About strehb18

gcusello · ‎09-13-2023

Hi @strehb18, if your requirement is to have only the last result and only one event, you could use something like this: <your_search> | join cwo type left [search source=punch index=your_index | rename work_center as position | sort -_time | head 1 ] Only one hint: the join command is a very slow command and it consumes many resources; there are usually other solutions to replace the join command, e.g. the stats command, but this depends on your use case. Ciao. Giuseppe

ldongradi_splun · ‎12-10-2021

Try where like. It can compare with any value inside the mv field. | where field1 LIKE (field2)

strehb18 · ‎10-28-2021

I can send more specific input if needed.

ITWhisperer · ‎10-21-2021

<panel id="panel" depends="$showpanel$"> <table> <search>...</search> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <drilldown> <unset token="showpanel"></unset> </drilldown> </table> </panel>

richgalloway · ‎05-27-2021

It's not just a potential limit, but an actual limit. The chart command, by default, shows 10 results. Use the limit option to change that. RTM at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Chart#Chart_options | chart limit=0 values(measure) over statistic by work_center

ITWhisperer · ‎04-15-2021

You can get user input to a dashboard by using the input elements. These can set tokens which can then be used on searches in the dashboard. Sorry for a generic answer. If you want something more specific, please ask.

strehb18 · ‎02-10-2021

Hello, This is a follow up post to my recent post on "Trouble with Hidden Panel Passing Value". I am having an issue with the safety ticker that I had implemented in that question. For some reason, the only result being posted is <news ticker>. The code is below. For some reason this code was working but now is not. The point of the search is to produce one result that shows the last safety incident but only in the last 48 hours. The ticker itself uses a marquee to show the results. <form> <search> <query> index=defmfg_safety work_center="S1**" | sort 0 -_time | dedup id | head 3 | stats max(corrective_actions{}) as corrective_action by investigation_result | eval corrective_action=if(corrective_action="30 day follow up" OR corrective_action="6 month follow up","PENDING",corrective_action) | eval result=investigation_result +" -CORRECTIVE ACTION- "+ corrective_action | eval ticker=result | eval length=ceil(len(ticker)/2) . "ms" </query> <earliest>-48h@h</earliest> <finalized> <condition match="$job.resultCount$ == 0"> <unset token="ticker"></unset> <unset token="ticker_result"></unset> </condition> <condition> <set token="ticker">$result.ticker$</set> <set token="ticker_result">$result.result$</set> </condition> </finalized> </search> <row depends="$ticker$"> <panel> <html> <style> #marquee { font-size: 30px; color: white; height: 45px; white-space: nowrap; line-height: 60px; } h2 { font-size: 30px !important; text-align: center; padding: 5px !important; color: red; } </style> <h2>SAFETY ALERT</h2> <marquee scrollamount="19" id="marquee">$ticker$</marquee> </html> </panel> </row> </form>

strehb18 · ‎02-01-2021

I am once again having issues with this code. For some reason this works, and then will stop working. Here is the entire code if that helps. I am wondering where the disconnect maybe. I can make a table and pass the value and it shows. <search> <query> index=defmfg_safety work_center="MAIN*" | sort 0 -_time | dedup id | head 3 | stats max(corrective_actions{}) as corrective_action by investigation_result | eval corrective_action=if(corrective_action="30 day follow up" OR corrective_action="6 month follow up","PENDING",corrective_action) | eval result=investigation_result +" -CORRECTIVE ACTION- "+ corrective_action | eval ticker=result | eval length=ceil(len(ticker)/2) . "ms" </query> <earliest>-48h@h</earliest> <finalized> <condition match="$job.resultCount$ == 0"> <unset token="ticker"></unset> <unset token="ticker_result"></unset> </condition> <condition> <set token="ticker">$result.ticker$</set> <set token="ticker_result">$result.result$</set> </condition> </finalized> </search> <row depends="$ticker$"> <panel> <html> <style> #marquee { font-size: 30px; color: white; height: 45px; white-space: nowrap; line-height: 60px; } h2 { font-size: 30px !important; text-align: center; padding: 5px !important; color: red; } </style> <h2>SAFETY ALERT</h2> <marquee scrollamount="19" id="marquee">$ticker$</marquee> </html> </panel> </row>

strehb18 · ‎01-11-2021

Hello, I generally use the following format to limit specific search results from panel to panel. However, in this case I would like to search for anything containing the string. [|loadjob $work_center_base$ | stats values(work_center) as location] This would limit the results in my search to only what is in the work_center field. I would like to match anything that contains what is in the location field. I won't this as the locations have more description after the work_center. ex: work_center 1CAP1 1CAP2 1CAP3 1CAP4 location (examples to match) 1CAP1-E3 1CAP2-W4 1CAP1-W1 1CAP4-E1 ... I am wondering if I can alter my search to match these and keep all locations that contain partials of work_center.

renjith_nair · ‎12-27-2020

strehb18 · ‎12-01-2020

That is mostly correct. I would like to search production_area=$production_area$ unless a sub_production_area is not at the default. Then I would like to search production_area=$sub_production_area$. Thinking about it now, the ideal solution would be to add the subs into the production_area dropdown, but I don't want all that clutter in the dropdown. | search index=def_mfg source=work_order production_area=$select_production_area$ Is the main search. The tokens are created through inputs. I can put those in but they will fill the page a bit.

richgalloway · ‎10-27-2020

See if this helps. It uses a case statement to see if _time is between 8:50 and 9:15 or between 11:50 and 12:30. There are a few hoops to jump through before that to get the starting time. <your search> | eval hr=strftime(_time,"%H"), min=strftime(_time,"%M") | eval startMin=(hr*60)+min | eval adder=case(startMin>=((8*60)+50) AND startMin<=((9*60)+15),15, startMin>=((11*60)+50) AND startMin<=((12*60)+30), 30, 1==1, 0) | eval duration=duration+adder

strehb18 · ‎10-19-2020

Yes! This worked for my data. Thank you for all the help.

ITWhisperer · ‎10-16-2020

Aggregate your results into wider chunks e.g. if you are counting by minute, try changing the span to 5m or 10m

Posts	28
Solutions	0
Karma Given	5
Karma Received	6
Member Since	‎10-01-2020

Online Status	Offline
Date Last Visited	‎09-15-2023 01:09 AM

Which record does a join function look at

Best Way to Find if Field Matches a Value in an MV...

Two Inputs Sending to a Collect Function

Hiding Panels After Unhiding a New Panel

"OTHER" being presented in a CHART function

Adding User Inputs into searches

Trouble With Ticker Not Populating

Searching for a partial string in a loadjob

Collecting _time from a different event

Best Way to Search based on a Token Value

Re: Which record does a join function look at

Re: Best Way to Find if Field Matches a Value in a...

Re: Two Inputs Sending to a Collect Function

Re: Hiding Panels After Unhiding a New Panel

Re: "OTHER" being presented in a CHART function

Re: Adding User Inputs into searches

Trouble With Ticker Not Populating

Re: Trouble with Hidden Panel Passing a Value

Searching for a partial string in a loadjob

Re: Collecting _time from a different event

Re: Best Way to Search based on a Token Value

Re: Adding in a break/lunch time into a duration

Re: Question for extracting a string out of longer...

Re: Adjusting the Individual Columns on a Column C...