Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About michael_vi
michael_vi
Path Finder
Member since:
02-18-2021
03-17-2024
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 1 |
| Member Since | 02-18-2021 |
Activity Feed
- Posted Re: Split sourcetype + indexed fields on Getting Data In. 03-17-2024 12:04 AM
- Karma Re: Replication factor change before indexer removing for richgalloway. 03-13-2024 09:49 AM
- Posted Split sourcetype + indexed fields on Getting Data In. 03-13-2024 09:27 AM
- Posted Replication factor change before indexer removing on Deployment Architecture. 03-13-2024 09:13 AM
- Posted Re: Regex extraction with different field delimiters on Getting Data In. 12-31-2023 10:52 AM
- Posted Re: Regex extraction with different field delimiters on Getting Data In. 12-31-2023 04:49 AM
- Posted Re: Regex extraction with different field delimiters on Getting Data In. 12-31-2023 03:47 AM
- Posted Re: Regex extraction with different field delimiters on Getting Data In. 12-31-2023 02:37 AM
- Posted Re: Regex extraction with different field delimiters on Getting Data In. 12-31-2023 02:16 AM
- Posted Regex extraction with different field delimiters on Getting Data In. 12-31-2023 01:42 AM
- Posted Re: No Hebrew is shown in PDF on Reporting. 11-13-2023 02:40 AM
- Posted Re: How to add custom fonts (cyrillic) to use in PDF reports in Splunk 6.3? on Reporting. 11-13-2023 12:42 AM
- Tagged Re: How to add custom fonts (cyrillic) to use in PDF reports in Splunk 6.3? on Reporting. 11-13-2023 12:42 AM
- Tagged Re: How to add custom fonts (cyrillic) to use in PDF reports in Splunk 6.3? on Reporting. 11-13-2023 12:42 AM
- Posted No Hebrew is shown in PDF on Reporting. 11-09-2023 01:27 AM
- Posted How to Connect Splunk Universal Forwarder to MC? on Monitoring Splunk. 09-10-2023 02:54 AM
- Posted Re: Rest API for splunkbase to get list of all apps and version details on Splunk Enterprise. 09-07-2023 04:43 AM
- Karma Re: Drilldown with depends in Number Display wiz for bowesmana. 07-25-2023 11:03 PM
- Posted How to Drilldown with depends in Number Display wiz? on Dashboards & Visualizations. 07-18-2023 03:52 AM
- Posted Re: Rest API for splunkbase to get list of all apps and version details on Splunk Enterprise. 07-09-2023 04:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-13-2024
09:27 AM
I have an issue with adding indexed fields to each of the new (splatted) sourcetype: Configuration that "duplicated" indexed fields for each sourcetype: Now I see fields: indexedfileds1, indexedfileds2 and indexedfileds3 as 200%, For example: indexedfields1 values: valuie1 150% value2 50% props.conf [MAIN SOURCE]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-changesourcetype = sourcetype1, sourcetype2
TRANSFORMS-indexedfields = indexedfield1, indexedfield2, indexedfield3
[sourcetype1]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
[sourcetype2]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999 transforms.conf [indexedfield1]
REGEX=
FORMAT=
WRITE_META=
[indexedfield2]
REGEX=
FORMAT=
WRITE_META=
[indexedfield3]
REGEX=
FORMAT=
WRITE_META=
[sourcetype1]
DEST_KEY-MetaData:Sourcetype
REGEX = some regex
FORMAT = sourcetype::sourcetype1
[sourcetype2]
DEST_KEY-MetaData:Sourcetype
REGEX = some regex
FORMAT = sourcetype::sourcetype2 I thought to move the indexed fields to each of the new sourcetype but then I see no indexed fields. Check with | tstats count props.conf [MAIN SOURCE]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-changesourcetype = sourcetype1, sourcetype2
[sourcetype1]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-indexedfields = indexedfield1, indexedfield2, indexedfield3
[sourcetype2]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-indexedfields = indexedfield1, indexedfield2, indexedfield3 What is the needed configuration to see indexed fields per sourcetype, w/o showing 200% Thanks
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
03-13-2024
09:13 AM
Hi, We have 3 indexers and 1 search head (replication factor = 3).I need to permanently remove one indexer What is the correct procedure: 1. Change replication factor = 2 and then remove indexer OR 1. Remove indexer and after that change the replication factor to 2 Thanks
... View more
Labels
- Labels:
-
indexer
-
indexer clustering
12-31-2023
10:52 AM
Looks good. I'll check it. I also thought of using EVAL after extraction to replace NULLs and spaces: EVAL-OldType=if(isnull(OldType) OR OldType = " ", "noData", OldType)
EVAL-NewType=if(isnull(NewType) OR NewType = " ", "noData", NewType)
... View more
12-31-2023
04:49 AM
Managed to fix the old and new in props.conf: | rex "^([^\|]*\|){19}(?<OldType>[^\~|\|]*)\~|\|"
| rex "^([^\|]*\|){19}.+~(?<NewType>[^\|]*)\|" Still having trouble with the || (null values)
... View more
12-31-2023
03:47 AM
Something is missing. The 'NewType' filed may or may not start with the ~, if no data then it will start with the | In the attached picture the field 'NewType' is missing for the event that has only pipes.
... View more
12-31-2023
02:37 AM
@gcusello The problem is that, once props can't extract the field. it won't be shown in extracted fileds. so.. | fillnull value=NULL will not work
... View more
12-31-2023
02:16 AM
Good idea to combine... Is it possible to replace the NULL with space w/o using SPL? Within the porps.conf
... View more
12-31-2023
01:42 AM
Hi all, I have a very specifc regex extraction (search time extraction) _raw data example: | union [| makeresults | eval _raw = "Dec-28-2023|12:05:46,836|10.150.6.118|148:|some branch|uswer_name|d168a8b9-5647-421b-97ba-f2aa3bceb69a|1:Creation page stack|Success|action_portfolio_forms_c_save.action|8970:PORTFOLIO ONBOARDING - FORMS CAPTURE||3065254228||||||| ~newType|||"] [| makeresults | eval _raw = "Dec-28-2023|12:05:46,836|10.150.6.118|148:|some branch|uswer_name|d168a8b9-5647-421b-97ba-f2aa3bceb69a|1:Creation page stack|Success|action_portfolio_forms_c_save.action|8970:PORTFOLIO ONBOARDING - FORMS CAPTURE||3065254228|||||||oldType~newType|||"] [| makeresults | eval _raw = "Dec-28-2023|12:05:46,836|10.150.6.118|148:|some branch|uswer_name|d168a8b9-5647-421b-97ba-f2aa3bceb69a|1:Creation page stack|Success|action_portfolio_forms_c_save.action|8970:PORTFOLIO ONBOARDING - FORMS CAPTURE||3065254228||||||||||"] I want to extract 2 fields from position 19 of the pipe and until 20th position that include (or may not) 2 fields that need to be extracted new: comes right after 19th | and before ~ old: comes after ~ and before 20th | There are 3 option that the data may appear: |<space>~newType| |oldType~newType| |<null><null>| The problem that I have is when no data is presented (3rd option) , then the props.conf doesn't parse it In the end I need to have 2 fields, based on the example above: old new <space> newType oldType newType <space> <space> props.conf [user_activity]
REPORT-bb_extract = REPORT-bb_extract
EXTRACT-oldAccountType = ^(?:[^|]*\|){19}(?<old>[^\~|\|]*)
EXTRACT-newAccountType = (?:[^~]*\~){1}(?<new>[^|]*) transforms.conf [REPORT-bb_extract]
KEEP_EMPTY_VALS = true
DELIMS = "|"
FIELDS = "DATE","TIME","ip","branch","appName","userName","actionID","actionType","actionStatus","actionName","action","srcPortfolioId","refID","currency","TotalAmount","secondPortfolioId","multiTransfer","field18","field19","id2","field21","new","old" 1. How can I extract the field that may or may not include some value 2. How can I fix the the second regex to start with ~ after 19th | Thanks
... View more
Labels
- Labels:
-
field extraction
11-13-2023
02:40 AM
Yes, I did The thing is, the that any new font that I put into the fonts folder gives me gibberish...
... View more
11-13-2023
12:42 AM
After putting the new fonts, should I make any changes to reportCIDFontList = <string> In alert_actions.conf
... View more
11-09-2023
01:27 AM
I have a simple report that that has Hebrew in it. Exporting to CSV works as it should and I see the Hebrew in it, but exporting to PDF shows nothing. | makeresults
| eval title = "לא רואים אותי" Can someone help? Thanks
... View more
Labels
- Labels:
-
PDF
-
saved search
09-10-2023
02:54 AM
Hi,
I didn't find detailed info, how to connect Universal Forwarders to Monitoring Console.
In our organization there is no deployment server, but we do want to monitor Splunk UF/HF with monitoring console, so the info can be seen on MC > Forwarders > Forwarders: Deployment
What are the steps on the UF side to configure this.
Thanks
... View more
- Tags:
- splunk search
Labels
- Labels:
-
forwarder
-
monitoring console
09-07-2023
04:43 AM
import requests
url = "https://splunkbase.splunk.com/api/v1/app/"
limit = 1
url2= "https://splunkbase.splunk.com/api/v1/app/"
with open(r"C:\Users\denis.zarfin\PycharmProjects\pythonProject2\main.txt", 'w') as f:
f.write("name" + ", " + "uid" + ", " + "title" + ", " +'\n')
offset = -1
all_numbers = []
try :
while True:
offset += 1
try:
response = requests.get(url, params={"limit": limit, "offset": offset})
data = response.json()
for i in data["results"]:
url2 = str(url2) + str(i["uid"]) + "/release/"
response2 = requests.get(url2)
data2 = response2.json()
data2 = data2[0:1]
for j in data2:
a = str(j["name"])
b = str(i["uid"])
c = str(i["title"])
with open(r"C:\Users\denis.zarfin\PycharmProjects\pythonProject2\main.txt", 'a') as f:
f.write(a + ", " + b + ", " + c + ", " +'\n')
url2 = "https://splunkbase.splunk.com/api/v1/app/"
except:
pass
print(offset, a, b, c)
if offset > 2700:
break
except:
pass
print("ok") That one exports the results to CSV... but it's not that good. In the end I want to get 2 JSONs I was able to do it "manually" with: import json
import requests
result = []
for app_id in range(0, 1, 1):
url = f'https://splunkbase.splunk.com/api/v1/app/?offset={app_id}&limit=1'
data = requests.get(url).json()
print(f'Name: {data["results"]['uid']}')
... View more
07-18-2023
03:52 AM
Hi,
I'm trying to drill down to a panel with depends="$some token$" from the Number Display wiz, but instead to show/hide panel according to token, it opens a search.
I'm having trouble to make each of the 3 panels be dependable on token in Number Display wiz.
Please assist
<dashboard>
<label>Show Panel based on Click</label>
<row>
<panel>
<viz type="number_display_viz.number_display_viz">
<search>
<query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by log_level</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="number_display_viz.number_display_viz.bordercolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.bordersize">2</option>
<option name="number_display_viz.number_display_viz.colorprimary">#000000</option>
<option name="number_display_viz.number_display_viz.colorprimarymode">auto</option>
<option name="number_display_viz.number_display_viz.colorsecondary">#000000</option>
<option name="number_display_viz.number_display_viz.colorsecondarymode">darker1</option>
<option name="number_display_viz.number_display_viz.max">100</option>
<option name="number_display_viz.number_display_viz.min">0</option>
<option name="number_display_viz.number_display_viz.nodatacolor">#0178c7</option>
<option name="number_display_viz.number_display_viz.padding">1</option>
<option name="number_display_viz.number_display_viz.pulserate">4</option>
<option name="number_display_viz.number_display_viz.shadowcolor">#F2F4F5</option>
<option name="number_display_viz.number_display_viz.shapebordercolor">#FFFFFF</option>
<option name="number_display_viz.number_display_viz.shapebordercolormode">static</option>
<option name="number_display_viz.number_display_viz.shapebordersize">1</option>
<option name="number_display_viz.number_display_viz.shapedropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.shapeshadow">yes</option>
<option name="number_display_viz.number_display_viz.shapetexture">solid</option>
<option name="number_display_viz.number_display_viz.sparkHeight">30</option>
<option name="number_display_viz.number_display_viz.sparkWidth">90</option>
<option name="number_display_viz.number_display_viz.sparkalign">5</option>
<option name="number_display_viz.number_display_viz.sparkalignv">70</option>
<option name="number_display_viz.number_display_viz.sparkcolorfill">#009DD9</option>
<option name="number_display_viz.number_display_viz.sparkcolorline">#0178c7</option>
<option name="number_display_viz.number_display_viz.sparkcolormodefill">auto</option>
<option name="number_display_viz.number_display_viz.sparkcolormodeline">auto</option>
<option name="number_display_viz.number_display_viz.sparkmin">0</option>
<option name="number_display_viz.number_display_viz.sparknulls">gaps</option>
<option name="number_display_viz.number_display_viz.sparkorder">no</option>
<option name="number_display_viz.number_display_viz.sparkstyle">area</option>
<option name="number_display_viz.number_display_viz.spinnerspeedmax">20</option>
<option name="number_display_viz.number_display_viz.spinnerspeedmin">1</option>
<option name="number_display_viz.number_display_viz.style">a2</option>
<option name="number_display_viz.number_display_viz.subtitlealign">center</option>
<option name="number_display_viz.number_display_viz.subtitlealignv">70</option>
<option name="number_display_viz.number_display_viz.subtitlecolor">#5C6773</option>
<option name="number_display_viz.number_display_viz.subtitlecolormode">static</option>
<option name="number_display_viz.number_display_viz.subtitledrop">yes</option>
<option name="number_display_viz.number_display_viz.subtitledropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.subtitlesize">40</option>
<option name="number_display_viz.number_display_viz.textalign">center</option>
<option name="number_display_viz.number_display_viz.textalignv">60</option>
<option name="number_display_viz.number_display_viz.textcolor">#000000</option>
<option name="number_display_viz.number_display_viz.textdrop">no</option>
<option name="number_display_viz.number_display_viz.textdropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.textduration">300</option>
<option name="number_display_viz.number_display_viz.textmode">static</option>
<option name="number_display_viz.number_display_viz.textprecision">1</option>
<option name="number_display_viz.number_display_viz.textsize">100</option>
<option name="number_display_viz.number_display_viz.textunitposition">after</option>
<option name="number_display_viz.number_display_viz.textunitsize">50</option>
<option name="number_display_viz.number_display_viz.thickness">50</option>
<option name="number_display_viz.number_display_viz.thresholdcol1">#1a9035</option>
<option name="number_display_viz.number_display_viz.thresholdcol2">#d16f18</option>
<option name="number_display_viz.number_display_viz.thresholdcol3">#b22b32</option>
<option name="number_display_viz.number_display_viz.thresholdcol4">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdcol5">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdcol6">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdsize">20</option>
<option name="number_display_viz.number_display_viz.thresholdval2">70</option>
<option name="number_display_viz.number_display_viz.thresholdval3">90</option>
<option name="number_display_viz.number_display_viz.titlealign">center</option>
<option name="number_display_viz.number_display_viz.titlealignv">30</option>
<option name="number_display_viz.number_display_viz.titlecolor">#edd051</option>
<option name="number_display_viz.number_display_viz.titlecolormode">static</option>
<option name="number_display_viz.number_display_viz.titledrop">no</option>
<option name="number_display_viz.number_display_viz.titledropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.titlesize">65</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<condition field="INFO">
<set token="tokINFO">true</set>
<unset token="tokWARN"></unset>
<unset token="tokERROR"></unset>
</condition>
<condition field="WARN">
<unset token="tokINFO"></unset>
<set token="tokWARN">true</set>
<unset token="tokERROR"></unset>
</condition>
<condition field="ERROR">
<unset token="tokINFO"></unset>
<unset token="tokWARN"></unset>
<set token="tokERROR">ERROR</set>
</condition>
</drilldown>
</viz>
</panel>
</row>
<row>
<panel depends="$tokINFO$">
<table>
<title>INFO details</title>
<search>
<query>index=_internal sourcetype=splunkd log_level="INFO"
| timechart count by component</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$tokWARN$">
<table>
<title>WARN details</title>
<search>
<query>index=_internal sourcetype=splunkd log_level="WARN"
| timechart count by component</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">cell</option>
</table>
</panel>
<panel depends="$tokERROR$">
<table>
<title>ERROR details</title>
<search>
<query>index=_internal sourcetype=splunkd log_level="ERROR"
| timechart count by component</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
... View more
07-09-2023
04:31 AM
Is there any way to get the same # of rows (100) for the release URL, and not to do it 1 by 1? https://splunkbase.splunk.com/api/v1/app/<UUID>/release/
... View more
07-06-2023
06:38 AM
Our Splunk instance has no internet access, so I'm trying to get a list of Splunk apps from splunkbase in JSON format and to compare the results via lookup to installed apps in Splunk. The problem is that via API I can get info for specific app bit not for all of the apps in splunkbase. https://splunkbase.splunk.com/api/v1/app/2919/ uid 2919
appid "analysis_of_splunkbase_apps"
title "Analysis Of SplunkBase Apps for Splunk"
created_time "2022-06-29T22:21:12+00:00"
published_time "2022-06-29T22:21:12+00:00"
updated_time "2022-11-12T18:36:43+00:00"
type "app"
license_name "Splunk Software License Agreement"
license_url "https://www.splunk.com/en_us/legal/splunk-software-license-agreement.html"
description "After being asked for a list of Splunk Apps in a spreadsheet a few times, I found a need to build this App. This App provides a simple dashboard with App stats and allows you to search for Splunk Apps within Splunk. It was also designed to work if you are offline, as long as you have been online once to collect data.\n\nThis App can be used to determine which Apps are certified to work with Splunk Cloud, Hunk, ES, etc. \n\nThis is just one example of how you can use Splunk to analyze web site content.\n\n*NOTE: Firefox does not seem to like loading he dynamic menus, please use any other major browser."
access "unrestricted"
appinspect_passed true
path "https://splunkbase.splunk.com/app/2919/"
install_method_distributed "assisted"
install_method_single "simple"
download_count 6015
install_count 0
archive_status "live"
is_archived false
fedramp_validation "no" https://splunkbase.splunk.com/api/v1/app/2919/release/
0
id 26397
app 2919
name "5.4.3"
product
name "splunk"
display_name "Splunk"
release_notes "Changes to the Splunkbase API have been reflected in our collection script. \nLocal audit bug resolved."
CIM_versions []
product_versions
0 "9.1"
1 "9.0"
2 "8.2"
3 "8.1"
4 "8.0"
5 "7.3"
6 "7.2"
7 "7.1"
8 "7.0"
created_datetime "2022-06-29T22:21:12.495737Z"
published_datetime "2022-06-29T22:21:12.495763Z"
size 217239
filename "analysis-of-splunkbase-apps-for-splunk_543.tgz"
platform "independent"
install_method_single "simple"
install_method_distributed "assisted"
fedramp_validation "no"
cloud_compatible true So, my question is, how to get all apps list from splunkbase in JSON format
... View more
01-08-2023
10:50 PM
That will work if you know the values of the "values" column, but I don't. For example: | makeresults count=10
| eval name = "Disney"
| eval value = "user".random() % 100
... View more
12-22-2022
12:10 AM
<form>
<label>dropdown_</label>
<search id="base1">
<query>| makeresults
| eval name = "Disney"
| eval value = mvappend("Mickey Mouse","Donald Duck","Dumbo","Scooby","Olaf")
| table name value
| stats values(*) as * by name value</query>
<sampleRatio>1</sampleRatio>
<done>
<set token="value_tok">$result.value$</set>
</done>
</search>
<search id="base2">
<query>| makeresults
| eval name = "WB"
| eval value = mvappend("Pinky","Brain","Daffy Duck","Bugs","Batman")
| table name value
| stats values(*) as * by name value</query>
<sampleRatio>1</sampleRatio>
<done>
<set token="value_tok">$result.value$</set>
</done>
</search>
<search id="base3">
<query>| makeresults
| eval name = "SesameStreet"
| eval value = mvappend("Elmo","Bert","Big Bird","Kermit","Ernie")
| table name value
| stats values(*) as * by name value</query>
<sampleRatio>1</sampleRatio>
<done>
<set token="value_tok">$result.value$</set>
</done>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="name_tok">
<label>Name</label>
<choice value="Disney">Disney</choice>
<choice value="WB">WB</choice>
<choice value="SesameStreet">SesameStreet</choice>
<change>
<condition value="Disney">
<set token="disney_tok">true</set>
<unset token="wb_tok"></unset>
<unset token="sesame_tok"></unset>
</condition>
<condition value="WB">
<unset token="disney_tok"></unset>
<set token="wb_tok">true</set>
<unset token="sesame_tok"></unset>
</condition>
<condition value="SesameStreet">
<unset token="disney_tok"></unset>
<unset token="wb_tok"></unset>
<set token="sesame_tok">true</set>
</condition>
</change>
</input>
<input type="dropdown" token="value_tok">
<label>field1</label>
<fieldForLabel>value</fieldForLabel>
<fieldForValue>value</fieldForValue>
<search>
<query>| search name = "$name_tok$"
| search value = "$value_tok$"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel depends="$disney_tok$">
<table>
<search base="base1">
<query>| table *
| search name = "$name_tok$"
| search value = "$value_tok$"</query>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel depends="$wb_tok$">
<table>
<search base="base2">
<query>| table *
| search name = "$name_tok$"
| search value = "$value_tok$"</query>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel depends="$sesame_tok$">
<table>
<search base="base3">
<query>| table *
| search name = "$name_tok$"
| search value = "$value_tok$"</query>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form> I need for the second drop down to be connected to first drop down and to each table
... View more
12-20-2022
05:02 AM
I need to create one drop down for all the sources. Under input name I'll have A | B | C and each time I choose the name, I'' see the corresponding values in the Value input query 1 set token = query1 query 2 set token = query2 query 3 set token = query3 And the drop down input will present all 3 name
... View more
12-20-2022
03:58 AM
Hi all,
I need to create 2 drop down fields that depend on each other from several source:
| makeresults | eval name = "a" | eval value = mvappend("1","2","3","4","5") | union [| makeresults | eval name = "b" | eval value = mvappend("a","b","c","d","e") ] | union [| makeresults | eval name = "c" | eval value = mvappend("qq","ss","ff","gg","rr") ] | table name value | stats values(*) as * by name value
When I choose A, I get only A values. B - only B values and etc.
The queries are coming from several sources, so I can't append or union, I need to create token for each value.
Please assist
Name
Value
A
A values
... View more
Labels
- Labels:
-
dashboard
-
simple XML
-
token
12-12-2022
05:55 AM
And another thing I need help with I need to get the max action_count from the previous SPL: 2022-12-06 00:03:00 1 2022-12-06 00:04:00 1 2022-12-06 00:05:00 1 2022-12-06 00:06:00 2 2022-12-06 00:07:00 3 2022-12-06 00:08:00 4 2022-12-06 00:09:00 1 2022-12-06 00:10:00 2 2022-12-06 00:11:00 3 2022-12-06 00:12:00 1 TO 2022-12-06 00:03:00 1 2022-12-06 00:04:00 1 2022-12-06 00:08:00 4 2022-12-06 00:11:00 3 2022-12-06 00:12:00 1
... View more
12-08-2022
05:16 AM
I have a table with 3 columns: _time, type and action | makeresults count=10 | eval type = "typeA" | eval action = if((random()%2) == 1, "open", "close") | union [| makeresults count=10 | eval type = "typeB" | eval action = if((random()%2) == 1, "open", "close")]
I need to create a column for each type that would identify the change in the column action and count # of actions in ascending order like this...
_time
typeA
typeB
typeA_count
typeB_count
2022-01-01 05:00:00
open
close
1
1
2022-01-01 05:00:01
open
open
2
1
2022-01-01 05:00:02
close
close
1
1
2022-01-01 05:00:03
open
open
1
1
2022-01-01 05:00:04
close
open
1
2
2022-01-01 05:00:05
open
close
1
1
2022-01-01 05:00:06
open
close
2
2
2022-01-01 05:00:07
open
close
3
3
2022-01-01 05:00:08
close
open
1
1
2022-01-01 05:00:09
open
close
1
1
Thanks
... View more
01-08-2022
10:49 PM
@ITWhisperer They are repeated, since it answers the JOIN condition. aaaaa 11111 Can be applied to: field1 field2 field3 field4 field5 field6 aaaaa 11111 qqqqq aaaaaa tttttt yyyyyy aaaaa 11111 cccccc rrrrrrr The only way, I see that it can be done, is by each time to make a another join... something like: | join type=left max=0 field1 [...] | join type=left max=0 field1 field2 [...] | join type=left max=0 field1 field2 field3 [...] I was looking for more elegant solution
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-17-2024
09:01 AM
|
