About msage

msage · ‎07-27-2022

Looking to create a chart that can separate results into groups of how often they appear in a time range. We're looking to figure out attendance in our office and find out which employees are showing up 1, 2, 3 times per week to get a better understanding. Is this something that can be done?

msage · ‎07-22-2022

Actually you were correct. Not having the quotation marks was what was giving me issues.

msage · ‎07-22-2022

Tried that and it won't work for whatever reason. All the results are blank

msage · ‎07-21-2022

Working on a search where there's a field (Office Location) with about 5 different values that are stored in a lookup file. We're looking at attendance at a specific office (office 1) and differentiating who's actually going in. Specifically, we want to isolate people assigned to office 1 and those that are assigned to a different office. The original search looks like this but it would populate all the locations rather than just office 1 or not. index=index EVDESCR="event" READERDESC="reader" | lookup users.csv ID as EMPLOYEE_ID |timechart span=1d dc(CARDNUM) by Location limit=0 I tried using this eval statement to hopefully isolate the search to just two values. Yes, home office or no home office. |eval Home=if(Location"office1", yes, no) The problem is this eval statement doesn't work and I'm not sure what I'm doing wrong. Any help is appreciated.

msage · ‎07-21-2022

Looks like this solution worked! However I did have to make a tweak to make mine work. I added a line underneath the inputlookup and used the search command. And then in the actual chart I did the same and added all 3 tokens. Thank you for your help! <input type="dropdown" token="Function"> <label>Function</label> <fieldForLabel>Function</fieldForLabel> <fieldForValue>Function</fieldForValue> <search> <query>|inputlookup all_users.csv |table Function |dedup Function</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="dropdown" token="Hierarchy"> <label>Hierarchy</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Hierarchy</fieldForLabel> <fieldForValue>Hierarchy</fieldForValue> <search> <query>|inputlookup all_users.csv |search Function="$Function$" |table Hierarchy |dedup Hierarchy</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="Cost_Center"> <label>Cost Center</label> <fieldForLabel>Cost_Center</fieldForLabel> <fieldForValue>Cost_Center</fieldForValue> <search> <query>|inputlookup all_users.csv |search Function="$Function$" Hierarchy="$Hierarchy$" |table Cost_Center |dedup Cost_Center</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> </input> </fieldset>

msage · ‎07-21-2022

I'm looking to find a way to have multiple nested filters in a dashboard. Currently I'm creating attendance charts for our estaff and we require some more granularity due to the amount of unique data there is. The goal is to be able to isolate 3 values. Function, Hierarchy, and Cost Center. Currently there are 3 functions, 28 hierarchies, and nearly 200 cost centers. With the nested filters I hope to be able to choose a function which would only populate hierarchies under that function. Then when choosing a hierarchy only populating the cost centers under it. The issue I'm running into is that I'm able to create a two filters but once I add the 3rd filter the entire search breaks and the charts no longer update.

msage · ‎08-11-2021

It does yes

msage · ‎08-10-2021

Hey @manjunathmeti , I tried this but unfortunately the lookup data always stays at 0.

msage · ‎08-03-2021

I'm looking to combine data from a lookup file to data from our security server to create a comparison chart between how many alarms we get (security server) and how many of those are acknowledged (lookup file). I figured multisearch was the way to go but I'm getting errors when using it. The search is below. The reason for the eval Date fields are because one column contains dates so I needed to get them in the right order since they were always out. The end goal is a daily chart showing x alarms and y acknowledgements. | multisearch [| inputlookup genericlookupname.csv | eval Date=strptime(Date,"%m/%d/%Y") | sort Date | eval Date=strftime(Date,"%m/%d/%Y")] [search index=index EVDESCR="alarm"]

msage · ‎06-17-2021

Hey @yuanliu basically what it was doing was getting the average of all the days by 220 rather than average of each day. However the search string you just provided seems to be the perfect solution for this.

msage · ‎06-15-2021

A bit ago I submitted a question regarding how to get the average alarms per reader. So for example we have 100 alarms and 100 readers. That's on average 1 alarm per reader. With the help of the forum I got my answer but now I need to figure out how to get a trend of this search. I tried using a timechart but based on the way the search is built, it completely skews the results. Here's the search itself index="index" EVDESCR="EVDESCR" | dedup EVENT_TIME | bucket _time span=1d | stats count by READERDESC | stats sum(count) as sum_count | eval result=sum_count / 220

msage · ‎04-23-2021

I'm trying to track Ringcentral data that we have in Splunk now and the objective is to sort and alert us to missed calls. However the data isn't organized the way I'm used to. This is. a snippet of the event. What I want to do is utilize the rex field to sort by result. These are some of the different results we have. If you need any information please let me know "result" : "Missed" "result" : "Accepted" "result" : "Call Connected "duration":39,"type":"Voice","direction":"Inbound","action":"Phone Call","result":"Missed"

msage · ‎03-22-2021

So I'm having trouble figuring this one out. Basically for example we have 1000 alarms per day and 100 readers in our office. This would be an average of 10 alarms per reader. My question is how would i put that into a search that gets the info for me? I'm fairly new to Splunk but here's what I have. However this returns no results. index="index" EVDESCR="Alarm" |stats avg(EVDESCR) by READERDESC

msage · ‎10-23-2020

Apologies for the late reply @bowesmana and @inventsekar . To answer your questions yes I can isolate the cost center when using the inputlookup command and it was indeed the timechart that was the culprit. I've figured it out using both your help so thank you very much! In case anyone else stumbles upon this question this is the search I used. index="my index" EVDESCR="specific event" READERDESC="criteria" | lookup user_lookup.csv user_employee_number as EMPLOYEE_ID |search user_esc_cost_center="specific cost center" |timechart span=1d dc(CARDNUM) AS EVDESCR

msage · ‎10-13-2020

I'm working on a project for work where I want to see employee entry data for specific groups. We have a lookup file that has everyone's cost center that I use to see everyone's entries into an office as well as what team they're in. However now I want to see more granular data by only showing one cost center rather than all of them. Here's my current search that I can't get to work index="myindex" EVDESCR="Access Granted" READERDESC="yes*" |lookup user_lookup.csv user_employee_number as EMPLOYEE_ID |search user_esc_cost_center="specific group" |timechart span=1d dc(EMPLOYEE_ID) by FIRSTNAME I keep getting 0 results but I'm not sure how else to get around to this. I'm fairly new to Splunk and am basically self teaching with a little help from our other teams.

msage · ‎08-03-2020

I got it to work thank you so much for your help!

msage · ‎08-03-2020

Hey thanks for the reply! I tried doing this but it seems to connect both series into one when I try

msage · ‎08-03-2020

I want to create a chart showing the attendance between pre covid (February) and current covid (July) for one of our offices. This is my current search which gets me the data I need but I'm unsure on how to overlap the data so we can see the direct comparison. | multisearch [search index="physec_app_lenel" EVDESCR="Access Granted" READERDESC="TOK*" earliest="07/01/2020:20:00:00" latest="07/28/2020:23:00:00" | eval Attendance="July"] [search index="physec_app_lenel" EVDESCR="Access Granted" READERDESC="TOK*" earliest="02/01/2020:01:00:00" latest="02/28/2020:23:00:00" | eval Attendance="February"] | timechart span=1w dc(CARDNUM) by Attendance

Posts	18
Solutions	0
Karma Given	9
Karma Received	3
Member Since	‎08-03-2020

Online Status	Offline
Date Last Visited	‎08-10-2023 01:08 PM

How to separate data into groups of how often they...

How to get this eval statement to isolate the sear...

How to create multiple nested filters in a dashboa...

multisearch with a lookup and index?

Average alarms per reader over time

New to REX field. How would I go about extracting ...

Average alarms per reader

How to isolate a specific field in a lookup file

Comparing attendance info for two months (Feb and ...

How to separate data into groups of how often they...

Re: How to get this eval statement to isolate the ...

Re: How to get this eval statement to isolate the ...

How to get this eval statement to isolate the sear...

Re: Multiple nested filters

How to create multiple nested filters in a dashboa...

Re: multisearch with a lookup and index?