About t_shreya

t_shreya · ‎06-10-2021

Hi @Als123 , In this case you will have to modify the search string used in drilldown. The following query will work in case you want to see raw events for the particular HTTP status code clicked on. index="main" httpstatus="$row.httpstatus$" Here, I have assumed that httpstatus is the field name for HTTP status code. Ref - https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Viz/DrilldownLinkToSearch

venkatasri · ‎06-09-2021

Hi @TheBravoSierra [My_source_type] REPORT-file= extract_file [extract_file] REGEX = \<Data Name\=\'TargetFilename\'\>.*\\(?<file>[^<]+) FORMAT = file::$1 ----- An upvote would be appreciated if it helps!

strehb18 · ‎02-01-2021

I am once again having issues with this code. For some reason this works, and then will stop working. Here is the entire code if that helps. I am wondering where the disconnect maybe. I can make a table and pass the value and it shows. <search> <query> index=defmfg_safety work_center="MAIN*" | sort 0 -_time | dedup id | head 3 | stats max(corrective_actions{}) as corrective_action by investigation_result | eval corrective_action=if(corrective_action="30 day follow up" OR corrective_action="6 month follow up","PENDING",corrective_action) | eval result=investigation_result +" -CORRECTIVE ACTION- "+ corrective_action | eval ticker=result | eval length=ceil(len(ticker)/2) . "ms" </query> <earliest>-48h@h</earliest> <finalized> <condition match="$job.resultCount$ == 0"> <unset token="ticker"></unset> <unset token="ticker_result"></unset> </condition> <condition> <set token="ticker">$result.ticker$</set> <set token="ticker_result">$result.result$</set> </condition> </finalized> </search> <row depends="$ticker$"> <panel> <html> <style> #marquee { font-size: 30px; color: white; height: 45px; white-space: nowrap; line-height: 60px; } h2 { font-size: 30px !important; text-align: center; padding: 5px !important; color: red; } </style> <h2>SAFETY ALERT</h2> <marquee scrollamount="19" id="marquee">$ticker$</marquee> </html> </panel> </row>

t_shreya · ‎01-10-2021

Hi, I'd wanted a similar thing for a dashboard and the following way had worked for me: <row depends="$hidden$"> <panel> <table> <search> <done> <set token="tkn_display_earliest">$result.earliest$</set> <set token="tkn_display_latest">$result.latest$</set> </done> <query>| stats count | eval earliest= replace("$time.earliest$","rt","") | eval earliest = if(earliest!="",earliest,0) | eval earliest=strftime(if(replace(replace(earliest,"\.\d+",""),"\d","")!="",relative_time(now(),earliest),earliest), "%b %d %Y %H:%M:%S") | eval latest=strftime(if(replace(replace("$time.latest$","\.\d+",""),"\d","")!="",relative_time(now(),if("$time.latest$"="now" OR "$time.latest$"="rt" , "-0", "$time.latest$")),"$time.latest$"), "%b %d %Y %H:%M:%S") | eval latest = if(isnull(latest), strftime(now(),"%b %d %Y %H:%M:%S"), latest)</query> <earliest>$timeRange.earliest$</earliest> <latest>$timeRange.latest$</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <html> <h1>Time: $tkn_display_earliest$ - $tkn_display_latest$</h1> </html> </row>

D_D · ‎12-28-2020

i added "limit=0" to the chart command to avoid "OTHER", but i get the same results as before.

thuhuongle · ‎12-23-2020

Hi @t_shreya, I dont think span could be a solution because i need to split a event to multiple events based on its begin and end accordingly. Thanks anyway

azulgrana · ‎12-22-2020

Nice!, thanks @t_shreya. I will test this in my environment Cheers AzulgranaPDX

jip31 · ‎12-01-2020

Is anybody can't help?

ITWhisperer · ‎11-18-2020

I don't know what you mean by that. Can you show your SimpleXML for your dashboard panels?

marco_massari11 · ‎11-18-2020

@t_shreya It works!!! Thank you so much

ITWhisperer · ‎11-05-2020

All the events you have shown have old dates in SNAPTIME. Are there any results to be found matching your criteria?

jip31 · ‎11-03-2020

Hi OK I thought the header 'host" will not be created automatically..... Thanks

t_shreya · ‎10-21-2020

Hi @ramyaashok , I'm not sure how to create a table exactly in the way that you want. But it is possible to create a table in the following format: file status name_of_job1 name_of_job2 name_of_job_3 name_of_job_4 abc waiting time_of_job1 def collected time_of_job2 time_of_job4 hij waiting time_of_job3 by using the following query: your_results| eventstats count as duplicates by file | eval status = if(duplicates>1,"Data collected","waiting for data") | table file, status | join file [| search your_results | chart values(_time) over file by job limit=10] you can increase/decrease the limit parameter to put a threshold on the number of columns to be shown.

t_shreya · ‎10-20-2020

@pitmod I'm sorry, I misunderstood your question and thought that you wanted a vertical threshold line. I'm not completely sure for the horizontal threshold, but can you try something like this? | mysearch | eval Treshold=90| timechart span=120min latest(Treshold) as Treshold avg(MyPredictedValue) as PredictedValue | predict "PredictedValue" as prediction algorithm=LLT holdback=12 future_timespan=96 upper95=upper95 lower95=lower95 | eval _ft=96 | eval _hb=12 | eval _vars=mvappend("PredictedValue","Treshold") | eval _ci=95

t_shreya · ‎10-20-2020

Hi @aditsss I think that your current query would result into something like this: OrgName="value1" OR "value2" OR "value3".. You can try the following to see if it works. Provide value prefix as OrgName= in the multiselect filter which would set the token as (OrgName=value1 OR OrgName=value2 OR..). This means the code would be something like this: <label> Licenses Clone06</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="OrgName" searchWhenChanged="true"> <label>Org Name</label> <choice value="*">All Salesforce Org</choice> <search> <query>index="ABC" sourcetype="XYZ" | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | stats count by OrgName</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <fieldForLabel>OrgName</fieldForLabel> <fieldForValue>OrgName</fieldForValue> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source="</valuePrefix> <delimiter> OR </delimiter> <initialValue>*</initialValue> <default>*</default> </input> And the subsequent change the query would be to just have the token name: index="ABC" sourcetype="XYZ" $type$ |lookup Org_Alias.csv OrgFolderName OUTPUT OrgName| search $OrgName$|dedup OrgName, LicenseName, OrgId |stats sum(TotalLicenses) as "Total-Licenses" sum(UsedLicenses) as "Used Licenses" sum(UnusedLicenses) as "Unused Licenses" by LicenseName OrgName OrgId | sort -Total-Licenses

t_shreya · ‎10-19-2020

Hi @inventsekar Actually, Splunk provides translations for only some of the strings. I was trying to add my own translations in Japanese for the strings present in a specific app to provide it to the customers. The app consisted of some of the strings which are not converted by Splunk and some for which Splunk already provided a translation. This can be seen in the attached image. In this case, the Splunk has not provided any translation for "Landscape Overview" and "Span". I figured out that this can be done as specified in the following document: https://docs.splunk.com/Documentation/Splunk/8.0.6/AdvancedDev/TranslateSplunk I was able to add translations for strings not converted by Splunk for the Splunk components such as navigation menu, dashboard titles, filters. In addition, I could change the default translation provided by Splunk for some string and substitute it with my own conversions in case of dashboard titles and filters. But the same thing failed for navigation menus. So, I was looking for something where I can change the default translations that Splunk provides for the Japanese language and add my own Japanese translations in case of navigation menus.

t_shreya · ‎10-19-2020

Hi, I think the following query may help. ...| bin span=1d _time | eventstats count as FailedLoginForThisDay by user,_time | eventstats avg(FailedLoginForThisDay) as avg_failed_logins by user | where avg_failed_logins < FailedLoginForThisDay | table user, ipaddr, ... where, bin span=1d _time would help divide the data into 1 day buckets, eventstats count as FailedLoginForThisDay by user,_time would calculate the number of failed logins per day and user eventstats avg(FailedLoginForThisDay) as avg_failed_logins by user would calculate the average failed logins per user Thanks.

Posts	40
Solutions	7
Karma Given	0
Karma Received	6
Member Since	‎09-04-2020

Online Status	Offline
Date Last Visited	‎06-10-2021 10:21 AM

Changing default conversion provided by Splunk for...

Re: Drilldown Editor

Re: Regex in transforms.conf

Re: Trouble with Hidden Panel Passing a Value

Re: Time picker shows up in the dashboard panel

Re: How do you sort by a specific order by the val...

Re: Split event for timechart

Re: How to remove redudant data from a query

Re: Help on xml formatting with css

Re: Search different results with token

Re: Recover fields after stats

Re: How to extract latest events of particular fie...

Re: help on outputlookup field name

Re: comparing values of same field for duplicate

Re: draw treshold line in predict forecastviz

Re: Not all the values are populating from the dro...

Re: Changing default conversion provided by Splunk...

Re: Dynamically generate user login failures