Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About rally0321
rally0321
Path Finder
Member since:
03-04-2021
01-23-2023
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 03-04-2021 |
Activity Feed
- Posted Re: Is there any way to set different email receipt for for "send email" alerting action ? on Alerting. 01-23-2023 09:43 PM
- Posted Is there any way to set different email receipt for for "send email" alerting action ? on Alerting. 01-15-2023 04:42 AM
- Tagged Is there any way to set different email receipt for for "send email" alerting action ? on Alerting. 01-15-2023 04:42 AM
- Karma Re: update table cell color as per the another field for ITWhisperer. 06-04-2022 01:53 AM
- Posted How to update table cell color as per the another field? on Dashboards & Visualizations. 05-31-2022 10:15 AM
- Tagged How to update table cell color as per the another field? on Dashboards & Visualizations. 05-31-2022 10:15 AM
- Karma Re: Chart count result process - replace zero with SPACE for particular cell for ITWhisperer. 05-02-2022 08:44 PM
- Karma Re: Chart count result process - replace zero with SPACE for particular cell for ITWhisperer. 05-02-2022 08:44 PM
- Posted Re: Chart count result process - replace zero with SPACE for particular cell on Splunk Enterprise. 04-29-2022 03:35 AM
- Posted Chart count result process - replace zero with SPACE for particular cell on Splunk Enterprise. 04-29-2022 02:30 AM
- Tagged Chart count result process - replace zero with SPACE for particular cell on Splunk Enterprise. 04-29-2022 02:30 AM
- Posted Can we base on trend percent to set Coloring with Dynamic Trend in Dashboard? on Splunk Search. 03-24-2022 11:15 PM
- Tagged Can we base on trend percent to set Coloring with Dynamic Trend in Dashboard? on Splunk Search. 03-24-2022 11:15 PM
- Posted Re: Chart count result process - replace zero with SPACE on Splunk Enterprise. 09-14-2021 02:06 AM
- Posted Re: Chart count result process - replace zero with SPACE on Splunk Enterprise. 09-13-2021 09:21 PM
- Posted Re: Chart count result process - replace zero with SPACE on Splunk Enterprise. 09-13-2021 04:09 AM
- Karma Re: Chart count result process - replace zero with SPACE for PickleRick. 09-13-2021 02:43 AM
- Posted Chart count result process - replace zero with SPACE on Splunk Enterprise. 09-10-2021 02:01 AM
- Tagged Chart count result process - replace zero with SPACE on Splunk Enterprise. 09-10-2021 02:01 AM
- Posted Re: How to hide a dashboard in Dashboards list on Dashboards & Visualizations. 06-28-2021 03:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-23-2023
09:43 PM
Is there approach to refer this $result.fieldname$ as source for action.mail.to ; but not show this field in final search result? We include the search result as pdf when send alert. thanks.
... View more
01-15-2023
04:42 AM
Dear all, We set a few alerts and send to one receipt (DL) and alert work fine now. we want to send the alert to different receipt for environment-A and environment-B. the alert search code and other setup are same for 2 environments. Is there any solution for this?
... View more
- Tags:
- action.email.to
Labels
- Labels:
-
alert action
05-31-2022
10:15 AM
Dear all,
I have below table, FieldA (String) FieldB to FieldE (Numeric). Can we base on the FieldA value to change color for FieldB to FieldE?
logic will below
1. update cell for Field B as red when (FieldA = "1111" or "3333" or "4444") and FieldB cell value >0
2. update cell for Field C as red when (FieldA = "2222" or "3333" ) and FieldC cell value >0
3. update cell for Field D as red when (FieldA = "2222" or "3333" ) and FieldD cell value >0
4. update cell for Field E as red when (FieldA = "4444" ) and FieldE cell value >0
... View more
Labels
- Labels:
-
table
04-29-2022
03:35 AM
above command will replace 0 to space for all cells. Can we somehow replace the cell for selected row/column only? for example replace 0 in row 2, column 2/5 to SPACE and leave 0 in row 2, column 3/6.
... View more
04-29-2022
02:30 AM
I get below result when use Chart count over field-A by Field-B We can see there are cell with value 0, is there any solution to replace these 0 with SPACE for particular cell? Thanks. replace 0 for over value 1 + by field value 1/4; replace 0 for over value 2 + by field value 3/5. Over field value by field value1 by field value2 by field value3 by field value 4 by field value5 Total Over value 1 0 0 1 0 0 1 Over value 2 0 0 0 603 0 603 Over value 3 0 0 12 0 0 12 Over value 4 0 0 0 600 0 600
... View more
- Tags:
- char count
Labels
- Labels:
-
using Splunk Enterprise
03-24-2022
11:15 PM
With below setup, we can setup the single value dashboard with dynamic coloring change while trendValue change.
"trendColor": "> trendValue | rangeValue(trendColorEditorConfig)",
Can we somehow to to decide the color as per the trend percentage instead of trendValue itself?
like color 1 in case increase 10%, color 2 in case increase 20% etc.. Thanks.
... View more
Labels
- Labels:
-
chart
09-14-2021
02:06 AM
Before use foreach command to replace zero with SPACE, I can see the string table data is left-justify and numeric data is right-justify After "foreach", I can see 7 numeric column data is left-justify and only 1 numeric column data is right-justify.
... View more
09-13-2021
09:21 PM
Understand that, as per the Splunk manual I can see below attribute for table column number format. <format type="number" field="count">
<option name="precision">3</option>
<option name="useThousandSeparators">false</option>
<option name="unit">MB</option>
<option name="unitPosition">before</option>
</format> If we use table as visualization solution, can we specify how the number justify? Similarly, I see some table column head/title is left-justify and a few is right-justify. Is there any solution to align the same justification? Thanks.
... View more
09-13-2021
04:09 AM
Thanks PickleRick, I can have below result now, however we can see the number is left-justify now, how can we make it right-justify instead? Description AA CC HH NN MM PP SS TT VV A 11 15 78 10 17 16 94 1 B 1 7 C 25 D 107 31 28 975 184 308 E 4 31 181 1 22 40 5 3
... View more
09-10-2021
02:01 AM
I get below result when use Chart count over field-A by Field-B We can see there are cell with value 0, is there any solution to replace these 0 with SPACE? Thanks. Over field value by field value1 by field value2 by field value3 by field value 4 by field value5 Total Over value 1 0 0 1 0 0 1 Over value 2 0 0 0 603 0 603 Over value 3 0 0 12 0 0 12 Over value 4 0 0 0 600 0 600
... View more
- Tags:
- Chart count
Labels
- Labels:
-
using Splunk Enterprise
06-28-2021
03:20 AM
Hi Elizabethl, Yes, your understanding is correct. Thanks.
... View more
06-23-2021
04:37 AM
Cool ! It works. Thanks.
... View more
06-22-2021
09:52 PM
Dear all, There are 5 columns in one chart output and the output used to create one dashboard panel. When enable the drill down function for this dashboard, all cells for 5 columns appear as click-able status. Is there any way to disable the click or disable cells selection for particular column? So user cannot click the cells for that column, or even click nothing happen from system behavior point of view. Thanks.
... View more
- Tags:
- click cell
Labels
- Labels:
-
chart
-
Dashboard Studio
06-22-2021
08:54 PM
I created 3 dashboard A , B, C A is main dashboard and B & C is sub dashboard. Is there any way to show A only and hide B/C in Dashboards list? Thanks.
... View more
- Tags:
- query
Labels
- Labels:
-
Dashboard Studio
03-04-2021
08:38 PM
| tstats count where index=some_index earliest=-1d by _time span=1h
| tstats append=t prestats=t count where index= some_index earliest=-7d@d latest=-1d@d by _time span=1h
| table _time count psrsvd_gc
| rename psrsvd_gc AS lastweek_counts
| eventstats avg(lastweek_counts) as weekly_avg
| where count>weekly_avg Thanks. I can see result with below change. 1. add prestats=t to 1st tstats 2. where count>weekly_avg need change as lastweek_counts>weekly_avg However I see below gap. 1. the average is the average for the past 1 week + today's count. 2. the result include past 1 week record in case any hour of last week is > average. We expect to have below result. 1. the average is the average for the past 1 week only 2. the result include today's entry only.
... View more
03-04-2021
05:32 AM
| tstats count where index=some_index earliest=-1d by _time span=1h
| where count >
[| tstats count where index=some_index earliest=-7d@d latest=-1d@d by _time span=1h
| stats avg(count) as count
| rename count as search] Hi, How can we show the average count in the result as well? I refer to value of search. Thanks. _time count 1 2021-03-04 09:00:00 491
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-23-2023
10:11 PM
|
