Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About synastraa
synastraa
Path Finder
Member since:
03-18-2019
06-05-2020
Community Statistics
| Posts | 25 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 03-18-2019 |
Activity Feed
- Karma Re: Token reference for TimeChart panel for tiagofbmm. 06-05-2020 12:50 AM
- Posted Grouping results on Dashboards & Visualizations. 07-18-2019 08:32 PM
- Tagged Grouping results on Dashboards & Visualizations. 07-18-2019 08:32 PM
- Posted Re: Token reference for TimeChart panel on Splunk Search. 07-10-2019 07:58 PM
- Posted Token reference for TimeChart panel on Splunk Search. 07-09-2019 08:30 PM
- Tagged Token reference for TimeChart panel on Splunk Search. 07-09-2019 08:30 PM
- Posted Re: Is it possible to create a chart like this in splunk? on Reporting. 05-16-2019 12:01 AM
- Posted Re: Is it possible to create a chart like this in splunk? on Reporting. 05-16-2019 12:00 AM
- Posted Re: Creating a Chart that shows count of Reported ticket and Resolved ticket by week on Splunk Search. 05-15-2019 02:32 AM
- Posted Re: Is it possible to create a chart like this in splunk? on Reporting. 05-13-2019 01:18 AM
- Posted Re: Is it possible to create a chart like this in splunk? on Reporting. 05-13-2019 01:17 AM
- Posted Is it possible to create a chart like this in splunk? on Reporting. 05-12-2019 11:39 PM
- Tagged Is it possible to create a chart like this in splunk? on Reporting. 05-12-2019 11:39 PM
- Posted Re: Creating a Chart that shows count of Reported ticket and Resolved ticket by week on Splunk Search. 05-10-2019 10:33 PM
- Posted Re: Creating a Chart that shows count of Reported ticket and Resolved ticket by week on Splunk Search. 05-09-2019 08:05 PM
- Posted Re: Creating a Chart that shows count of Reported ticket and Resolved ticket by week on Splunk Search. 05-09-2019 01:07 AM
- Posted Creating a Chart that shows count of Reported ticket and Resolved ticket by week on Splunk Search. 05-08-2019 11:56 PM
- Tagged Creating a Chart that shows count of Reported ticket and Resolved ticket by week on Splunk Search. 05-08-2019 11:56 PM
- Posted Re: Calculating multiple counts in one search on Splunk Search. 04-26-2019 12:34 AM
- Posted Re: Calculating multiple counts in one search on Splunk Search. 04-25-2019 11:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-18-2019
09:18 PM
@synastraa Try the following steps:
1) Either run multiple searches for each table or use post processing to form two tables out of your table search.
2) Create <html> panel for each table's title which will be displayed on the left.
3) Create 5% and 95% width for title panel and table panel respective.
4) In addition I have rotated the title text to vertical.
Following is the required Simple XML code for run anywhere example used above:
<dashboard>
<label>Chart by component over time</label>
<row>
<panel id="panelErrorID">
<html depends="$alwaysHideCSSPanel$">
<style>
#panelErrorID,#panelWarnID{
width:5% !important;
}
#panelErrorTable,#panelWarnTable{
width:95% !important;
}
#panelErrorID .htmlPanelTitle,#panelWarnID .htmlPanelTitle{
font-size: 120%;
font-weight: bold;
width: 0;
word-wrap: break-word;
padding-left: 30%;
padding-top: 10px;
}
</style>
</html>
<html>
<div class="htmlPanelTitle">Errors</div>
</html>
</panel>
<panel id="panelErrorTable">
<table>
<search>
<query>index=_internal sourcetype=splunkd log_level=ERROR
| eval Time=strftime(_time,"%H").":00"
| chart count by component Time limit=5 useother=f usenull=f</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel id="panelWarnID">
<html>
<div class="htmlPanelTitle">Warnings</div>
</html>
</panel>
<panel id="panelWarnTable">
<table>
<search>
<query>index=_internal sourcetype=splunkd log_level=WARN
| eval Time=strftime(_time,"%H").":00"
| chart count by component Time limit=5 useother=f usenull=f</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
... View more
Hi Nabeel,
I am more concern on how to get the chart out then the colouring. Thanks.
... View more
05-15-2019
02:32 AM
This is the solution i found for my question by using the appendcols function.
|dedup Incident_Number|table Incident_Number Reported_Date _time
|eval reported=strftime(Reported_Date, "%Y-%W")
|eval _time=strftime(Reported_Date , "%Y-%W")
|stats count(reported) as Reported_Ticket by _time
| appendcols
[ search
|dedup Incident_Number|table Incident_Number Last_Resolved_Date _time
|eval resolved=strftime(Last_Resolved_Date, "%Y-%W")
|eval _time=strftime(Last_Resolved_Date , "%Y-%W")
|stats count(resolved) as Resolved_Ticket by _time
]
... View more
04-11-2019
12:37 AM
Hi,
Still have not been able to get a solution for this. Is there anyone with a solution for this? Thanks!
... View more
03-31-2019
10:53 PM
Hi renjith,
How would i go about on checking the timezone for my user setting and event settings. Thanks!
Best Regards,
Aloysius
... View more
