Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nagarajsf
nagarajsf
Explorer
Member since:
10-28-2019
07-27-2020
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-28-2019 |
Activity Feed
- Tagged Getting error when trying to send cloud watch alerts using lambda function in AWS. on Splunk Dev. 07-26-2020 10:51 AM
- Posted Getting error when trying to send cloud watch alerts using lambda function in AWS. on Splunk Dev. 07-23-2020 04:34 PM
- Karma Re: Multivalve drilldown and dropdown is not working in query results for renjith_nair. 06-05-2020 12:50 AM
- Karma How to change the width of panels in xml? for auaave. 06-05-2020 12:49 AM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-20-2019 08:15 PM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-18-2019 04:52 PM
- Posted Re: rename the search results for multiple conditions on Splunk Search. 11-15-2019 01:08 PM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-15-2019 11:05 AM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-14-2019 01:37 PM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-13-2019 08:21 PM
- Posted Re: rename the search results for multiple conditions on Splunk Search. 11-08-2019 10:59 AM
- Posted rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Posted cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
- Tagged cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
- Tagged cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
- Tagged cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-03-2020
10:30 AM
We had the same problem when trying to set this up for the first time. We discovered that the lambda function is expecting the json from CloudWatch and not the default test event. The CloudWatch json has a data field that the function decodes from base64. Replacing the test event with the json below should work. {
"awslogs": {
"data": "QVdTIGxvZyBjb250ZW50"
}
}
... View more
05-04-2020
08:42 AM
The solution I found was to make the CSS panel 0% by adding an id on the CSS panel and another entry in the CSS code
<panel depends="$alwaysHideCSS$" id="CSSPanel">
<html>
<style>
#CSSPanel{
width:0% !important;
}
#errorSinglePanel{
width:25% !important;
}
#errorStatsPanel{
width:30% !important;
}
#errorLineChartPanel{
width:45% !important;
}
</style>
</html>
</panel>
... View more
11-19-2019
03:47 AM
Can you show a sample of your data showing the MANAGER_NAME and AMONAME fields and the result of the case statement as it is put into MANAGER_NAME1?
... View more
11-07-2019
09:44 PM
I have a dashboard with a dropdown that contains a list of values. The value of the choices must match to another dropdown list and get the respective results in dashboard but we tokens are not resolving in query when I checked in dashboard.
<form>
<label>Da1</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="field1">
<label>Select Window</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tokPlatform" searchWhenChanged="true">
<label>Select Platform</label>
<default>On-prem</default>
<choice value="APPLICATION=Hadoop OR APPLICATION=*Unix*">On-prem</choice>
<choice value="MANAGER_NAME=*.corporate.com OR NETWORKELEMENTCODE= PRD.* ">Cloud-AWS</choice>
<choice value="Null">Cloud-Azure</choice>
</input>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Select Environment</label>
<default>Prod</default>
<choice value="$tokPlatform$ MANAGER_NAME=prdehdp* OR MANAGER_NAME=prdplhdpx* OR MANAGER_NAME=prdasdp">Prod</choice>
<choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=dev*">Dev</choice>
<choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=QAT*">QAT</choice>
</input>
</fieldset>
<panel id="ticketStatusPanel">
<title>HDP INFRA ALERTS CHART</title>
<chart>
<title>ALERTS SEVERITY</title>
<search>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE|timechart span=5m count(compound_exp) BY SEVERITY </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"CRITICAL":0xFF0000,"MINOR":0xFF8000, "MAJOR":0xFF8000}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
<set token="clicked_group">$click.name2$</set>
</drilldown>
</chart>
</panel>
<panel id="countTicketPanel">
<title>TICKET STATUS CHART</title>
<chart>
<title>Ticket status</title>
<search>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE |timechart span=4m count(compound_exp) BY TICKET_STATUS</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="trellis.size">large</option>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
<set token="clicked_group">$click.name2$</set>
</drilldown>
</chart>
</panel>
</row>
<row id="row2">
<panel id="t2">
<title>Important alerts by severity ($resultcount$)</title>
<table id="table2">
<search>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE | rename TTID as Ticket | table Ticket,MANAGER_NAME,SEVERITY,DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE | dedup Ticket | sort - SEVERITY desc</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<done>
<eval token="resultcount">$job.resultCount$</eval>
</done>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<format type="color" field="SEVERITY">
<colorPalette type="map">{"CRITICAL":#DC4E41,"MINOR":#F8BE34,"MAJOR":0xFF8000}</colorPalette>
</format>
</table>
</panel>
<panel id="t1">
<title>OPEN TICKET STATUS ($resultcount1$)</title>
<table id="table1">
<search>
<done>
<eval token="resultcount1">$job.resultCount$</eval>
</done>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | rename TTID as Ticket | eval ot = strptime(CREATED_DATE, "%Y-%m-%d %H:%M:%S")
| eval ud = strptime(UPDATE_DATE, "%Y-%m-%d %H:%M:%S")
| eval nowstring=strftime(now(), "%Y-%m-%d %H:%M:%S")
| eval open_status(hr)=tostring((now() - ot), "duration" ) | eval lastactionON(hr)=tostring((now() - ud), "duration" )
| table Ticket,TICKET_STATUS,UPDATE_DATE, open_status(hr), lastactionON(hr) | where TICKET_STATUS!= "Resolved" | dedup Ticket</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="TICKET_STATUS">
<colorPalette type="map">{"Assigned":#DC4E41,"Working":#F8BE34 }</colorPalette>
</format>
</table>
</panel>
</row>
... View more
11-22-2019
03:34 AM
@nagarajsf,
Most probably its due to the extracted fields which are not available in the post process search. Try adding |fields <your field list> to your base search
... View more
11-07-2019
12:50 PM
Hi @adonio
How can we pass query to drop-down list, instead getting information based on content could define some values for fixed objects like A,B, C and backend we need to target some queries.
I posted some question similar to this,
fyi :https://answers.splunk.com/answers/780873/multivalve-drilldown-and-dropdown-is-not-working-i.html
link text
... View more
10-28-2019
04:22 PM
Hi,
I'm in the same scenario, but trying to get the difference from CREATED_DATE and current timestamp . For that, it is not working.
base_search
| eval it = strptime(CREATED_DATE, "%Y-%m-%d %H:%M:%S")
| eval nowstring=strptime(now(), "%Y-%m-%d %H:%M:%S")
| eval ticket_duration=tostring((now() - it), "duration" )
| table DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE, ticket_duration
base_search
| convert timeformat='%Y-%m-%dT%H:%M:%S' mktime(CREATED_DATE) mktime(now() AS _now)
| eval duration=(_now-CREATED_DATE)/86400
|table TTID,MANAGER_NAME,SEVERITY,DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE, duration
In both ways I'm getting null value, ticket_duration=null
Can you please suggest any?
Thanks,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-27-2020
06:06 PM
|
