Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About t_shreya
t_shreya
Path Finder
Member since:
09-04-2020
06-10-2021
Community Statistics
| Posts | 40 |
| Solutions | 7 |
| Karma Given | 0 |
| Karma Received | 6 |
| Member Since | 09-04-2020 |
Activity Feed
- Got Karma for Re: Recover fields after stats. 11-27-2022 09:26 PM
- Posted Re: Drilldown Editor on Dashboards & Visualizations. 06-10-2021 01:34 AM
- Posted Re: Drilldown Editor on Dashboards & Visualizations. 06-09-2021 10:03 PM
- Posted Re: Regex in transforms.conf on Splunk Search. 06-09-2021 09:45 PM
- Posted Re: Time picker shows up in the dashboard panel on Dashboards & Visualizations. 01-10-2021 09:11 PM
- Tagged Re: Time picker shows up in the dashboard panel on Dashboards & Visualizations. 01-10-2021 09:11 PM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-28-2020 05:20 AM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-28-2020 04:46 AM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-28-2020 12:45 AM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-28-2020 12:37 AM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-27-2020 11:48 PM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-27-2020 11:42 PM
- Posted Re: How do you sort by a specific order by the values of a field? on Dashboards & Visualizations. 12-27-2020 10:30 PM
- Posted Re: Split event for timechart on Splunk Search. 12-23-2020 05:51 AM
- Got Karma for Re: How to remove redudant data from a query. 12-22-2020 06:24 AM
- Posted Re: How to remove redudant data from a query on Splunk Search. 12-22-2020 05:31 AM
- Tagged Re: How to remove redudant data from a query on Splunk Search. 12-22-2020 05:31 AM
- Posted Re: help on xml formatting with css on Splunk Search. 11-27-2020 02:49 AM
- Posted Re: help on xml formatting with css on Splunk Search. 11-26-2020 02:56 AM
- Posted Re: help on xml formatting with css on Splunk Search. 11-24-2020 09:09 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
06-10-2021
01:34 AM
Hi @Als123 , In this case you will have to modify the search string used in drilldown. The following query will work in case you want to see raw events for the particular HTTP status code clicked on. index="main" httpstatus="$row.httpstatus$" Here, I have assumed that httpstatus is the field name for HTTP status code. Ref - https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Viz/DrilldownLinkToSearch
... View more
06-09-2021
10:03 PM
Hi @Als123 , Is it still giving issue when you save the dashboard and reload it? Usually, this error is thrown when we try to drilldown from the dashboard in the Edit Mode. If this a persistent issue, there may be an issue in the URL that is created from the search query, does the query contain any special characters such as +, &,< etc.? These characters need to be encoded. If possible, can you send the query that you want to show in the new tab to debug further?
... View more
06-09-2021
09:45 PM
Hi @TheBravoSierra , Can you check if the following works? <Data Name='TargetFilename'>.*\\(?<file>[\S\s+]*)<\/Data>
... View more
01-10-2021
09:11 PM
Hi, I'd wanted a similar thing for a dashboard and the following way had worked for me: <row depends="$hidden$">
<panel>
<table>
<search>
<done>
<set token="tkn_display_earliest">$result.earliest$</set>
<set token="tkn_display_latest">$result.latest$</set>
</done>
<query>| stats count
| eval earliest= replace("$time.earliest$","rt","")
| eval earliest = if(earliest!="",earliest,0)
| eval earliest=strftime(if(replace(replace(earliest,"\.\d+",""),"\d","")!="",relative_time(now(),earliest),earliest), "%b %d %Y %H:%M:%S")
| eval latest=strftime(if(replace(replace("$time.latest$","\.\d+",""),"\d","")!="",relative_time(now(),if("$time.latest$"="now" OR "$time.latest$"="rt" , "-0", "$time.latest$")),"$time.latest$"), "%b %d %Y %H:%M:%S")
| eval latest = if(isnull(latest), strftime(now(),"%b %d %Y %H:%M:%S"), latest)</query>
<earliest>$timeRange.earliest$</earliest>
<latest>$timeRange.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<html>
<h1>Time: $tkn_display_earliest$ - $tkn_display_latest$</h1>
</html>
</row>
... View more
- Tags:
- ve
12-28-2020
05:20 AM
In the original query that you posted in the question, you have been taking the latest duration for every task_id and run_id in the chart. If we go according to that, then, it seems we need to take into account the starttime of the task_id for the latest duration obtained. I think that would also solve our problem of having duplicate task_ids. For that the dummy_sort can be calculated after we have got the events having last duration for the task_id and run_id: | eventstats last(duration) as last_duration by run_id, task_id
| where duration = last_duration
| eval dummy_sort = starttime."_".task_id
| chart last(last_duration) as duration over run_id by dummy_sort
| foreach *_*
[ rename <<FIELD>> to <<MATCHSEG2>>
]
... View more
12-28-2020
04:46 AM
Hi, In the data, is it expected that same task_id can have different start time depending for the same run_id? So for eg, task_id "task_1" has maybe started twice for run_id "run_1". This will create two different field values like time1_task_1 and time2_task_2 in the dummy_sort field. However, on column rename both would have name If so, then the solution may be creating the problem.
... View more
12-28-2020
12:45 AM
Can you please share screenshots of the result obtained in table as well as the chart?
... View more
12-28-2020
12:37 AM
You are getting 0 in the column names or the field values?
... View more
12-27-2020
11:48 PM
< would be < > would be >
... View more
12-27-2020
11:42 PM
Yes, you can use that. The foreach would look something like this then: | foreach *_* [rename <<FIELD>> to <<MATCHSEG2>>]
... View more
12-27-2020
10:30 PM
Hi @D_D , The chart command while creating the columns would by default sort the field task_id as it has been mentioned in the by clause. I think you can create a dummy field which is a string joining the start time and task_id and use that field in the by clause of the chart command. The column names can be renamed using foreach. | eval dummy_sort = start_time."_".task_id
| chart last(duration) as duration over run_id by dummy_sort
| foreach *task_* [rename <<FIELD>> to task_<<MATCHSEG2>>] There may be a simpler way to do this. Thanks.
... View more
12-23-2020
05:51 AM
Hi @thuhuongle , I think the span attribute in timechart command may work for you. https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/SearchReference/Timechart#Span_options
... View more
12-22-2020
05:31 AM
1 Karma
Hi @azulgrana , Can you try the following? The search is basically creating a new field which is a string joining the fields - Name, IP and OS. Streamstats command has been used to calculate the number of times that string is found in the data and if the count is more than one, then eval has been used to make the fields blank. | makeresults
| eval data= "Name=ServerA IP=1.1.1.1 OS=\"Windows 2016\" Software=Word;Name=ServerA IP=1.1.1.1 OS=\"Windows 2016\" Software=Paint;Name=ServerA IP=1.1.1.1 OS=\"Windows 2016\" Software=VMWare Tools;Name=ServerB IP=1.1.1.2 OS=\"Windows 2016\" Software=Word;Name=ServerB IP=1.1.1.2 OS=\"Windows 2016\" Software=Paint;Name=ServerB IP=1.1.1.2 OS=\"Windows 2016\" Software=VMWare Tools;"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| table Name IP OS Software
| eval dummy_value = Name."+".IP."+".OS
| streamstats count by dummy_value
| eval Name = if(count>1,"",Name)
| eval IP = if(count>1,"",IP)
| eval OS = if(count>1,"",OS)
| table Name IP OS Software I obtained the following result:
... View more
- Tags:
- @
11-27-2020
02:49 AM
Hi, is this working for you? <dashboard stylesheet="myfile.css">
<row>
<html>
<h1 id="my_header">DEVICE</h1>
</html>
</row>
<row>
<html>
<p id="my_para">abcdefg..... </p>
</html>
</row>
</dashboard> myfile.css: h1#my_header
{
background: #848484 !important;
}
p#my_para
{
background: #848484 !important;
} Also, these may help you out: https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-js-css-Issue/m-p/154746 https://community.splunk.com/t5/Dashboards-Visualizations/js-and-css-scripts-not-working-for-Splunk-Dashboard/m-p/411691 https://community.splunk.com/t5/Dashboards-Visualizations/Unable-to-customize-dashboard-with-CSS/m-p/37235
... View more
11-26-2020
02:56 AM
Hi, Is there any error getting shown in the console of the browser? And if you are trying to replace class with ID in this case, is it working?
... View more
11-24-2020
09:09 PM
Hi @jip31 , not sure why it's not working for you. Are both internal or external css not working in the dashboard, or the css is not working only when it is linked externally? Also, did you try to _bump and refresh the dashboard to see if changes are getting reflected?
... View more
11-23-2020
09:10 PM
Can you confirm and let me know if the external css file is placed in appserver/static folder of the app?
... View more
11-23-2020
08:04 PM
Oh alright! Have you used the external css in the dashboard in the following manner? <dashboard stylesheet="myfile.css">
<row>
<html>
<h1 class="my_header">DEVICE</h1>
</html>
</row>
<row>
<html>
<p class="my_para">abcdefg..... </p>
</html>
</row>
</dashboard> and the following should be in myfile.css: h1.my_header
{
background: #848484 !important;
}
p.my_para
{
background: #848484 !important;
}
... View more
11-23-2020
06:58 AM
Hi @jip31 , the following code would add background to just the text and not the entire row: <html>
<style>
span.my_header
{
background: #848484 !important;
}
span.my_para
{
background: #848484 !important;
}
</style>
<h1 class="my_header"><span>DEVICE</span></h1>
<p class="my_para">
<span>abcdefg.....</span>
</p>
</html>
... View more
11-23-2020
03:12 AM
@jip31 , can you try the following? <html>
<style>
h1.my_header
{
background: #848484 !important;
}
p.my_para
{
background: #848484 !important;
}
</style>
<h1 class="my_header">DEVICE</h1>
<p class="my_para">
abcdefg.....
</p>
</html>
... View more
11-18-2020
03:33 AM
@marco_massari11 , I'm not sure if I got the question completely correct. But in case, you require only the results of the bar you clicked on, then you can retrieve the name of the field using : <set token="clicked_field">$click.name2$</set> and use the token $clicked_field$ to filter results in the query of the other dashboard.
... View more
11-18-2020
03:13 AM
1 Karma
@marco_massari11 , can you try using eventstats instead of stats?
... View more
11-10-2020
09:36 PM
@strehb18 , I tried the condition you have written and it worked for me. Not sure why it is not working for you.
... View more
11-05-2020
12:58 AM
@prateeksawhney , Can you share details about the field SNAPTIME_NEW, means some of the values that it has in it?
... View more
11-05-2020
12:26 AM
Hi @prateeksawhney , For today's events you would need to change -15m to @d | eval limit = relative_time(now(),"@d")
| where SNAPTIME_NEW >= limit
| sort SNAPTIME_NEW
... View more
