Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About stratenh
stratenh
Loves-to-Learn
Member since:
11-20-2016
04-11-2023
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-20-2016 |
Activity Feed
- Posted Re: Set multiple tokens using "condition match" on Dashboards & Visualizations. 04-11-2023 08:01 AM
- Posted Re: Set multiple tokens using "condition match" on Dashboards & Visualizations. 04-11-2023 06:04 AM
- Posted Re: Is there a way to know which fields were extracted at index-time vs search-time? on Splunk Search. 03-17-2023 02:56 PM
- Posted Re: No results found, still chart and stats return 1. on Splunk Search. 11-23-2016 07:18 AM
- Posted Re: No results found, still chart and stats return 1. on Splunk Search. 11-23-2016 12:20 AM
- Posted Re: No results found, still chart and stats return 1. on Splunk Search. 11-22-2016 11:27 PM
- Posted Re: No results found, still chart and stats return 1. on Splunk Search. 11-22-2016 01:23 AM
- Posted No results found, still chart and stats return 1. on Splunk Search. 11-20-2016 10:53 PM
- Tagged No results found, still chart and stats return 1. on Splunk Search. 11-20-2016 10:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
04-11-2023
08:01 AM
This seems to work (but still feels like a work around): <form theme="dark" script="simple_xml_examples:showtokens.js">
<init>
<set token="field1">off</set>
</init>
<fieldset submitButton="false">
<input type="checkbox" token="field">
<label>field</label>
<choice value="option1">option1</choice>
<choice value="option2">option2</choice>
<change>
<eval token="field1">case(isnotnull(mvfind($form.field$,"option1")),"option1")</eval>
<eval token="field2">case(isnotnull(mvfind($form.field$,"option2")),"option2")</eval>
</change>
</input>
</fieldset>
<search>
<query>
| makeresults
| eval option1=$field1$
</query>
<done>
<condition match="isnull($field1$)">
<unset token="option1.txt"></unset>
</condition>
<condition>
<set token="option1.txt">$field1$</set>
</condition>
</done>
</search>
<search>
<query>
| makeresults
| eval option2=$field2$
</query>
<done>
<condition match="isnull($field2$)">
<unset token="option2.txt"></unset>
</condition>
<condition>
<set token="option2.txt">$field2$</set>
</condition>
</done>
</search>
<row>
<panel>
<html>
<p>$option1.txt$</p>
<p>$option2.txt$</p>
</html>
</panel>
</row>
</form> Does someone have a better solution?
... View more
04-11-2023
06:04 AM
If this would (still) be the case, then this dashboard should be able to set one of the 2 tokens based upon the clicked checkbox: <form theme="dark" script="simple_xml_examples:showtokens.js">
<fieldset submitButton="false">
<input type="checkbox" token="field1">
<label>field1</label>
<choice value="option1">option1</choice>
<choice value="option2">option2</choice>
<change>
<condition match="isnotnull(mvfind($form.field1$,"option1"))">
<set token="option1.txt">option1</set>
</condition>
<condition>
<unset token="option1.txt"></unset>
</condition>
</change>
<change>
<condition match="isnotnull(mvfind($form.field1$,"option2"))">
<set token="option2.txt">option2</set>
</condition>
<condition>
<unset token="option2.txt"></unset>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<p>$option1.txt$</p>
<p>$option2.txt$</p>
</html>
</panel>
</row>
</form> But, only the second change block gets hit. Or am I doing something wrong here?
... View more
03-17-2023
02:56 PM
You can now even do it simpeler: | tstats
[ search index=<your_index>
| stats first(*) as *
| transpose
| fields column
| search column!="index" column!="splunk_server" column!="splunk_server_group"
| mvcombine column
| eval expr="count(".mvjoin(column,"), count(").")"
| return $expr] where index=<your_index>
| transpose
| where 'row 1'>0
| rex field=column "count\((?<indexed_field_name>.*)\)"
| fields indexed_field_name I came to this solution via this thread and https://community.splunk.com/t5/Splunk-Search/How-do-you-prevent-the-map-command-from-encapsulating-the/m-p/435102 . The 3 values for column needed to be excluded, otherwise tstats tells you it can't do that count function for those fields.
... View more
11-23-2016
07:18 AM
My query was wrong. The dedup sorted nothing, because OPEN_TIME is the same. So sorting is different every time, as well as the remaining records after the dedup.
Sorry for taking your time.
Regards, Hans van Straten
... View more
11-23-2016
12:20 AM
Maybe some additional info will help.
I created a dashboard with this query in it. I didn't notice the problem before we used the dashboard.
... View more
11-22-2016
11:27 PM
At this moment I don't see the issue using a relative period of 1 week. Just to be sure, I now used a fixed time frame specifying a period from Monday morning until the next Monday morning: it's still there. So a relative period is not the issue.
... View more
11-22-2016
01:23 AM
It's a relative time range of 1 week. But swithing between the 2 queries back and forth didn't show any change in the results. The number of records is also very low. A couple of records per week after filtering on ASSIGNMENT. So I don't expect this to be the problem.
... View more
11-20-2016
10:53 PM
Hi,
I have a query which returns no results:
index="itsm" sourcetype=incidents | dedup NUMBER sortby OPEN_TIME | search STATUS!=Closed STATUS!=Resolved ASSIGNMENT="MY GROUP"
but when I add chart or stats:
index="itsm" sourcetype=incidents | dedup NUMBER sortby OPEN_TIME | search STATUS!=Closed STATUS!=Resolved ASSIGNMENT="MY GROUP" | chart count
it returns 1 (but not always).
Does someone have an explanation for this and a solution?
Thanks.
Regard, Hans van Straten
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-11-2023
03:09 PM
|
