I have a lookup.csv with all the public holidays in Singapore. I am trying to query if _time=datefield(meaning if today is a public holiday), SLA_DEADLINE +86400(deadline extend by 1 day). I added a row called test and datefield is today, so by right, if _time =test, it should extend the deadline by 1 day. This is my code: | eval today = strftime(_time,"%Y-%m-%d") | lookup public_holiday.csv Public_Holiday output datefield | rename datefield TO public_holiday | eval SLA_DEADLINE = case((public_holiday==today),SLA_DEADLINE+86400,true(),SLA_DEADLINE) But it isn't extending by 1 day, can anyone help me? ... View more

I have a support ticket system where people can submit their support tickets. The system is running 24 hours but the workers only work from 8am to 8pm,Monday to Friday. I have a create_time field which is when the ticket is created. So if a ticket is created on Monday 9pm, the create_time should be Monday 8am. If the ticket is created on Saturday, it should start on Monday instead. Secondly, I have a SLA where Level 1 is 4 hours, level 2 is 8 hours. SLA refers to how long the support ticket must take to be solved. So if a support ticket of Level 1(4 hours) is raised on Monday, 7pm, the workers can only take 1 hour because they leave work at 8pm, and Tuesday 8am continue working on it, which means that the deadline should be Tuesday 11am. How do i do that? This is my current script which is already able to skip weekends index="test" sourcetype="incident_all_v3" | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") | eventstats max(check) as checktime | where checktime = check | dedup 1 ticket_id sortby -_time | join ticket_id type=left [ search index="test" sourcetype="incident_assigned" | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") | eventstats max(check) as checktime | where checktime = check | eval move_datetime = strptime(move_datetime, "%Y-%m-%d %H:%M:%S") | dedup 1 ticket_id sortby -move_datetime | eval move_datetime = strftime(move_datetime, "%Y-%m-%d %H:%M:%S") | fields ticket_id move_datetime] | eval realtime = if(isnotnull(move_datetime), move_datetime, create_time) | eval create_time_epoch = strptime(realtime, "%Y-%m-%d %H:%M:%S") | lookup app_name.csv queue_name output vendor, app_name | search vendor = "Company" AND ticket_type = "Incident" AND app_name = "*" | eval diff_seconds = now() - create_time_epoch | eval diff_days = diff_seconds / 86400 | eval status = if (ticket_state="Closed" OR ticket_state="Completed" OR ticket_state="For Verification" OR ticket_state="Verified", "resolved" , "unresolved") | where status = "unresolved" AND ticket_type = "Incident" | eval SEVERITY = case ( SLA == "SLA Level 1", "1", SLA == "SLA Level 2", "2", SLA == "SLA Level 3", "3", SLA == "SLA Level 4", "4") | eval SEVERITY = "Sev ".SEVERITY | lookup sev_target.csv SEVERITY output TARGET | eval SLA_DEADLINE = case(SEVERITY = "Sev 4", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 3", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 2", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 1", create_time_epoch + (TARGET*3600)) | eval day_of_week= strftime(create_time_epoch, "%A") | eval sum= case( (day_of_week=="Tuesday" OR day_of_week== "Sunday"), 86400, 1=1, 172800) | eval SLA_DEADLINE = if(SEVERITY = "Sev 4", SLA_DEADLINE + sum , SLA_DEADLINE) | eval SLA_DEADLINE = if(SEVERITY = "Sev 3", SLA_DEADLINE + sum , SLA_DEADLINE) | eval SLA_DEADLINE = if(SEVERITY = "Sev 2", SLA_DEADLINE + sum , SLA_DEADLINE) | eval SLA_DEADLINE = if(SEVERITY = "Sev 1", SLA_DEADLINE + sum , SLA_DEADLINE) | eval SLA_DEADLINE = strftime(SLA_DEADLINE,"%Y-%m-%d %H:%M:%S") | table * ... View more

I have a bar graph with 3 fields labelled Memory, CPU and Disk Space. When there is no Memory value, only CPU and Disk space will show. However, the size of the bar will become fatter as less fields are being shown. Take for example: It only shows disk space and CPU vs where there is only one field and the size of the bar is bigger. How do i make it so its the same size no matter how many fields? This is the code for the graph: <option name="charting.chart">bar</option> <option name="charting.chart.barSpacing">10</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"Green":#8BC647 , "Available":#A9A9A9, "Amber":#FCB54E, "Red":#EE2E55}</option> <option name="charting.legend.placement">bottom</option> <option name="height">350</option> <option name="refresh.display">progressbar</option> ... View more

I am doing a support ticket with 4 levels of severity. Level 1 expects the ticket to be resolved in 4 hours Level 2 expects the ticket to be resolved in 8 hours. Level 3 expects the ticket to be resolved in 72 hours aka 3 days. Level 4 expects the ticket to be resolved in 120 hours aka 5 days. So when a ticket is raised on a Thursday with level 4 severity, it should be expected to be solved by Next Wednesday. However, my code now included Saturday and Sunday into the calculation, resulting it to be resolved by next Monday instead How do i exclude Saturday and Sunday out when calculating the expected time? index="test" sourcetype="incident_all_v3" | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") | eventstats max(check) as checktime | where checktime = check | dedup 1 ticket_id sortby -_time | join ticket_id type=left [ search index="test" sourcetype="incident_assigned" | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") | eventstats max(check) as checktime | where checktime = check | eval move_datetime = strptime(move_datetime, "%Y-%m-%d %H:%M:%S") | dedup 1 ticket_id sortby -move_datetime | eval move_datetime = strftime(move_datetime, "%Y-%m-%d %H:%M:%S") | fields ticket_id move_datetime] | eval realtime = if(isnotnull(move_datetime), move_datetime, create_time) | eval create_time_epoch = strptime(realtime, "%Y-%m-%d %H:%M:%S") | lookup app_name.csv queue_name output vendor, app_name | search vendor = "Company" AND ticket_type = "Incident" AND app_name = "*" | eval diff_seconds = now() - create_time_epoch | eval diff_days = diff_seconds / 86400 | eval status = if (ticket_state="Closed" OR ticket_state="Completed" OR ticket_state="For Verification" OR ticket_state="Verified", "resolved" , "unresolved") | where status = "unresolved" AND ticket_type = "Incident" | eval SEVERITY = case ( SLA == "SLA Level 1", "1", SLA == "SLA Level 2", "2", SLA == "SLA Level 3", "3", SLA == "SLA Level 4", "4") | eval SEVERITY = "Sev ".SEVERITY | lookup sev_target.csv SEVERITY output TARGET | eval SLA_DEADLINE = case(SEVERITY = "Sev 4", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 3", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 2", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 1", create_time_epoch + (TARGET*3600)) | eval SLA_DEADLINE = strftime(SLA_DEADLINE,"%Y-%m-%d %H:%M:%S") | table * So for this picture, on 2019-01-18(Friday), the Severity is level 4 and the Deadline is 2019-01-23, which is not what i wanted because it included saturday and sunday inside. It should be 2019-01-25 instead. ... View more

I am creating a support ticket for my project. When a ticket is raised, it has 4 levels of severity(how long to solve the issue). Sev 1 will have a 4 hour period, sev 2 = 8 hours, sev 3 = 72 hours and sev 4 = 120 hours. I am referencing from this post: https://answers.splunk.com/answers/69820/search-to-only-include-business-hours-and-exclude-weekends.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev but where do i input the "date_wday!="saturday" AND date_wday!="sunday" | eval myHour=strftime(_time, "%H") | where ( myHour <= 18 AND myHour > 5 )" into my codes? This is my code for the project: index="test" sourcetype="incident_all_v3" | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") | eventstats max(check) as checktime | where checktime = check | dedup 1 ticket_id sortby -_time | join ticket_id type=left [ search index="test" sourcetype="incident_assigned_ams" | eval check = strptime(strftime(_time , "%d/%m/%Y") , "%d/%m/%Y") | eventstats max(check) as checktime | where checktime = check | eval move_datetime = strptime(move_datetime, "%Y-%m-%d %H:%M:%S") | dedup 1 ticket_id sortby -move_datetime | eval move_datetime = strftime(move_datetime, "%Y-%m-%d %H:%M:%S") | fields ticket_id move_datetime] | eval realtime = if(isnotnull(move_datetime), move_datetime, create_time) | eval create_time_epoch = strptime(realtime, "%Y-%m-%d %H:%M:%S") | lookup inc_app_name.csv queue_name output vendor, app_name | search vendor = "Company" AND ticket_type = "Incident" AND app_name = "*" | eval diff_seconds = now() - create_time_epoch | eval diff_days = diff_seconds / 86400 | eval status = if (ticket_state="Closed" OR ticket_state="Completed" OR ticket_state="For Verification" OR ticket_state="Verified", "resolved" , "unresolved") | where status = "unresolved" AND ticket_type = "Incident" | eval SEVERITY = case ( SLA == "SLA Level 1", "1", SLA == "SLA Level 2", "2", SLA == "SLA Level 3", "3", SLA == "SLA Level 4", "4") | eval SEVERITY = "Sev ".SEVERITY | lookup sev_target.csv SEVERITY output TARGET | eval SLA_DEADLINE = case(SEVERITY = "Sev 4", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 3", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 2", create_time_epoch + (TARGET*3600), SEVERITY = "Sev 1", create_time_epoch + (TARGET*3600)) | where SLA_DEADLINE <= relative_time(strptime(strftime(now(),"%d/%m/%Y"),"%d/%m/%Y") , "+4d") AND SLA_DEADLINE >= strptime(strftime(now(),"%d/%m/%Y"), "%d/%m/%Y") | append [| stats count | fields - count | eval SLA_DEADLINE=strptime(strftime(now(),"%d/%m/%Y"),"%d/%m/%Y") ] | append [| stats count | fields - count | eval SLA_DEADLINE=relative_time(strptime(strftime(now(),"%d/%m/%Y"),"%d/%m/%Y") , "+1d") ] | append [| stats count | fields - count | eval SLA_DEADLINE=relative_time(strptime(strftime(now(),"%d/%m/%Y"),"%d/%m/%Y") , "+2d") ] | append [| stats count | fields - count | eval SLA_DEADLINE=relative_time(strptime(strftime(now(),"%d/%m/%Y"),"%d/%m/%Y") , "+3d") ] | eval SLA_DEADLINE = strftime(SLA_DEADLINE,"%d/%m/%Y") | stats count, avg(diff_days) as avg by SLA_DEADLINE | eval count=count-1 | eval average = round(avg,2)." Days" | eventstats sum(count) as total | eval perc = round(count*100/total,2)."%" | eval perc = count." (".perc.")" | table SLA_DEADLINE, average, perc | sort -perc | sort SLA_DEADLINE | rename SLA_DEADLINE as "Incident SLA Deadline", average as "Avg Duration", perc as "Count (Percentage)" Right now, it is 24 hours, 7 days a week. How do i make it to 5 days a week and business hours(8am to 8pm)? If a ticket is raised on friday 10am with SLA 3, it should be solved by Wednesday 10am. ... View more

I have 3 rows with 3 panels in each row. If the 1st panel has no data, the row will hide itself. I have another row on top of the 3 rows displaying the title of the 3 rows. So if all the 3 rows are hidden, I would like to hide the row with the title. In Splunk, can I use depends="$row1$,$row2$,$row3$" ? <row depends="$hide_row1$,$hide_row2$,$hide_row3$"> <panel id="header_2"> <html> <div class="container-header"> <!--<header class="left-header">MAJORS</header>--> <div>2. INFRASTRUCTURE MONITORING</div> </div> </html> </panel> </row> <row depends="$hide_row1$"> <panel> <title>APPLICATION SERVER</title> <table id="appServer"> <search> <query></query> <earliest>-180m@m</earliest> <latest>now</latest> <progress> <condition match="'job.resultCount' == 0"> <unset token="hide_row1"></unset> </condition> <condition> <set token="hide_row1">true</set> </condition> </progress> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="Server Name"> <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette> </format> <format type="color" field="Disk Space"> <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette> </format> <format type="color" field="Memory"> <colorPalette type="map">{"OK":#FFFFFF}</colorPalette> </format> <format type="color" field="CPU"> <colorPalette type="map">{"OK":#FFFFFF}</colorPalette> </format> </table> </panel> $hide_row2$ and $hide_row3$ are about the same as the panel in $hide_row1$. Apparently, the problem is even if row 2 is not hidden, the header is hidden as well. ... View more