Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About matansocher
matansocher
Contributor
Member since:
03-15-2017
06-05-2020
Community Statistics
| Posts | 105 |
| Solutions | 1 |
| Karma Given | 40 |
| Karma Received | 7 |
| Member Since | 03-15-2017 |
Activity Feed
- Karma Re: How to present the date and value not in epoch format and is there a way to add a line to the bubble chart (over the time), in order to show trend? for Richfez. 06-05-2020 12:49 AM
- Karma Re: Extracting date from a date string that has many options for HiroshiSatoh. 06-05-2020 12:49 AM
- Karma Re: Dashboard drilldown: user clicks on value, search is ran on that value, value from this search opens a new web page for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Dashboard drilldown: user clicks on value, search is ran on that value, value from this search opens a new web page for niketn. 06-05-2020 12:49 AM
- Karma Re: Sum values from a table for niketn. 06-05-2020 12:49 AM
- Karma Re: changing bars colors by a string value of a field for niketn. 06-05-2020 12:49 AM
- Karma Re: Return a custom table with empty results when no results on base search for gcusello. 06-05-2020 12:49 AM
- Karma Re: show difference of 2 accumulated values in line chart for rjthibod. 06-05-2020 12:49 AM
- Karma Re: count how many records was opened by open date field for rjthibod. 06-05-2020 12:49 AM
- Karma Re: adding css to dashboard crashed dashboard for kmaron. 06-05-2020 12:49 AM
- Got Karma for Re: Passing token value from one dashboard to another in drilldown. 06-05-2020 12:49 AM
- Got Karma for Re: How do you use eval in XML drilldown?. 06-05-2020 12:49 AM
- Got Karma for change search based on the event's field's value. 06-05-2020 12:49 AM
- Got Karma for How to use time input in another input search. 06-05-2020 12:49 AM
- Got Karma for How to use time input in another input search. 06-05-2020 12:49 AM
- Karma Re: add cumulative line on bar chart for HiroshiSatoh. 06-05-2020 12:48 AM
- Karma Re: run dashboard hourly for kamlesh_vaghela. 06-05-2020 12:48 AM
- Karma Re: Show 2 bars in every "by" value bar chart for niketn. 06-05-2020 12:48 AM
- Karma Re: Show 2 bars in every "by" value bar chart for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: how to extract time from a string time field? for dineshraj9. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 0 |
07-31-2018
09:50 PM
1 Karma
hi mbasharat,
the way to pass token or values to another dashboard:
at the dashboard you are passing data from:
<drilldown target="_blank">
<eval token="new_field">split($core_core_ver$," ")</eval>
<link>
<![CDATA[/app/splunk_app/dashboard_name?&form.project=$project_name$&form.date=$click.value$]]>
</link>
</drilldown>
I have also added an eval calculation for a new field (new_field) that you can create right before the drilldown.
in that way, at the dashboard you are passing data to, the tokens we set (project, date) will be available in the inputs that will have the same corresponding token names.
for example, form.project=$project_name$, and input with token name project will send a token named project with the value $project_name$ (also a token) to the second dashboard, to the input with token name project
... View more
05-07-2018
09:17 PM
Hi Rich thank you for your answer, it helped!
I understand that setting the x axis with time values is not possible, so I definitely take your solution.
... View more
05-02-2018
06:48 AM
Hi,
I created a bubble chart with numeric values on the y-axis and time(epoch) on the x-axis, and the bubble size is another numeric field.
I want to present the date value and not the epoch, so the users will understand the date. Is that possible?
Also, is there a way to add a line to the bubble chart (over the time), in order to show a trend?
Thanks
... View more
04-29-2018
05:29 AM
Hi
I want to "teach" the machine learning tool kit how our projects in our company converges through time based on project name and the field 'SLOC'.
How can I tell the algorithm to see the different projects in our company and forecast the current project?
I can build a table that contains 3 fields: project name, date, sloc
Example:
project 1, 01.01.18, 22
project 1, 01.02.18, 40
project 1, 01.03.18, 2
project 2, 01.01.18, 400
project 2, 01.02.18, 88
project 2, 01.03.18, 16
Is it possible to "feed" the algorithm to know how our projects are going, so it will be able to forecast the next projects based on the previous project's data?
Thanks
... View more
04-23-2018
07:34 AM
wanted to do that but then I get the error:
Error in 'SearchParser': The search specifies a macro 'modvizpredict' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.
... View more
04-23-2018
06:01 AM
Hi
I want to integrate one of my reports from the machine learning tool kit in other dashboard (from the regular splunk app).
I want to be able to pass parameters from inputs of the dashboard to the report.
is that possible?
... View more
04-23-2018
05:52 AM
Hi
I want to integrate one of my reports from the machine learning tool kit in other dashboard (from the regular splunk app).
I want to be able to pass parameters from inputs of the dashboard to the report.
is that possible?
... View more
04-23-2018
01:13 AM
Thanks you sko and niketnilay for your help. I have managed to use the machine learning tool kit (Forecast Time Series in particular).
I have another question.
is there a way to tell the algorithm to "strive" one value to 0 in a specific day?
I will explain better. our project ends in some date and the SLOC field will then be zero, and I want to predict the value of the SLOC field based on the past, and with knowing that it will be 0 in a specific date.
... View more
04-22-2018
01:07 AM
Hi
I want to predict values of a field over time.
the result table of my search:
In the end of the search I use:
| timechart span=24h sum(sloc) as SLOC
| eval _time = strftime(_time, "%Y-%m-%d")
| fillnull value=0
| predict SLOC
the error I get:
External search command 'predict' returned error code 1.
I am using splunk 6.5.7
the results I would like to see is more days to come with the 'SLOC' predicted value.
... View more
04-22-2018
12:21 AM
Hi,
I am trying to create a box plot of my data.
the output of my search is:
I get the error:
Failed to load source for Box Plot visualization.
... View more
04-17-2018
07:37 AM
I actually cant add custom css files. my organization is very big and I dont have the privileges to add files.
thanks!
... View more
04-17-2018
07:02 AM
I dont want to convert it. is there any other way to add css?
... View more
04-17-2018
06:45 AM
Hi,
I added a bit of css to my dashboard in simple xml
<html>
<head>
<style type="text/css">
.my-list ul {
list-style-position: inside;
}
</style>
</head>
</html>
everytime I save the dashboard and refresh, it cannot load again, remains on the Loading ... grey screen.
any idea why?
... View more
03-19-2018
08:34 AM
2 Karma
Hi
I have a dashboard with 2 input - time and another field ('fieldA').
'fieldA' is populated by a search, and it has his own time.
How do I use the time input to the search that populates 'fieldA'?
thanks
... View more
03-05-2018
02:03 AM
I have given a look at that question, but it is still going through the results twice.
index=*
| eval result=if( host != "myPc" ,
[ search index=_
| stats dc(host) as cc
| return $cc] ,
[ search index=_
| stats c(source) as cs
| return $cs] )
| table result
'search index=_' is there twice
... View more
03-05-2018
12:27 AM
edited the question, I think that now it has a deeper explanation of the problem
... View more
03-04-2018
07:08 AM
1 Karma
Hi,
I have a very big data set, and I want to return different fields from it, based on a value of another field (2 values possible).
if that field's (fieldA) value is 'aaa' I want to take the search to one place, and if the value is 'bbb' to another place, but at the end I want to go through the data only once.
now, I have a search for each of the options, which I concatenate them at their end:
index=main fieldA='aaa'
| set of commands
and
index=main fieldA='bbb'
| different set of commands
by that I am running on the same data twice. I want to run over the data once with something like:
index=main
| if(fieldA='aaa', set of commands, different set of commands)
I want to take care of the event differently for the two values possible of fieldA.
Is there an option to do that, or I will have to run over the data set twice?
... View more
02-21-2018
01:03 AM
Hi,
I have my query that return a table with 4 fields: A1, B1, A2, A2. I want to create a new table that contains 2 fields: A and B.
example:
current table -
desired table -
I would like to achieve that without running on the events again and append the results.
is there an efficient way to do that?
thanks
... View more
12-17-2017
10:55 PM
Hi,
I want to remove a number (up to 5 digits) from a string on its beginning.
an example:
43.aaaa_vvvvv.cccccc:dddddd => aaaa_vvvvv.cccccc:dddddd
9374.aaaa_vvvvv.cccccc:dddddd => aaaa_vvvvv.cccccc:dddddd
1.aaaa_vvvvv.cccccc:dddddd => aaaa_vvvvv.cccccc:dddddd
I only need to remove the first number and the "." after it.
thanks
... View more
12-13-2017
04:48 AM
Sorry, I didnt know that a subsearch has a timeout of 60 seconds or a limit of 50000 results.
Thanks anyway
... View more
12-12-2017
01:21 AM
Hi,
I need a way to check if a value is in a sub search table result.
for example I use the code that doesent work:
index=indexA groupID=*groupA* regression_target=*TargetA* job_type=run_job
| search
[ search index=indexA groupID=*groupA* regression_target=*TargetA* status=PASS job_type=batch
| dedup thumb_print
| fields thumb_print]
| table thumb_print
I am trying to filter the 'thumb_print' field by the subsearch result. in the subsearch there are more results then the whole search.
by the data, it does not make any sense. am I doing something wrong?
thanks
... View more
11-22-2017
12:17 AM
it did work
... View more
11-22-2017
12:00 AM
Thanks!! I probably did not understand the meaning of the tag
... View more
11-21-2017
11:35 PM
Hi
I want to set a token in my dashboard after a user has entered an input.
this is my dashboard, after a try (in the 'change' tag, wanted to use the 'teamRegressions' I set and it doesent recognize it in my search):
<form>
<label>Matan Regressions Test - v1.4</label>
<fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="teamTests">
<label>Team (Mandatory)</label>
<choice value="TestsMultimediaCSV">camss</choice>
<choice value="TestsPeriphCSV">periph</choice>
</input>
<input type="dropdown" token="groupID">
<change>
<eval token="teamRegressions">case($teamTests$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $teamTests$=="TestsPeriphCSV", "RegressionsCSV")</eval>
</change>
<label>Core (Mandatory)</label>
<prefix>*</prefix>
<fieldForLabel>groupID</fieldForLabel>
<fieldForValue>groupID</fieldForValue>
<search>
<query>| inputcsv $teamRegressions$
| eval groupID = substr(groupID, 6, len(groupID))
| dedup groupID
| table groupID
| sort groupID</query>
<earliest>0</earliest>
<latest></latest>
</search>
<suffix>*</suffix>
</input>
<input type="dropdown" token="regression_target">
<label>Chip (Mandatory)</label>
<choice value="*">All</choice>
<prefix>*</prefix>
<fieldForLabel>regression_target</fieldForLabel>
<fieldForValue>regression_target</fieldForValue>
<search>
<query>| inputcsv $teamRegressions$
| search groupID=$groupID$
| dedup regression_target
| table regression_target
| sort regression_target</query>
<earliest>0</earliest>
<latest></latest>
</search>
<suffix>*</suffix>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>$teamRegressions$</h1>
</html>
</panel>
</row>
<row>
<panel>
<title>Best Regresion per week</title>
<chart>
<search>
<query>| inputcsv $teamTests$
| search groupID=$groupID$ regression_target=$regression_target$
| dedup thumb_print test_id
| search
[| inputcsv $teamRegressions$
| search groupID=$groupID$ regression_target=$regression_target$
| eval _time = strptime(regression_start_time, "%Y.%m.%d_%H:%M:%S")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d/%Y")
| sort -regression_target -Day1ofWeek -PASS
| streamstats count as counter by regression_target Day1ofWeek
| where counter <= 1
| rename a as "this is a set of thumb_prints of the best regressions from each week"
| table thumb_print]
| eval job_start_time = strftime(job_start_time, "%Y.%m.%d_%H:%M:%S")
| eval job_end_time = strftime(job_end_time, "%Y.%m.%d_%H:%M:%S")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d/%Y")
| table _time Day1ofWeek thumb_print test_id state status job_start_time job_end_time
| fillnull value=0
| eval _time = strptime(Day1ofWeek, "%m/%d/%Y")
| stats count(eval(status=="INCOMPLETE")) as INCOMPLETE count(eval(status=="INCONCLUSIVE")) as INCONCLUSIVE count(eval(status=="RUNNING")) as RUNNING count(eval(status=="FAIL")) as FAIL count(eval(status=="PASS")) as PASS by Day1ofWeek
| eval "Pass %" = floor((PASS / (PASS+FAIL+INCOMPLETE+INCONCLUSIVE+RUNNING))*100)</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleY.text">Number Of Tests</option>
<option name="charting.axisTitleY2.text">Pass %</option>
<option name="charting.axisY2.enabled">1</option>
<option name="charting.axisY2.maximumNumber">100</option>
<option name="charting.axisY2.minimumNumber">0</option>
<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">"Pass %"</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"PASS":10FF00,"FAIL":FF0000,"INCOMPLETE":0015FF,"INCONCLUSIVE":FF00EE,"RUNNING":FF9000,"Pass %":FFEE00}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.placement">bottom</option>
<option name="height">500</option>
</chart>
</panel>
</row>
</form>
what am I doing wrong?
Thanks
... View more
