About ITWhisperer

ITWhisperer

Splunk is not really a report generating tool. Having said that, you can spoof it by manipulating the events to make it look like a report index=myindex | stats count as events values(_raw) by host | eval row=mvrange(0,2) | mvexpand row | eval "values(_raw)"=if(row=0,"----------------- Host: ".host." -----------------",'values(_raw)') | fields - host events row Note that you don't need the sort since values() will sort for you and given that your events already start with a timestamp, which, when sorted lexicographically, will appear in time order, and stats will sort the hosts for you as this field is in the by clause.

sh254087

I have the cloud consumption information indexed in real-time. I do not (or can not) have the consumption information in a csv. I want this map to showcase the cloud consumption data across different regions in real-time. I can come up with a csv having long and lat values for each cloud-regions. I'm unsure how to link these two to come up with the map visualization.

yuanliu

Based on the layout, I hypothesize that the count column is in ascending order. If it is so, find the maximum then compare each row with it. | eventstats max(Count) as maxcount | where Count < maxcount

ITWhisperer

You can use a case function to evaluate the value of a field e.g. | eval alarm=case(PRIORITY=02 AND Condition="Alarm","Critical",PRIORITY=12 AND Condition="Alarm","High",PRIORITY=22 OR PRIORITY=25 AND Condition="Alarm","Low",PRIORITY=02 OR PRIORITY=12 OR PRIORITY=22 OR PRIORITY=25 AND Condition="Clear","Cleared")

ITWhisperer

You could try defining WILDCARD lookups in the lookup definition for the field e.g. Connection timed out *

marksheinbaum

I accepted the solution. However, I'm surprised that the cloning process does not generate that automatically.

isoutamo

Here is some old answers and other examples/instructions how to use it https://community.splunk.com/t5/Getting-Data-In/REST-API-endpoints-for-saved-searches/m-p/355507 https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches https://community.splunk.com/t5/Splunk-Search/How-to-execute-a-saved-search-using-Splunk-s-REST-API/m-p/358699 https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtowork/#To-view-and-modify-the-properties-of-a-saved-search https://community.splunk.com/t5/Reporting/How-to-start-a-saved-search-using-REST-API/m-p/88026 https://hurricanelabs.com/splunk-tutorials/splunk-searching-with-rest-api/ https://stackoverflow.com/questions/70541196/http-get-method-for-splunk-saved-search-using-access-token

ITWhisperer

Try something like this index=my_index sourcetype=openshift_logs openshift_namespace=my_ns openshift_cluster="cluster009" ("message.statusCode"=20* OR "message.statusCode"=4*) | eval status=if('message.statusCode'>300,"fail","success") | search "message.logType"=CLIENT_RES | search "message.url"="/shopping/carts/*" | timechart span=1h dc("message.tracers.id{}") as count by status

ITWhisperer

Here is a runanywhere example showing your replace working | makeresults | fields - _time | eval _raw="{ \"durationMs\": 83, \"properties\": { \"request-id\": \"1c910793-8be4-4850-83d5-f360b4b05478\", \"method\": \"GET\", \"path\": \"/scenarios/636d40506930b10b8f082f27\" } }" | spath | eval path=replace('properties.path',"(\/[0-9a-zA-Z]{15,}|\/\d+)","/{id}") | stats values(path) by properties.path , properties.method Which version of Splunk are you running?

ITWhisperer

Depending on whether the final field is important, you could do something like this | rex max_match=0 "(?<field>\"[^\"]*\"),?" | eval categories=split(trim(mvindex(field,9),"\""),",")

jamie1

Hi There, The majority of the panels on the dashboard are tables, so I'm going to accept that search as the solution. I do hope that they eventually add the option to display an image or some sort of message for all types of panel when there is no data to be displayed. Jamie

SplunkDash

Hello @isoutamo, I know this is the best we can do for now. Thank you so much, truly appreciate your support.

Abhay

https://splunkonbigdata.com/difference-between-streamstats-and-eventstats-command-in-splunk/

jamie1

Hi @isoutamo, Thanks for the additional info, I've got the CIM app set up and managed to achieve my goal just in the Splunk settings. Once again, thanks for the info, Jamie

ITWhisperer

Your timewrap should be 1w not 4d as you want the same days in the previous week

ITWhisperer

<row> <panel depends="$stayhidden$"> <html> <style> #piechart table.highcharts-tooltip tbody tr:nth-child(3) td{ display:none !important; } </style> </html> </panel> <panel> <title>LastLogon-New</title> <chart id="piechart"> <search> <query>| savedsearch XYZ | where $apps$ and $bscode$ and $function$ and $dept$ and $country$ and $emp_type$ | eval current_date = now() | eval six_months_ago = relative_time(current_date,"-6mon@d") | eval Twelve_months_ago = relative_time(current_date,"-12mon@d") | eval converted_date = strftime(six_months_ago, "%Y-%m-%d %H:%M:%S") | eval converted_date12 = strftime(Twelve_months_ago, "%Y-%m-%d %H:%M:%S") | eval LASTLOGON1= IF(isnull(LASTLOGON),"NULL", (if (LASTLOGON < converted_date and LASTLOGON >converted_date12 ,"More Than 6 Months",(if(LASTLOGON < converted_date12,"More Than 12 Months","Less than 6"))))) | eval CURRENT_date = strftime(current_date, "%Y-%m-%d %H:%M:%S") | where LASTLOGON1!="Less than 6" | table LASTLOGON,converted_date,CURRENT_date,LASTLOGON1 | stats count by LASTLOGON1</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </form>

POR160893

Hi, This doesn't work. When I input "10.105.12.19" as the input, it generates no results and the resulting search is as follows: | inputlookup firewall_rule_owner | where like(src_ip,"10.105.12.19") OR like(dest_ip,"10.105.12.19") When I input multiple IP addresses as the input (comma separated) i.e. 10.105.12.19, 10.175.96.146, I also generate no results and the resulting search is: | inputlookup firewall_rule_owner | where like(src_ip,"10.105.12.19, 10.175.96.146") OR like(dest_ip,"10.105.12.19, 10.175.96.146") Finally, when I input nothing and the dashboard runs on the default text field value *, I generate no results with the search: | inputlookup firewall_rule_owner | where like(src_ip,"*") OR like(dest_ip,"*") I need all 3 instances to work for the stakeholder. Can you please help?

ITWhisperer

If the index name appear multiple times, it is because there is a difference in the other fields. For example, with hod (hour of day?) it is perhaps not surprising that the stats are difference for different times of the day or day of the week (dow?). Depending on your data, this makes sense, you possibly want your model to take time into account so that you can pick up on anomalies for normal behaviour when compared to the same time periods. (This is certainly how I have used it.) If you don't want the index to appear more than once, you need to remove the varying fields, but that could limit the relevance of the model.

damode1

After spending hours doing trial and error, I finally was able to craft an SPL that gave me the expected result index=botsv3 sourcetype=xmlwineventlog | spath | rename Event.EventData.Data as EventDataData, Event.EventData.Data{@Name} as EventDataName EventID as ID Computer as Hostname TimeCreated as Timestamp | eval EventData=json_object("EventData",json_object(mvindex(EventDataName,0),mvindex(EventDataData,0))) | eval count=0 | foreach mode=multivalue EventDataName [ | eval EventData=json_set(EventData,"EventData."+mvindex(EventDataName,mvcount(<<ITEM>>)+count),mvindex(EventDataData,mvcount(<<ITEM>>)+count)),count=count+1] | foreach ID Hostname Timestamp [ | eval EventData=json_set(EventData,"<<FIELD>>",<<FIELD>>)] | table EventData

man03359

Thanks a lot 🙂 It worked 🙂 🙂

Posts	7626
Solutions	1687
Karma Given	35
Karma Received	2298
Member Since	‎2020-08-18

Help with mvexpand limits, one issue is the memory...

Re: List of events per host, with heading per host...

Re: How to plot choropleth data on maps? I have da...

Re: How to delete last row in a table?

Re: If The Else Condition

Re: Lookup Match

Re: Why is Classic Time picker not cloned in dashb...

Re: Report ID

Re: Splunk search for PASS and FAIL

Re: replace is giving empty string

Re: Parsing Fields Properly

Re: Is there a way to show a message when no searc...

Re: Field Extraction -Key/ Value Pairs with Specia...

Re: Diffrence between stats eventstats streamstats

Re: Is there a way to link field names?

Re: Compare assets from previous week and highligh...

Re: How to remove highlighted value in pie chart?

Re: Unable to search with String tokens against 2 ...

Re: Building a machine learning model for high vol...

Re: How to convert nested xml block into json form...

Re: How to extract a field in using regex?