
03-13-2019
05:27 AM
Hi,
We have closed cases and escalated cases,in that single person can work on particular case as well as multiple persons worked on particular case.So my requirement is to display in bar chart how many cases resolved and escalated by person.
Ex: Case:1111 Worked persons: Raju,Ramu,rahul
Case:1112 Worked persons: Ramu,rahul
Case:1113 Worked persons: Raju
Case:1115 Worked persons: Ramu
So my chart should be
Raju count is 2
Ramu count is 2
rahul count is 1 like this
My Basic search is:
index="os" sourcetype="Service" CaseNumber=* status=* assignment_group=* |dedup _time,CaseNumber,assignment |streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup test.csv check as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment="Sustaining",1,NULL) |eval is_resolved=if(assignment="Sustaining" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL)|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" assigned_to,TeamName| fields - TeamName
I retrieved the names from comments using below search:
index="os" sourcetype="Service" CaseNumber=*|dedup _time,CaseNumber,status|rex field=Comments"(?\w*\W*\w*\s*\w*\s*\s\(\d+\))" |stats values(Names) as Names by CaseNumber|nomv Names|table CaseNumber,Names,status
So I want to display resolved and escalated cases by name.Please help how to do this.
... View more
- Tags:
- search
03-11-2019
12:26 AM
Hi,
With you query i am getting names who worked on that particular case.But My requirement is to display single person completed cases.
Ex: Case:1 name: raju
Case:2 name:raju,ramu,rakesh
Case:3 name:ramu,rakesh,rahul,raju
so the requirement is single peron completed cases.
Here raju only worked on one case.so raju count is 1
In multiple cases he involved: raju count is 2
index="os" sourcetype="Service" CaseNumber=* status=* assignment=* |dedup _time,CaseNumber,assignment|streamstats current=f last(assignment) as lg, last(active) as Active by CaseNumber|lookup L1Team.csv SSO as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment!=lg AND assignment_group="Sustaining",1,NULL) |eval is_resolved=if(assignment="Sustaining" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL)|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName| fields - TeamName
with this query iam getting only who closed this case.that number is assigned to that case.
i want to display like above what i explained.Please help how to do this
... View more
03-08-2019
06:43 AM
Hi,
index="os" sourcetype="test" CaseNumber=*| dedup _time,CaseNumber | rex field=Notes "(?\d+-\d+-\d+\s*\d+:\d+:\d+)\s*\-\s*(?\w*\W*\w*\s*\w*\s*\(\d+\))\s*"
The above query displays the lastupdated user. But I want to display all names from the comments
EX:
2019-03-07 11:48:12 - one (1234513241) (Case Notes (Comments Visible )) data in not loading
2019-03-07 12:48:12 - two (2345132421) (Case Notes (Comments Visible)) error occured
2019-03-06 14:48:12 - three (3451324143) (Case Notes (Comments Visible)) testing
2019-03-06 15:48:12 - one (5513241321) (Case Notes (Comments Visible)) case in progress
2019-03-06 17:48:12 - four (2416575443) (Case Notes (Comments Visible)) filter option
2019-03-06 18:48:12 - five (4154678765) (Case Notes (Comments Visible)) data loading
This is for one case. After date is names of the persons. So I want to display all names who commented for that case.
Ex:Casenumber is 1111
1111 one (1234513241) two (2345132421) three (3451324143) four (2416575443) five (4154678765) like this
How do I write the regular expression to do this?
... View more
03-05-2019
03:08 AM
Could you please send me the final query.i am little bit confused.
... View more
03-05-2019
02:26 AM
Hi,
index="osh" sourcetype="Service" CaseNumber=1111 status=* assignment_group=*
| dedup _time,CaseNumber,assignment_group
| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber
| lookup Team.csv SO as sys_updated_by OUTPUT TeamName
| eval is_escalated= if(assignment_group!=lg AND assignment_group="OSM L1",1,NULL)
| eval is_resolved=if(assignment_group="OSM L1" AND status="Complete" AND (isnull(Active) OR Active="true"),1,NULL)
| stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by sys_updated_by,TeamName
| fields - TeamName
when i run this query it is displaying like that(attached image).
For that case number(1111) 2 members worked.so this case resolved case so the output should be 1 for two members.
if it is escalated cases then in escalated cases i should should assign 1.
How to do this?
... View more
- Tags:
- splunk-enterprise
03-04-2019
04:10 AM
Hi,
index="os" sourcetype="Service" CaseNumber=* status=* assignment_group=* |dedup _time,CaseNumber,assignment_group |streamstats current=f last(assignment_group) as lg, last(active) as Active,first(assigned_to) as fs,last(assigned_to) as ls by CaseNumber|lookup Team.csv test as assigned_to OUTPUT TeamName| eval is_escalated= if(assignment_group!=lg AND assignment_group="Support L1",1,NULL) |eval is_resolved=if(assignment_group="Support L1" AND status="Complete" AND (isnull(Active) OR Active="true") AND fs=ls,1,NULL)|stats count(is_escalated) AS "Escalated Cases" count(is_resolved) AS "Resolved Cases" by assigned_to,TeamName| fields - TeamName
The above query display the person wise resolved and escalated count.The persons names we are reading from Team.csv file.
1)Now i want to display count of only one person resolved entire case(from first to last means first(assigned_to)=last(assigned_to).
2)Now i want to display persons who is involved in that case while resolving partcular case.
EX:Case No :1111,assigned_to: ramesh,raju,ramu.
So three members worked for this case.so this case should comes under all three.
3)Two steps same for Escalated cases as well.
How to do this?
... View more
02-28-2019
07:10 AM
for less than one day it is displaying other date created data also.means it is displaying the with the Updated_ON field.If Created_ON=2019-02-26 Updated_ON=2019-02-26 today.but is displaying that CaseNumber as well.
Note:Group is changed 2019-02-26 this date only
... View more
02-28-2019
06:46 AM
Thank you Very much for your help.
... View more
02-28-2019
06:14 AM
Could you please send me the final query.
... View more
02-28-2019
04:25 AM
Exactly i want to display the latest group as i added image you can see.
If it i s one group one color other one other color
... View more
02-28-2019
03:26 AM
Still it is displaying same One group.not displaying with latest Group.
... View more
02-28-2019
02:40 AM
Can you please send me the final query.i just deduped the _time.removed CaseNumber as well.but it is showing only one group.
... View more
02-28-2019
02:03 AM
Yes the data is like that only.
... View more
02-27-2019
07:04 AM
From my point of you Created_ON=Updated_ON is the problem,because this statement is used to find the created cases count.when it is checking the condition that time Group it is displaying.
Initially
Ex:Created_ON 2019-02-27 12:00:00
Updated_ON 2019-02-27 12:00:00
Group:Data/Config
Next Updated_ON:2019-02-27 14:30:00
Group:Secure
But it is displaying First Group only.i want current group
... View more
