About chiennylin

chiennylin · ‎07-13-2021

Hi Kv. on tabular: Post-o.splexcbj-HAPQ 1484 (0min) Post-o.splexcbj-HUEVQ 32 (0min) HTML wise i didn't really change anything. i just added: #prg_spback .facets-container{ display: flex !important; justify-content: center !important; } #prg_spback div.viz-facet{ $tokWidth2$; } then its tie to: <progress> <condition match="$job.resultCount$==0"> <set token="tokWidth2">width: 0% !important;</set> </condition> <condition match="$job.resultCount$==1"> <set token="tokWidth2">width: 95% !important;</set> </condition> <condition match="$job.resultCount$==2"> <set token="tokWidth2">width: 45% !important;</set> </condition> <condition match="$job.resultCount$==3"> <set token="tokWidth2">width: 30% !important;</set> </condition> <condition match="$job.resultCount$==4"> <set token="tokWidth2">width: 22% !important;</set> </condition> <condition match="$job.resultCount$==5"> <set token="tokWidth2">width: 18% !important;</set> </condition> <condition match="$job.resultCount$==6"> <set token="tokWidth2">width: 10% !important;</set> </condition> <condition> <set token="tokWidth2"></set> </condition> </progress> but it doesn't fix the wrap issue when the result is huge

chiennylin · ‎07-12-2021

Hello. The solution is amazing but im wondering, how to make the trellis not to overlap if the result is huge?

chiennylin · ‎07-12-2021

Hi, I have a single Value visualization with trellis. The dashboard was created to get the backlog count + how long the backlog is in the system. on a list view, the result is: sp_type values(sp_tot) Post-o.splexcbj-HAPQ 1484 (0min) Post-o.splexcbj-HUEVQ 32 (0min) im using: eval sp_type=sp_qtype."-".sp_qname stats sum(sp_msgnum) as "total" by sp_type sp_msgbcklog eval sp_tot=total." (".sp_msgbcklog."min)" sort total streamstats count as "AA" eval sp_type = printf("%*s", len(sp_type) + AA, sp_type) where total!="0" stats values(sp_tot) by sp_type then i use single value visualization, the display is like this: but the problem is that i need to make the result is in RED color, and to make sure that the result will not overlap each other like the one in the screenshot. *i added streamstats to sort and make sure that the one with highest value will return first Any idea how to achieve that?

chiennylin · ‎05-27-2021

Good day! I want to know if it's possible to use splunk as a recovery option? this means that Splunk will be sending messages to IBM MQ based on the queue set up. from what i know, MQ can be setup as the source of the message in splunk: MQ Queue --> Splunk i wanted to know if this is possible: Splunk --> MQ Queue? and how? like any idea?

chiennylin · ‎01-20-2020

Thanks for the answer, but it's not working. because the _time is used before hand. i even tried this: | eval TID=if(Type=="Inbound",obj_type,corrID) | eval inboundTime=if(Type=="Inbound",_time,null()) | eval outboundTime=if(Type=="Outbound",_time,null()) | convert ctime(inboundTime) AS inboundTime | convert ctime(outboundTime) AS outboundTime | eval ResponseTime=outboundTime-inboundTime | stats values(inboundTime) AS starttime values(outboundTime) AS endtime values(ResponseTime) as ResponseTime by TID but its not working. it looks like this: TID starttime endtime ResponseTime 0b44ffc9-8e92-44a0-b487-da9acba0bc52 01/21/2020 00:12:45.168 01/21/2020 00:12:45.362 0d501b27-ad34-4481-bc16-7c029baa8bec 01/21/2020 00:10:56.951 01/21/2020 00:10:57.293

chiennylin · ‎01-20-2020

the start and end have time. but when i do this: | eval ResponseTime=outboundTime-inboundTime there is no result. here's the sample: TID starttime endtime ResponseTime 0b44ffc9-8e92-44a0-b487-da9acba0bc52 01/21/2020 00:12:45.168 01/21/2020 00:12:45.362 0d501b27-ad34-4481-bc16-7c029baa8bec 01/21/2020 00:10:56.951 01/21/2020 00:10:57.293 there's no response time by simply eval ResponseTime=outbound-inbound

chiennylin · ‎01-19-2020

Help, my eval subtraction is not working: | convert ctime(_time) AS time | eval TID=if(Type=="Inbound",obj_type,corrID) | eval inboundTime=if(Type=="Inbound",time,null()) | eval outboundTime=if(Type=="Outbound",time,null()) | eval ResponseTime=strptime(outboundTime,"%Y%m%d %H:%M:%S.%N")-strptime(inboundTime,"%Y%m%d %H:%M:%S.%N") | stats values(inboundTime) AS starttime values(outboundTime) AS endtime values(ResponseTime) as ResponseTime by TID i even tried | eval ResponseTime=outboundTime-inboundTime but there's no output

chiennylin · ‎01-19-2020

Hi, I am trying to subtract the _time as well, but i don't know why my simple eval is not working. here's my code: | convert ctime(_time) AS time | eval TID=if(Type=="Inbound",obj_type,corrID) | eval inboundTime=if(Type=="Inbound",time,null()) | eval outboundTime=if(Type=="Outbound",time,null()) | eval ResponseTime=strptime(outboundTime,"%Y%m%d %H:%M:%S.%N")-strptime(inboundTime,"%Y%m%d %H:%M:%S.%N") | stats values(inboundTime) AS starttime values(outboundTime) AS endtime values(ResponseTime) as ResponseTime by TID I even tried a simpler approach: | eval ResponseTime=outboundTime-inboundTime But this is not working as well. help!

chiennylin · ‎01-16-2020

Thanks! this works perfectly!

chiennylin · ‎01-15-2020

Currently, we are extracting the total of bagging per country and this is being stored in a report. the report output looks like this: 01/15/2020 07:45:00 +0000, search_name=BT_COUNTRY_TOTAL_SHP, search_now=1579075200.000, info_min_time=1579071600.000, info_max_time=1579075200.000, info_search_time=1579075209.762, AE=2, AU=5, BG=0, CH=0, CM=0, CN=3, CZ=4, FI=1, FR=1, GR=1, HK=2, HU=0, IE=0, IN=0, IQ=0, IT=2, JP=2, KR=1, KW=1, KZ=0, LT=0, MX=12, NG=1, NO=0, NZ=2, PL=0, PT=1, RO=3, RU=1, SA=0, SE=0, SG=1, SI=2, TR=13, US=17, VN=0, ZA=1, report="BT_COUNTRY_TOTAL_SHP" Moving to dashboard, i don't know what is the best strategy to make country a dynamic checkbox that will sum up via timechart. unlike in region, we have 251 countries define in total. in region, i use this for my dashboard: for input i define it like this: but i had to REX all the region input id="region_id" type="checkbox" token="region" Select Region choice value="sum(AM) as "AM"" choice value="sum(AP) as "AP"" index=*ocnt_summary source=$BTYPE2$ | rex "AM=(?<AM>\d+)" | rex "AP=(?<AP>\d+)" | rex "CN=(?<CN>\d+)" | rex "EU=(?<EU>\d+)" | rex "ME=(?<ME>\d+)" | rex "SB=(?<SB>\d+)" | timechart span=$span$ $region$ For country, aside from during REX for all the country, I don't know if I have any other options. HELP!

chiennylin · ‎01-14-2020

hi, having the same problem. Not good with css. So i added the id, i tried this: <title>Bagging by Region</title> <input id="region_id" type="checkbox" token="region" > <label>Select Region</label> <choice value="sum(AM) as "AM"">AM</choice> <choice value="sum(AP) as "AP"">AP</choice> <choice value="sum(CN) as "CN"">CN</choice> <choice value="sum(EU) as "EU"">EU</choice> <choice value="sum(SB) as "SB"">SB</choice> <choice value="sum(ME) as "ME"">ME</choice> <delimiter>,</delimiter> </input> <html> <style> .control.shared-controls-syntheticcheckboxcontrol.control-default{ display: inline-block !important; } region_id{ width:auto !important; } </style> </html> but this is still not working

chiennylin · ‎01-14-2020

I'm having the same issue. when I updated the form inputs, my panel search is not refreshing.

chiennylin · ‎11-07-2019

Thanks! this helps! this is now working. will take note on the whitespace for my rex moving forward.

chiennylin · ‎11-06-2019

My raw event is: 07 Nov 2019 01:24:49 | INFO | DispatchThread: 6119 | *** Time taken to process 100 records 1009ms | GNS-C6CAE58A-3482-451B-A7B2-6F63DE58E4B3-002 | com.dhl.ms.sdm.jms.listeners.GNSMessageListener | onMessage | i tried to get the number of records over time | rex "Time taken to process(?[^\_]+)records(?[^ms]+)" | eval aveDuration =recDuration/recNum | table recNum recDuration aveDuration _raw but, this is not returning the aveDuration even if i use the simple eval =recDuration/recNum my rex is correct, and i even put in convert to num but, still not working. HELP. thanks

Posts	14
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-06-2019

Online Status	Offline
Date Last Visited	‎07-13-2021 09:07 PM

Single Value trellis wrap result and font color

Can Splunk send message to IBM Websphere MQ?

Dealing with Multiple dynamic input such as countr...

Why is division via EVAL is not working?

Re: Single Value trellis wrap result and font colo...

Re: Trellis to align automatically to the panel si...

Single Value trellis wrap result and font color

Can Splunk send message to IBM Websphere MQ?

Re: How to subtract windows time stamps?

Re: subtraction using eval

Re: subtraction using eval

Re: How to subtract windows time stamps?

Re: Dealing with Multiple dynamic input such as co...

Dealing with Multiple dynamic input such as countr...

Re: Checkbox horizontal Value alignment

Re: Why are changes based on drop-down input in pa...

Re: Why is division via EVAL is not working?

Why is division via EVAL is not working?

Are you a member of the Splunk Community?