About Rgk_Trail

Rgk_Trail · ‎03-17-2021

Ohhh.. Sorry about the misunderstanding.. basically I have different URLs in Training_Link column that point to webpages (udemy, corsera, etc) outside of the Splunk. So when I click on certain training, it should open the webpage URL in the new tab.

Rgk_Trail · ‎03-16-2021

Hi Vardhan, Thanks for the response. I tried using the code but it opens up the same dashboard in the separate browser tab. What I am trying to do is open an URL that is listed in "Training_Link" column. If I use my old code , it does open up the corresponding URL in new browser tab but it does that for the entire row.

Rgk_Trail · ‎03-15-2021

Hi, I am trying to enable drill-down on only single column present in table in my dashboard named "Training_Link". I tried using $column, not sure that's accurate. Then I shifted to $row, its working but drilldown in enabled on entire table. <option name="drilldown">cell</option> <drilldown> <link target="_blank">$row.Training_Link|n$</link> </drilldown> Any idea how can I do this ? - Rohan

Rgk_Trail · ‎01-20-2021

Worked like a charm ! Thanks a lot.

Rgk_Trail · ‎01-20-2021

Hi, I have a few fields in lookup from which I am trying to extract strings. I read that rex is what I should be using. Can anyone recommend how should I go about this ? I have attached lookup field and result of rex command that I want. - Thanks Rohan K.

Rgk_Trail · ‎10-16-2020

Thanks a lot ! it worked. I am also trying to sort the bar charts by the count but looks like it was working before but it doesnt work with eval statements in stats command. Can you suggest a way to sort the bars by the count ? |stats count(eval(CHG_Type="Normal")) as Normal count(eval(CHG_Type="Standard")) as Standard count(eval(CHG_Type="Emergency")) as Emergency by CHG_Type|sort - count </query> </search> <option name="charting.axisTitleX.text">Change Type</option> <option name="charting.axisTitleY.text">Number of Changes</option> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.fieldColors">{"Standard":#5DADE2,"Emergency":#85C1E9,"Normal":#3498DB}</option>

Rgk_Trail · ‎10-11-2020

Hi, I am trying to assign colors to the bars in my chart. I have 3 distinct values under variable "Change Type" and I am using charting.fieldColors but for some reason all the bars in the chart appear with default blue color. Am I doing something wrong here ? <panel> <chart> <title>Change Type Analysis</title> <search base="Base"> <query> |stats count by "Change Type"|sort -count </query> </search> <option name="charting.axisTitleX.text">Change Type</option> <option name="charting.axisTitleY.text">Number of Changes</option> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.fieldColors">{"Standard":0x9BE8AB,"Emergency":0xE87D6F,"Normal":0x5A4575}</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option> <option name="height">200</option> <option name="refresh.display">progressbar</option> </chart> </panel> - Rohan

Rgk_Trail · ‎10-09-2020

Hi, I am combining fields using strcat as shows below and I want to have "N/A" in the same field if result of strcat is Null. But for some reason, isnull or isnotnull command used after strcat is not identifying null values. Am I missing something here ? |strcat Key_1 Key_2 Key_3 Key_4 Testing_Key |eval Testing_Key=if(isnotnull(Testing_Key),Testing_Key,"N/A") Result should be either value of Testing_Key when its not null and it should "N/A" when Testing_Key is Null. Thanks, Rohan Kinhikar

Rgk_Trail · ‎09-26-2020

Thanks a lot !

Rgk_Trail · ‎09-25-2020

attached data from lookup. its multiline as single event. Its tied to unique field (change_request) in dataset. So goal is to extract change_request and name, group from approval for that change request.

Rgk_Trail · ‎09-25-2020

I am trying this command but it doesnt return any results, am i using it wrong ? |inputlookup change_task_xx| rex "\n(?<name>.+)\sapproved\s.+for\sgroup\s(?<group>.+)\n"|table change_request name group Output that I am getting: change_requests name group 1 2 3 name and group information exists in the field(approval) in the lookup . - Rohan K.

Rgk_Trail · ‎09-24-2020

Are these all separate events or does every event start with a timestamp but can be multi-line? Every event starts with timestamp, and its multi-line. for every event name and group is buried between some other information that is not relevant for the task. Does the group name always start with **? Ya. Always Does every line with name and group always have "approved" and "for group" in? Yes. Always. It may have "rejected" as well but I want to extract only one with "approved"

Rgk_Trail · ‎09-24-2020

Would this work if names(Jack Smith) and groups(**CAB - DEV Tech) change ? Actually, I was not very clear in my initial question. So I want to extract name of the person and the group from that field. So format will remain the same but names and groups will change. Any idea if I can extract based on matching string and then extract text based on spaces in between ? cause format will remain the same in my data. Thanks , Rohan

Rgk_Trail · ‎09-23-2020

Hi, I am trying to extract name of the individuals from the field that I have in the data. For example from the data below, I want to extract Jack Smith and Joe Shmoe. Any suggestions on how I can do this ? Some Text Some Text 24-Jul-2020 10:52:41 - Jack Smith (Approval history) Jack Smith approved INT128302 for group **CAB - DEV Tech Some Text Some Text 22-Jul-2020 12:56:37 - Joe Shmoe (Approval history) Joe Shmoe approved INT128302 for group **Dev - DBA Tech group Some Text Some Text Thanks ! Rohan

Rgk_Trail · ‎09-05-2020

Hi Giuseppe, Thanks for the quick response. I tried using your code but now it gives me error : RROR LookupDataProvider - Could not find all of the specified lookup fields in the lookup table.

Rgk_Trail · ‎09-05-2020

Hi, I am using combination of inputlookup and lookup to generate a report. I am using one field to join two lookup tables but both my tables have duplicate values. In the output I want to get unique rows containing fields from both lookup tables but I seem to get duplicate values in 2nd lookup table that I am joining. I am using dedup to remove duplicates from first table but It doesnt seem to work for second lookup. Can you suggest better way to do this ?

Posts	16
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎09-05-2020

Online Status	Offline
Date Last Visited	‎06-09-2021 10:58 AM

Drilldown to URL on single column

Extracting string from field in lookup

Bar Chart with colors

Handling Nulls

Extracting names from fields

Get distinct rows when using inputlookup and looku...

Re: Drilldown to URL on single column

Re: Drilldown to URL on single column

Drilldown to URL on single column

Re: Extracting string from field in lookup

Extracting string from field in lookup

Re: Bar Chart with colors

Bar Chart with colors

Handling Nulls

Re: Extracting names from fields

Re: Extracting names from fields

Re: Extracting names from fields

Re: Extracting names from fields

Re: Extracting names from fields

Extracting names from fields

Re: Get distinct rows when using inputlookup and l...

Get distinct rows when using inputlookup and looku...