Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About cmerriman
cmerriman
Super Champion
Member since:
09-10-2013
08-12-2025
Community Statistics
| Posts | 1453 |
| Solutions | 271 |
| Karma Given | 79 |
| Karma Received | 707 |
| Member Since | 09-10-2013 |
Activity Feed
- Got Karma for Re: DMA - datamodel artifacts filling up the dispatch dir. 10-15-2025 06:44 AM
- Got Karma for Re: Reset all inputs to default in dashboard studio?. 07-21-2025 10:38 AM
- Got Karma for Re: Reset all inputs to default in dashboard studio?. 06-16-2025 01:48 PM
- Posted Re: Reset all inputs to default in dashboard studio? on Dashboards & Visualizations. 06-16-2025 01:30 PM
- Posted Re: DMA - datamodel artifacts filling up the dispatch dir on Splunk Enterprise Security. 06-16-2025 12:28 PM
- Got Karma for Re: How can I create a query to find dashboard usage and top used dashboards of all the dashboards in my environment?. 05-20-2025 10:04 AM
- Got Karma for Re: How do you display a blank panel?. 05-19-2025 07:07 AM
- Got Karma for Re: Count of events based on two where conditions. 05-06-2025 04:45 PM
- Got Karma for Re: How to add final total count of results without adding another column?. 04-14-2025 06:24 PM
- Got Karma for Re: How do I add yesterday's date to an emailed report subject?. 03-13-2025 10:20 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 02-25-2025 02:12 PM
- Got Karma for Re: What are the differences between append, appendcols, and join search commands?. 11-06-2024 02:19 AM
- Got Karma for Re: How to replace specific field value?. 06-20-2024 06:36 AM
- Got Karma for Re: "Other" in timechart. 01-11-2024 01:30 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 12-14-2023 07:48 AM
- Got Karma for Re: If there are no results found, how do I get my search to return a field that has the value of zero?. 11-17-2023 07:09 AM
- Got Karma for Re: Search Query Help: Number of Events per Event Code and Total size of those events. 08-07-2023 06:54 AM
- Got Karma for Re: Stats (count(x) as countX, count(y) as countY) BY FIELD X. 03-16-2023 06:36 AM
- Got Karma for Re: How to reference a dashboard token in an HTML panel?. 01-30-2023 12:00 AM
- Got Karma for Re: "Other" in timechart. 01-13-2023 05:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
11-01-2016
01:17 PM
3 Karma
can you just add |addcoltotals
... View more
11-01-2016
04:38 AM
you may need to add the unset code back in underneath the set condition.
<condition>
<unset token="hide_panel"></unset>
</condition>
... View more
10-31-2016
01:37 PM
the code at the top is what i used. If it isn't working for you, I'm not entirely sure why, because it works for me.
<panel rejects="$hide_panel$">
<chart>
<title>Average % CPU Utilization</title>
<search>
<query>index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
</done>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Percent</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
... View more
10-31-2016
01:04 PM
You have <panel rejects="$hide_panel$"> ?
... View more
10-31-2016
11:57 AM
I changed depends to reject and also changed <progress> to <done> while also removing the <condition> <unset token="hide_panel"></unset> </condition>
I tried it on a test dashboard and got it to hide the panel when empty and show the panel when there were results.
... View more
10-31-2016
11:49 AM
see my updated syntax at the top.
... View more
10-31-2016
11:22 AM
you should set the token when the resultcount is 0
<progress>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</condition>
</progress>
... View more
10-31-2016
10:52 AM
do you have a depends statement? It may have been cut off? Also, set the token when job.resultCount=0, try that.
<panel rejects="$hide_panel$">
<chart>
<title>Average % CPU Utilization</title>
<search>
<query>index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
</done>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Percent</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
... View more
10-31-2016
10:16 AM
sourcetype=cisco:squid (IP or IP or IP or IP or IP)|eventstats dc(IP) as totalIPs|stats values(IP) as IPaddresses dc(IP) as dcIP max(totalIPs) as totalIPs by URL|where dcIP=totalIPs
something like this should give you what you're looking for, if I'm not mistaken. the eventstats will distinctly count how many IPs you have total, then the stats command will list out the IP addresses and distinctly count them by each URL. If the number that hit the URL does not match the total, that URL would be filtered out, so you should only see URLs that were hit by every IP.
... View more
10-31-2016
07:50 AM
what format are those fields in originally? are they in "%Y-%m-%d %H:%M:%S" or are they in another format?
I just updated the syntax. I misread the format you had listed in the question. Changed format to have "-" instead of "/". If it isn't in that format, please share what original format the fields are in.
... View more
10-31-2016
07:24 AM
turn them into epoch time before calculating the difference. If fields are already in epoch, you can just calculate the difference without converting them.
|convert mktime(VENDOR_NOTIFIED_TIME) as nt_time timeformat="%Y-%m-%d %H:%M:%S"|convert mktime(START_DATE) as st_time timeformat="%Y-%m-%d %H:%M:%S"|eval latency = nt_time-st_time
... View more
10-29-2016
05:38 AM
Im on iOS10 and after I login to my vpn, my Splunk app works with this: https://{URL}:8089
Just like if I were connecting from my home computer on a vpn and can't just type in Splunk:8000.
... View more
10-28-2016
10:29 AM
1 Karma
this shows, for all single values (you should be able to change them to tables/charts/etc.), searches in one panel on one line, and then the html part breaks it into another row, if wanted. To keep things on one line, you just don't want <row> between the <panel>
<panel>
<single>
<search>
<query>....</query>
</search>
<option name="drilldown">none</option>
</single>
<single>
<search>....</query>
</search>
<option name="drilldown">none</option>
</single>
<html tokens="true" encoded="true">
<![CDATA[
<br/>
]]>
</html>
<single>
<search>
<query>....</query>
</search>
<option name="drilldown">none</option>
</single>
<single>
<search>
<query>....</query>
</search>
<option name="drilldown">none</option>
</single>
<single>
<search>
<query>....</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
... View more
10-28-2016
07:22 AM
1 Karma
I'd use transaction
...|transaction event startswith="file_change" max_span=5m|search eventcount=1
that should give you any transaction that only has a file_change with no git_commit within 5 minutes.
... View more
10-28-2016
06:02 AM
i worked this out on my own dashboard and it should work:
<title>Test1 $value$</title>
<search>
<query>index=_internal | stats count by status|head 2</query>
<earliest>-3d@d</earliest>
<latest>-1d@d</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<set token="panel1">$row.status$=200</set>
<set token="panel2">$row.status$=201</set>
<eval token="showpanel1">if($panel1$="200=200","true",null())</eval>
<eval token="showpanel2">if($panel2$="201=201","true",null())</eval>
</drilldown>
<title>Test Panel 1</title>
<search>
<query>index=_internal|stats count by source</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<title>Test Panel 2</title>
<search>
<query>index=_internal|stats count by source</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
... View more
10-27-2016
01:21 PM
try something like this:
...| timechart span=1d count("failed") as failed count("succeeded") as succeeded|eval failureRate=failed/(failed+succeeded)|fields - failed - succeeded
you might need to add something like count(match(x,"failed")) into the timechart command instead of the count("failed")
... View more
10-27-2016
12:12 PM
1 Karma
when pasting your example, highlight the syntax and click on the little '101 010' icon above the texbox
... View more
10-27-2016
11:51 AM
1 Karma
are you trying to search for everything EXCEPT search index= myindex source=server.log earliest=-360 latest=-60
... View more
10-27-2016
11:36 AM
i don't think you can use the $.
https://docs.splunk.com/Documentation/Splunk/6.3.5/SearchReference/Highlight
... View more
10-27-2016
09:26 AM
progress tags go before </search> and drilldown tags go after.
might be able to try:
<drilldown>
<set token="value">$click.value2$</set>
<condition match="$value$=200">
<set token="panel1">true</set>
</condtion>
<condition match="$value$=201">
<set token="panel2">true</set>
</condtion>
</drilldown>
<drilldown>
<unset token="value"></unset>
</drilldown>
instead of using the progress part.
... View more
10-27-2016
09:04 AM
index=mysource earliest =-15m|rex field=_raw "(?msi)(?{.+}$)" | spath input=json_field | rename s.Path as sPath,s.pElapsedTime as ElapsedTime|eval ElapsedTimeinSecs=(ElapsedTime/1000)|where isnotnull(ElapsedTimeinSecs)| stats list(ElapsedTimeinSecs) as ElapsTime, avg(ElapsedTimeinSecs) as AVGResponse by sPath|mvexpand ElapsTime|eval GreaterThankAvg=if(ElapsTime>AVGResponse,ElapsTime,null())
try that. you mvexpaned a field you renamed as ElapsTime.
... View more
10-27-2016
08:51 AM
sorry, you should use the mvexpand command on the multivalued field. i updated the syntax. can you show me the syntax you're trying?
... View more
10-27-2016
08:48 AM
2 Karma
something like this:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Custom_logic_for_dashboards
you'll want to set a token in the pie chart
<drilldown>
<set token="value">$click.value2$</set>
</drilldown>
<drilldown>
<unset token="value"></unset>
</drilldown>
<progress>
<condition match="$value$=200">
<set token="panel1">true</set>
</condtion>
<condition match="$value$=201">
<set token="panel2">true</set>
</condtion>
</progress>
and then in the first bar chart:
<panel depends="$panel1$">
and second chart:
<panel depends="$panel2$">
... View more
10-27-2016
08:35 AM
1 Karma
could you do something like. if it isn't a multivalued field, you can excluve the mvexpand.
...|stats ....avg(marks) as averageMarks by.....|mvexpand user|eval GreaterThanAverage=if(marks>averageMarks,"True",null())
... View more
10-27-2016
08:30 AM
2 Karma
eventtype=majordomo-from OR eventtype=majordomo-to |stats values(eventtype) as events values(to) as to values(from) as from by queue_id
something like this should work.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-12-2025
10:31 AM
|
Karma given to
