About wang

wang · ‎10-31-2018

I tried this with the SID I got back from the response: https://SPLUNK_HOST/en-US/app/search/search?q=%7Cloadjob%201541017578.20031_E86B55B0-BB4E-4D2E-9BA0-23B22288B1CA And got this error: Error in 'SearchOperator:loadjob': The search artifact for job '1541017578.20031_E86B55B0-BB4E-4D2E-9BA0-23B22288B1CA' is not available because we cannot proxy an ad-hoc job in a searchhead cluster. Please run the search locally. What does this mean?

wang · ‎10-30-2018

I am using REST API search endpoints to invoke a search. When the search completes, I get a SID from the json response. I then create an email with the search result. In additional, I want to include a hyperlink in the email that will take me to splunk displaying the same result (with the same criteria including the time window). Can I use the SID to do this (as long as the SID hasn't expired)?

wang · ‎03-23-2018

I figured out how to correctly safe the original timestamps: <input type="time" token="time_range" searchWhenChanged="true"> <label></label> <default> <earliest>-5m</earliest> <latest>now</latest> </default> <change> <condition match="isnum($time_range.earliest$) OR isnum($time_range.latest$)"> <eval token="start_timestamp">$time_range.earliest$</eval> <eval token="end_timestamp">$time_range.latest$</eval> </condition> <condition> <eval token="start_timestamp">relative_time(now(), $earliest$)</eval> <eval token="end_timestamp">relative_time(now(), $latest$)</eval> </condition> </change> Then I can use the start_timestamp and end_timestamp in my delayed search.

wang · ‎03-23-2018

Implemented Option 2 and it works well! One minor issue is that if the time picker window is relative like -10m (last 10 mins) and the checkbox for the hidden panel/searche is clicked 5 mins after the initial display for the dashboard, the time window for the hidden search is different from the original time, i.e. deplayed by 5 mins. How can I capture the time window when the main dashboard is displayed and use that for the hidden search? I tried saving infomintime and infomaxtime in variables: | eval starttimestamp = infomintime | eval endtimestamp = infomaxtime and reuse them in the hidden search by setting earliest and latest but it's not working. How do I pass the original time stamp to the delayed search?

wang · ‎03-22-2018

I am building a dashboard that has multiple panels and some searches are slow. So I added an input checkbox to control whether to show/hide the slow panels and added the "depends" attribute in the slow panels. While the display is correctly show/hide the slow panels, my question is does the "depends" attribute also prevents the slow search to be executed? What I really want is to NOT have the slow search to be execute at all if the checkbox is not checked. When I toggle the checkbox, the slow panels are shown immediately (i.e. not waiting for search results) so it appears that while the slow panels are NOT displayed by default, the associated searches are still being executed "behind the scene" by default. Is there anyway to NOT execute the slow query until selected?

wang · ‎04-08-2015

Close but not quite. Adding eval fixed the formatting but sorting now sorts count as strings, not numeric values.

wang · ‎04-07-2015

I have a stats command that correctly formats the count field. stats count by method client | fieldformat count=tostring(count,"commas") However, when I add | xyseries method client count , I lose the nice formatting. I try to rearrange the fieldformat clause to the end, but that didn't help. I get no formatting at all with the numbers. I might as well just use chart count over . The reason I use stats with xyseries is that I thought I can format the numbers this way.

wang · ‎04-07-2015

Worked perfectly. Thanks for the quick reply.

wang · ‎04-07-2015

Let say I have a chart that reports the count of what user has purchased what item. I can create a nice table using chart count over item by user. ===== UserA === UserB === UserC Item X ====1 =======2 ======= 1 Item Y ==== 2 ====== 3 ======= 5 Now I want each row to report not the count, but the percentage, on a per row basis ====UserA UserB UserC Item X 25% 50% 25% Item Y 20% 30% 50% So essentially, I want to chart percentage over over item by user. How do I do that?

wang · ‎09-30-2014

Got it: req="v/documents/" | rex field=req mode=sed "s/[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}//g" | stats count by req

wang · ‎09-30-2014

In my logs, I have a variable req that contains a REST request which includes an UUID. How do I remove the UUID so that stats count by req will ignore the UUID? req="v/documents/" | stats count by req v2/documents/0003cfad-c6ce-46f1-b617-9efd95d79b52 v2/documents/0003cfad-c6ce-46f1-b617-9efd95d79b52/status v2/documents/004083f4-467e-4d25-9d71-baf7087acb2b v2/documents/004083f4-467e-4d25-9d71-baf7087acb2b/status v2/documents/0063891d-6822-493e-a650-31cc57989310/create v2/documents/00ee9bb9-e21b-44c7-b437-d0c7dd1057f8 v2/documents/00ee9bb9-e21b-44c7-b437-d0c7dd1057f8/status v2/documents/00fcce48-1768-4e89-a58b-e699be061ae4/delete

wang · ‎04-23-2013

I want to get a list of ip and then feed that list into 3 subsequent searches that will each produce a count by column and end up with a table like: ip countA countB countC 1st search: index=test source=ip-log ip | table ip | sort ip 2nd search: index=test source=logA *ip-list-from-1st-search* patternA | stats count as countA by ip 3rd search: index=test source=logB *ip-list-from-1st-search* patternB | stats count as countB by ip 4th search: index=test source=logC *ip-list-from-1st-search* patternC | stats count as countC by ip I can combine the 1st and 2nd search with subsearch and produce a table ip, countA. But I don't know how to chain in the 3rd and 4th searches since their events only have ip but not countA. I've also played with appendcols but the problem there is I have to re-execute the 1st search for every appendcols subsearch. So how do I pass the result of the 1st search into 3 subsequent independent searches and stitch the columns into one table?

wang · ‎04-22-2013

I have a list of IPs that I'd like to use as input to a saved search. Instead of manually typing (ip=x OR ip=y OR ip=z), if I have a csv file on my local drive with a single column of IPs, is there a way for the saved search to dynamically import the IPs? I've look at inputcsv but that seems to expect the csv to reside on the server. I want to pull the csv from my local disk, or write a form that prompts for the location of the csv on my local disk.

wang · ‎04-16-2013

Thanks. Didn't know about the "default" param. I thought setting "selected" to True would do it.

wang · ‎04-13-2013

Via the UI, in the view for flashtimelineI added values to pageControls for results and set the default to 50. While the new values do show up in the dropdown, I have searches (not all) that will come back and display the default of 10, eventhough there is no value 10 in the dropdown menu and I set the default to 50. Is this a bug? Is there another setting I need to adjust to default search to 50? <module name="Count" layoutPanel="pageControls"> <param name="options"> <list> <param name="text">50</param> <param name="selected">True</param> <param name="value">50</param> </list> <list> <param name="text">100</param> <param name="value">100</param> </list> <list> <param name="text">500</param> <param name="value">500</param> </list> <list> <param name="text">1000</param> <param name="value">1000</param> </list> </param>

wang · ‎01-31-2013

I have a saved search that uses "stats count by xyz" which produces a simple table search result. Is there any way I can add a legend or text block to the search result to clarify the column names? I want to add text that says "response time is in milliseconds and throughput is requests/second".

wang · ‎01-08-2013

I have stats output some numbers like min, max, avg. The numbers are left justifed and make it really hard to read. Is there a simple way to make the numbers right justified without using CSS? Less desirable would be pad with leading zeros. Is that possible?

wang · ‎07-26-2012

Thanks. The regex works great!

wang · ‎07-25-2012

I have a timechart that plots response time by source: index=myidx duration | timechart avg(duration) by source Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path? I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source.

wang · ‎04-07-2011

Does drilldown work with IE 6? I have a lot of trouble with drill down in IE which does not happen in FF. Problems include no matching event (when FF found them) and can't do show source when an event is found. I’ve capture the URLs in this example. IE returns nothing when FF found 1 event. Event: 2011-04-05 16:30:34,971 WARN [status.driver:ajp-0.0.0.0-8009-92] - filer=***5284 authCode= year=2009 app=null test=false. Using 'NA' for authCode Splunk Query: index=myindex host="myhost*" " WARN [" | rex "(?i)[\d\s\w]+\[(?P[^\]:]+)" | search LOG_SOURCE="status.driver" IE: https://mySplunkServer/en-US/app/search/flashtimeline?q=search%20index%3Dmyindex%20host%3D%22myhost*%22%20%22%20WARN%20%20%5B%22%20%7C%20rex%20%22(%3Fi)%5B%5C%5Cd%5C%5Cs%5C%5Cw%5D%2B%5C%5C%5B(%3FP%3CLOG_SOURCE%3E%5B%5E%5C%5C%5D%3A%5D%2B)%22%20%7C%20search%20LOG_SOURCE%3D%22status.driver%22&earliest=1302045780&latest=1302049433 Firefox: https://mySplunkServer/en-US/app/search/flashtimeline?q=search%20index%3Dmyindex%20host%3D%22myhost*%22%20%22%20WARN%20%20[%22%20|%20rex%20%22%28%3Fi%29[\d\s\w]%2B\[%28%3FP%3CLOG_SOURCE%3E[^\]%3A]%2B%29%22%20|%20search%20LOG_SOURCE%3D%22status.driver%22&earliest=1302045780&latest=1302049433

Posts	32
Solutions	1
Karma Given	0
Karma Received	5
Member Since	‎11-08-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: How to construct hyperlink from sid

How to construct hyperlink from sid

Re: Dashboard panels with depends attribute still ...

Re: Dashboard panels with depends attribute still ...

Dashboard panels with depends attribute still exec...

Re: How do I prevent losing the nice formatting of...

How do I prevent losing the nice formatting of fie...

Re: chart percentage over over item by user

chart percentage over over item by user

Re: How to write regex to filter out UUID before s...

How to write regex to filter out UUID before stats...

Feed result from one search into multiple subseque...

Input from csv from my local drive

Re: Setting default pageControls for results

Setting default pageControls for results

Can I add legend to search results?

stats right justify numbers

Re: Timechart by source with only basename of sour...

Timechart by source with only basename of source

Is drilldown supported in IE 6?