Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About luna23
luna23
Explorer
Member since:
03-15-2016
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 03-15-2016 |
Activity Feed
- Karma Re: Single panel with multiple values for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Show a result even if no events match for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Compare field from 2 sources and return when source1 has no match in source2 for lguinn2. 06-05-2020 12:46 AM
- Karma Re: erex not working in splunk 6 for triest. 06-05-2020 12:46 AM
- Posted Re: How to get two custom visualizations in the same dashboard? on Dashboards & Visualizations. 05-23-2017 08:35 AM
- Posted How to get two custom visualizations in the same dashboard? on Dashboards & Visualizations. 05-22-2017 02:16 PM
- Tagged How to get two custom visualizations in the same dashboard? on Dashboards & Visualizations. 05-22-2017 02:16 PM
- Tagged How to get two custom visualizations in the same dashboard? on Dashboards & Visualizations. 05-22-2017 02:16 PM
- Tagged How to get two custom visualizations in the same dashboard? on Dashboards & Visualizations. 05-22-2017 02:16 PM
- Posted Re: Why is the Status Indicator - Custom Visualization app not loading? on All Apps and Add-ons. 04-04-2017 06:28 AM
- Posted Re: Failed to load source for Punchcard visualization. on All Apps and Add-ons. 02-03-2017 07:12 AM
- Posted Re: Failed to load source for Punchcard visualization. on All Apps and Add-ons. 02-02-2017 11:17 AM
- Posted Re: Why is the Status Indicator - Custom Visualization app not loading? on All Apps and Add-ons. 02-02-2017 11:17 AM
- Posted Re: SPLUNK Tableau no data on Getting Data In. 10-12-2016 02:31 PM
- Posted Re: How to overlap two bars in a Splunk chart? on Splunk Search. 07-21-2016 07:18 AM
- Posted Re: How to overlap two bars in a Splunk chart? on Splunk Search. 07-21-2016 07:10 AM
- Posted Re: How to overlap two bars in a Splunk chart? on Splunk Search. 07-21-2016 06:08 AM
- Posted How to overlap two bars in a Splunk chart? on Splunk Search. 07-19-2016 03:27 PM
- Tagged How to overlap two bars in a Splunk chart? on Splunk Search. 07-19-2016 03:27 PM
- Tagged How to overlap two bars in a Splunk chart? on Splunk Search. 07-19-2016 03:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-23-2017
08:35 AM
I find a solution , but i still not understanding why it works.
I changed the paths for the data-required in both charts
<div id="bubblechart" class="splunk-view" data-require="app/search/components/bubblechart/bubblechart"......
<div id="dendrogram" class="splunk-view" data-require="app/custom_vizs/components/dendrogram/dendrogram"
<form script="autodiscover.js">
<label>2 classes</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" searchWhenChanged="true">
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="term" id="input_term"/>
<input type="text" token="category" id="input_category"/>
</fieldset>
<row>
<panel>
<html>
<h2>Top 30 Most Common Terms in an Ad-hoc Search Query (drilldown)</h2>
<div id="bubblechart_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
"preview": true,
"search": "index=_audit NOT REST: search=* | regex search_id=\"'\\d+\\.\\d+'\" | rex field=search max_match=0 \"(?<terms>\\w+)\" | eval terms=mvdedup(terms) | top limit=30 terms | lookup search_commands.csv search_command AS terms OUTPUT search_command | eval type=case(isnum(terms), \"number\", isnotnull(search_command), \"command\", 1=1, \"word\") | eval terms=if(isnum(terms), \"\\\"\"+terms+\"\\\"\", terms)",
"earliest_time": {
"type": "token_safe",
"value": "$$earliest$$"
},
"latest_time": {
"type": "token_safe",
"value": "$$latest$$"
}
}'>
</div>
<div id="bubblechart" class="splunk-view" data-require="app/search/components/bubblechart/bubblechart" data-options='{
"managerid": "bubblechart_search",
"nameField": "terms",
"valueField": "count",
"categoryField": "type",
"height": 600
}'>
</div>
</html>
</panel>
</row>
<row>
<panel>
<chart id="timechart" depends="$term$">
<title>Term: $term$ - Type: $category$</title>
<search>
<query>index=_audit NOT REST: "$term$" search=* | regex search_id="'\\d+\\.\\d+'" | rex field=search max_match=0 "(?<terms>\w+)" | search terms="$term$" | timechart count</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Bubble Chart Search Results</title>
<search base="bubblechart_search"/>
</table>
</panel>
</row>
<row>
<panel>
<html>
<h2>All Splunk Internal Events by Index Sourcetype and Source</h2>
<div id="dendrogram_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
"search": {
"type": "token_safe",
"value": "| tstats count where index=_* by index sourcetype source"
},
"preview": true,
"earliest_time": {
"type": "token_safe",
"value": "$$earliest$$"
},
"latest_time": {
"type": "token_safe",
"value": "$$latest$$"
}
}'>
</div>
<div id="dendrogram" class="splunk-view" data-require="app/custom_vizs/components/dendrogram/dendrogram" data-options='{
"managerid": "dendrogram_search",
"root_label": "Index",
"margin_left": 200,
"margin_right": 0
}'>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Dendrogram Search Results</title>
<search base="dendrogram_search"/>
</table>
</panel>
</row>
</form>
... View more
05-22-2017
02:16 PM
Hi i'm trying to get two custom visualizations in one single dashboard, but there seems to be a problem to load the two html elements using the same splunk_view class.
<form script="custom_vizs:autodiscover.js, custom_vizs:viz_bubblechart.js">
<label>2 classes</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" searchWhenChanged="true">
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="term" id="input_term"/>
<input type="text" token="category" id="input_category"/>
</fieldset>
<row>
<panel>
<html>
<h2>Top 30 Most Common Terms in an Ad-hoc Search Query (drilldown)</h2>
<div id="bubblechart_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
"preview": true,
"search": "index=_audit NOT REST: search=* | regex search_id=\"'\\d+\\.\\d+'\" | rex field=search max_match=0 \"(?<terms>\\w+)\" | eval terms=mvdedup(terms) | top limit=30 terms | lookup search_commands.csv search_command AS terms OUTPUT search_command | eval type=case(isnum(terms), \"number\", isnotnull(search_command), \"command\", 1=1, \"word\") | eval terms=if(isnum(terms), \"\\\"\"+terms+\"\\\"\", terms)",
"earliest_time": {
"type": "token_safe",
"value": "$$earliest$$"
},
"latest_time": {
"type": "token_safe",
"value": "$$latest$$"
}
}'>
</div>
<div id="bubblechart" class="splunk-view" data-require="app/custom_vizs/components/bubblechart/bubblechart" data-options='{
"managerid": "bubblechart_search",
"nameField": "terms",
"valueField": "count",
"categoryField": "type",
"height": 600
}'>
</div>
</html>
</panel>
</row>
<row>
<panel>
<chart id="timechart" depends="$term$">
<title>Term: $term$ - Type: $category$</title>
<search>
<query>index=_audit NOT REST: "$term$" search=* | regex search_id="'\\d+\\.\\d+'" | rex field=search max_match=0 "(?<terms>\w+)" | search terms="$term$" | timechart count</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Bubble Chart Search Results</title>
<search base="bubblechart_search"/>
</table>
</panel>
</row>
<row>
<panel>
<html>
<h2>All Splunk Internal Events by Index Sourcetype and Source</h2>
<div id="dendrogram_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
"search": {
"type": "token_safe",
"value": "| tstats count where index=_* by index sourcetype source"
},
"preview": true,
"earliest_time": {
"type": "token_safe",
"value": "$$earliest$$"
},
"latest_time": {
"type": "token_safe",
"value": "$$latest$$"
}
}'>
</div>
<div id="dendrogram" class="splunk-view" data-require="app/custom_vizs/components/dendrogram/dendrogram" data-options='{
"managerid": "dendrogram_search",
"root_label": "Index",
"margin_left": 200,
"margin_right": 0
}'>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Dendrogram Search Results</title>
<search base="dendrogram_search"/>
</table>
</panel>
</row>
</form>
... View more
04-04-2017
06:28 AM
I was working in windows 10 and google chrome, but i tried it in mozilla and did not work either
... View more
02-03-2017
07:12 AM
i tried it, but in total are like 15 status indicators some of them worked but the others did not.
... View more
02-02-2017
11:17 AM
Hi i have the same problem.
i just changed for the 1.0.0 version but still does not working.
My Splunk version is 6.5.1
... View more
02-02-2017
11:17 AM
Hi i have the same problem.
i just changed for the 1.0.0 version but still does not working.
My Splunk version is 6.5.1
... View more
10-12-2016
02:31 PM
I have the same problem with Tableau 10.
The connexion is working but there is not data at all
... View more
07-21-2016
07:10 AM
Thanks DMohn,as you said it, the calculations will be wrong, although the chart will look good.
But what i am trying to do here is a market basket analisys, so i need to show the correct times a product has been purchased (TotalEvents) and the times a product has been purchased with other product (TotalMatch)
... View more
07-21-2016
06:08 AM
I already tried the area chart and it does overlap, but i want the same result in a bar chart
... View more
07-19-2016
03:27 PM
I have this search that counts the times a product has been purchased and the times the same product has been purchased with some other product, in this case product m.
I want to overlap the TotalEvents upon the TotalMatchs, but the option of stacked bars is just adding up the 2 fields.
Can someone help me please?
index=main sourcetype=csv source="reglas2.csv" Productos!=m [ search index=main sourcetype=csv source="reglas2.csv" Productos!=m [search index=main sourcetype=csv source="reglas2.csv" Productos=m | fields Id_Transaccion] | fields Productos ] | stats count as TotalEvents by Productos | appendcols [search index=main sourcetype=csv source="reglas2.csv" Productos!=m [search index=main sourcetype=csv source="reglas2.csv" Productos=m | fields Id_Transaccion] | stats count as TotalMatch by Productos]|table Productos TotalMatch TotalEvents
... View more
