Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Javip
Javip
Path Finder
Member since:
01-27-2015
06-05-2020
Community Statistics
| Posts | 39 |
| Solutions | 6 |
| Karma Given | 37 |
| Karma Received | 8 |
| Member Since | 01-27-2015 |
Activity Feed
- Got Karma for Re: Add to a dynamic dropdown. 08-20-2020 09:18 AM
- Karma Re: How to allow dashboard users to turn off auto-refresh? for paramagurukarth. 06-05-2020 12:49 AM
- Karma Re: Have you tested this app in Splunk Cloud? for afroz. 06-05-2020 12:49 AM
- Karma Re: How to change the default bar graph colors in a dashboard panel? for niketn. 06-05-2020 12:49 AM
- Karma Re: CEF logs parsing for Enterprise Security for dshpritz. 06-05-2020 12:49 AM
- Karma SUGGESTION: test and Translate CRONTAB in alert for rsennett_splunk. 06-05-2020 12:49 AM
- Karma Re: How can I set an alert for max thruput? for gjanders. 06-05-2020 12:49 AM
- Karma Re: Keywords and Field name restrictions. for gcusello. 06-05-2020 12:49 AM
- Karma Re: Global map bubble size for jiaqya. 06-05-2020 12:49 AM
- Karma Re: Merge Data from two indexes without using Join for DalJeanis. 06-05-2020 12:49 AM
- Got Karma for Re: How to set up Splunk alert for changing logs?. 06-05-2020 12:49 AM
- Got Karma for Re: How to set up Splunk alert for changing logs?. 06-05-2020 12:49 AM
- Got Karma for Re: How to change the default bar graph colors in a dashboard panel?. 06-05-2020 12:49 AM
- Karma Re: After creating a custom visualization, why am I getting error "Failed to load source for Radial Meter visualization" in Splunk Web? for timpopxpop. 06-05-2020 12:48 AM
- Karma Re: When is the expected release of Splunk 6.5.1? for ChrisG. 06-05-2020 12:48 AM
- Karma Re: What are best practices for handling data in a Splunk staging environment that needs to go to production? for Lucas_K. 06-05-2020 12:48 AM
- Karma Re: Is it possible to add a default value for a lookup without match? for s2_splunk. 06-05-2020 12:48 AM
- Karma Re: How to hide panels based on a search condition for MuS. 06-05-2020 12:48 AM
- Karma Re: How can I get the latitude and longitude range when I click on map markers and use those values for a drilldown to a panel in the same dashboard? for ziegfried. 06-05-2020 12:48 AM
- Karma Re: Is it possible to have the options for a checkbox input appear in a horizontal line instead of a vertical list? for jmallorquin. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 3 |
08-13-2018
02:45 AM
Thanks a lot for your answer!
Did you added this App to your Splunk Cloud or you added only macros and several saved searches?
... View more
06-01-2018
06:22 AM
@srujan0009 there could be multiple options to do this but depending on several things like:
1) What you want to do afterwards once you have the results from above table?
2) Are there always five values or can the number of results differ?
Please add more details for the community members to help.
Following are the three options I can think of:
1) Use Post Processing to reuse the search to initial further processing on existing results
2) Use the Search job Id (thorough addinfo command or $job.sid$ built in search job token) to load the job results using loadjob command and perform further actions on results
3) You can use transpose command to convert rows to column and fetch the default search job token for each result in the first row using <done> or <progress> search event handler through $result.fieldname$ token.
4) If you are on 6.6. or higher Trellis can be used to break up row level data to visualizations like Single Value, Gauges etc.
Following is a run anywhere example for Option 3 with transpose command which assumes there are only 5 rows in all the cases:
<dashboard>
<label>Token for each row value</label>
<!-- Dumy Search to perform transpose on original search for table-->
<search base="baseSearch">
<query>| transpose 5 header_field=Row
| rename "*" as "Field_*"
</query>
<done>
<set token="tokField1">$result.Field_1$</set>
<set token="tokField2">$result.Field_2$</set>
<set token="tokField3">$result.Field_3$</set>
<set token="tokField4">$result.Field_4$</set>
<set token="tokField5">$result.Field_5$</set>
</done>
</search>
<row>
<panel>
<table>
<search id="baseSearch">
<query>| makeresults
| fields - _time
| eval data="1 123;2 4567;3 5896;4 4573;5 3512"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval Row=mvindex(data,0), Count_by_values=mvindex(data,1)
| fields - data, _*
| table Row Count_by_values</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<html>
<div>
<ul>
<li>tokField1: $tokField1$</li>
<li>tokField2: $tokField2$</li>
<li>tokField3: $tokField3$</li>
<li>tokField4: $tokField4$</li>
<li>tokField5: $tokField5$</li>
</ul>
</div>
</html>
</panel>
</row>
</dashboard>
... View more
05-08-2018
04:02 AM
1 Karma
Hi niketnilay!
Finaly I used transpose command and it's works ok, thanks a lot for your idea!!
I use it like this:
... | transpose header_field=rango_desvio
<panel>
<title>Proyectos según % de desvío</title>
<chart>
<search>
<query>...| transpose header_field=rango_desvio</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"Verde (0-30)":0x57A639,"Amarillo (31-50)":0xFFFF00,"Naranja (51-70)":0xFFA420,"Rojo (71-100)":0xFE0000}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
And finally I can draw a panel like this:
Thanks!
... View more
04-18-2018
06:25 AM
yes, if necessary, you can have 2 HFs and you can send them balanced data from your UFs
... View more
04-19-2018
06:15 AM
Hi Javip,
i have modified query for this requirement
index=ABC host=ABC sourcetype=ABC "Success" OR "Failure"
| head 1
| eval event_time=_time, time_now=Now()
| eval diff=time_now-event_time
| where diff>=300 AND like(_raw, "%Failure%")
... View more
03-28-2018
05:18 AM
Thanks a lot for your answer!
The next week we'll go on testing this integration and if we have more doubts I'll tell you.
Thanks.
J.
... View more
03-28-2018
10:38 AM
Javi,
Unfortunately I don't have that app on my system and I am not able to install until further notice. I will try it as soon as I can and will let you know.
Thanks!
... View more
09-21-2017
06:03 AM
<![CDATA[$click.value|n$]]>
I found this now as a solution.
Thanks for your help!
... View more
09-21-2017
06:43 AM
Yes, I was right, it was a problem with our update frecuency. I've increased all the updates to every 15 minutes or so and we don't have errors and we are not losing events anymore.
Thanks!
... View more
05-24-2017
03:19 AM
Hi again,
I've been trying to represent percents (values between 0 and 100) and I have the same strange behaviour...
What do you think about this? Every radar chart have a different strange scale...
Thanks again for your comments!
J.
... View more
09-06-2017
03:41 AM
We use that option in almost all of our dashboards, but when Splunk autorefresh (due to this parameter) we cannot analyze this action with a query like:
index=_internal sourcetype=splunkd_ui_access uri_path=/app/ user!="-" AppName= ViewName= ViewName!=contents ViewName!=search .......
We can monitor user navigation between dashboads, but nt refresh when they stay in a dashboard...
Any ideas to monitor these autorefresh actions?
Thanks a lot in advance.
... View more
08-17-2016
06:46 AM
Thanks a lot, Martin!
I'm sure it's a useful functionality for this custom viz.
I'll wait for your update! 🙂
Javier
... View more
07-21-2016
10:35 AM
You can make lookup search case insensitive by adding case_sensitive_match =false in your lookup stanza.
... View more
06-13-2016
06:57 AM
Hi,
Yes, it's a good idea and I've solved this problem.
Now I have created 4 different little checkbox inputs, 4 new tokens, and I had to add some CSS code to reduce new checkboxes widths, but it's ok 🙂
Thanks a lot for your idea!
... View more
04-18-2016
03:46 AM
Your answer is perfect for me and based on it I've solved this little integration problem.
Thanks a lot!!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
