Activity Feed
- Posted Re: How to move addtotals to the first column for a chart? on Dashboards & Visualizations. 03-02-2022 08:54 AM
- Karma Re: How to move addtotals to the first column for a chart? for SanjayReddy. 03-02-2022 08:54 AM
- Karma Re: How to move addtotals to the first column for a chart? for SanjayReddy. 03-02-2022 08:54 AM
- Posted Re: How to move addtotals to the first column for a chart? on Dashboards & Visualizations. 03-01-2022 08:34 PM
- Posted How to move addtotals to the first column for a chart? on Dashboards & Visualizations. 03-01-2022 12:49 PM
- Karma Re: Table Formats Coloring for tshah-splunk. 02-26-2022 12:40 PM
- Posted Re: Table Formats Coloring on Dashboards & Visualizations. 02-26-2022 12:37 PM
- Karma Re: Table Formats Coloring for ITWhisperer. 02-26-2022 12:36 PM
- Posted Re: Table Formats Coloring on Dashboards & Visualizations. 02-25-2022 02:18 PM
- Karma Re: Table Formats Coloring for ITWhisperer. 02-25-2022 02:14 PM
- Posted How to create a Table Formats Coloring on Dashboards & Visualizations. 02-24-2022 05:15 PM
- Karma Re: How to exclude duplicates when using outputlookup ? for gcusello. 02-24-2022 05:15 PM
- Posted How to exclude duplicates when using outputlookup ? on Splunk Search. 02-07-2022 05:06 PM
- Tagged How to exclude duplicates when using outputlookup ? on Splunk Search. 02-07-2022 05:06 PM
- Tagged How to exclude duplicates when using outputlookup ? on Splunk Search. 02-07-2022 05:06 PM
- Posted Re: How to pass token to dropdown panels when token is coming from another dashboard on Dashboards & Visualizations. 01-06-2022 07:48 PM
- Posted How to pass token to dropdown panels when token is coming from another dashboard? on Dashboards & Visualizations. 01-05-2022 05:21 PM
- Posted How to Formulate an if Function for a Simple Math Problem on Splunk Search. 12-01-2021 06:11 PM
- Posted Re: How to remove words and characters from a multivalued filed on Splunk Search. 11-22-2021 02:06 PM
- Karma Re: How to remove words and characters from a multivalued filed for ITWhisperer. 11-22-2021 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-02-2022
08:54 AM
Yes, I needed to keep the chart at all costs | table _time Total * did it and I totally understand why now. Thanks!
... View more
03-01-2022
08:34 PM
Thanks, but doing | table command does not fix the issue, since I am using | chart command. When I use | table I am able to move the addtotals column to the start of the table, but it does away with the host data. So what I get now looks like this using table... notice no host name or counts are under the host now. _time Total host 2022-02-24 22:00 4 2022-02-24 23:00 2
... View more
03-01-2022
12:49 PM
Hello Splunk Community, How can I move the addtotals field to display as the first column and not last for this chart? Currently: _time Host123 Host456 total 2022-02-24 22:00 0 2 2 Would like: _time total Host123 Host456 2022-02-24 22:00 2 0 2 Current Code: index="Dept_data_idx" eventType="Created" status="success" host=* | bucket _time span=1h | stats count by _time host | addtotals
... View more
Labels
- Labels:
-
chart
02-25-2022
02:18 PM
Hi @ITWhisperer Thanks removing the filed="count" did the trick. Would you help me understand why this works? So far I understand that the field names become values with chart... but don't understand how removing count from field helped with this problem. <format type="color" field=" ">
... View more
02-24-2022
05:15 PM
Hello Splunk Community, I am trying to replicate a heat map using the table formats app available through Splunk. I see the coloring of the cells when I use the stats command as below, but I need to have the data show as a chart. The issue is when I use chart all the color goes away from the table. Is there a work around for this problem?
<dashboard>
<label>Table Formats</label>
<description>Format columns using built-in table formats (coloring, number formatting).</description>
<row>
<panel>
<table>
<search>
<query>
index="Dept_data_idx" eventType="Created" status="success" host=* | bucket _time span=1h | stats count by _time host
</query>
<earliest>-7d</earliest>
<latest>now</latest>
</search>
<format type="color" field="count">
<colorPalette type="minMidMax" maxColor="#31A35F" minColor="#FFFFFF"></colorPalette>
<scale type="minMidMax"></scale>
</format>
</table>
<html>
</html>
</panel>
</row>
</dashboard>
... View more
Labels
- Labels:
-
chart
02-07-2022
05:06 PM
Hello All, I have a lookup that is a saved as a schedule report that runs once a week. This schedule report will get the new email addresses that were populated upon the search, then write the new email addresses to another lookup. The issue I have is that I get duplicates as this search runs once a week. Is there a way I can avoid duplicates using outputlookup? Dedup is not doing the trick... | inputlookup Stored_Email_lookups.csv
| table Email, User_Id | rename User_Id as "New User" | dedup Email | outputlookup append=true "New_Incoming_Emails.csv"
... View more
- Tags:
- lookup
- outputlookup
Labels
- Labels:
-
lookup
01-06-2022
07:48 PM
@ITWhisperer I had the input forms match. Thank you for confirming my dashboard 1 code was correct, that was helpful.
... View more
01-05-2022
05:21 PM
Hi All,
I have two dashboards, dashboard 1 and dashboard 2. I have linked them. When clicking on host from a line chart from dashboard 1, dashboard 2 opens up and filters on the selected host from dashboard 1. So far, dashboard 2 shows the correct host on the multiselect input. The issue is that I somehow override the panels in dashboard 2 with those of dashboard 1. It may be an issue with the token, since I have tok_host=$tok_host$ on both dashboard's 1 and 2, but I am not sure if that is causing the issue. Any advise is welcome. Thanks in advance
Dashboard 1
Input for multiselect:
<input type="multiselect" token="tok_host" searchWhenChanged="true">
<label>Select Server (Multi Select)</label>
<search>
<query> (index=test_*_idx) |fields + host | stats values(host) as host | mvexpand host | rename host as tok_host </query>
</search>
<prefix>host IN (</prefix>
<valuePrefix></valuePrefix>
<valueSuffix></valueSuffix>
<delimiter> , </delimiter>
<suffix>)</suffix>
<choice value="*">All</choice>
<fieldForLabel>tok_host</fieldForLabel>
<fieldForValue>tok_host</fieldForValue>
</input>
Linking the dashboard code:
<drilldown>
<link target="_blank">/app/XYZ_Sun_Sys/Dashboard2?form.tok_host=$click.name2$</link>
</drilldown> Dashboard 2
Multiselect input code:
<input type="multiselect" token="tok_host" searchWhenChanged="true">
<label>Select Server</label>
<search>
<query>(index=text_idx) |fields + host | stats values(host) as host | mvexpand host | rename host as tok_host</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<fieldForLabel>Select Host</fieldForLabel>
<fieldForValue>tok_host</fieldForValue>
<choice value="*">All</choice>
<delimiter> ,</delimiter>
<default>*</default>
</input>
Dashboard 2 code for panel
</fieldset>
<row>
<panel depends="$tok_host$">
<title> First Panel - $tok_host$ </title>
<single>
<title>Space Avail</title>
<search>
<query>index=testing_idx host=$tok_host$ |timechart span=10min avg(Speed) as speed | eval change=_time</query>
... View more
12-01-2021
06:11 PM
Hi There, I am probably making this more confusing for myself than it needs to be, but its a simple concept. Here is the scenario. If an invite is emailed and no confirmation is received within 1 day from email being sent then it is "In Progress" otherwise its a failure. Please help formulate, basically if no confirmation is received within 1 day its in progress. I would like to keep my times all in epoch. Thank You in advance | makeresults
| eval email_sent=1637978619.056000
| eval time_passed_no_confirmation=86400
| eval confirmation_remains_null="null"
... View more
11-22-2021
02:06 PM
Pretty close, just used mvindex instead. Thanks | eval OS_Name=split(OSName,"-"), Env=mvindex(OS_Name, 1)
... View more
11-19-2021
12:07 AM
Hello All, How can I remove words and characters from a multivalued field without using REX? I have a filed named OS OS: Windows-2016 Windows-2010 How can I take out everything that comes in before the hyphen and just end up with the below? OS: 2016 2010
... View more
- Tags:
- other
Labels
- Labels:
-
field extraction
-
stats
11-16-2021
11:21 PM
Hi, my bad for the confusion, I am temporary away from my work station and don’t have the actual code at the moment Y can take upto 24 hours to show up after x - making it null until the 24 hours complete. so I was thinking I could include a lapse of time of 24 hours after x took place.
... View more
11-16-2021
08:54 PM
Howdy, Been researching on how to give time for the next sequential event to occur, but have not found a way. Lets say field X occurred and the next event to take place is field Y, but field Y is null if under 24 hrs give Length_of_Time in min once Y happens. Issue is if its the same day and Y still has not occurred following X -- , give X 24 hours to happen from the time field Y happened before marking it as failure of error... So far this is what I have... | eval X = strptime(StartTime,"%Y-%m-%d %H:%M:%S.%q"),
Y =strptime(EndTime,"%Y-%m-%d %H:%M:%S.%6N")
note: 86400 is 24 hrs in seconds
| eval Length_of_Time = if(isNull(Y)AND Y-X < 86400 AND 86400<=X,round((X-Y)/60,0))
... View more
- Tags:
- time
11-15-2021
10:35 PM
Hello All, Thought I had this down, but not quite. So here is the scenario. I have two Fields 1. "Sent Invite Time" and 2. "Received Invite Time". Received Invite Time should happen 1440 min from the time "Sent Invite Time occurred" and then searching for when the duration it took between those two fields is over 1440 in min. The problem I have is that I am getting fields that are coming up as Not Received Invite this is because its not giving Field 2 "Received Invite Time" 1440 min to complete. So how can I do that - have Field 1"Sent Invite Time" and give it 24 hours for Field 2 to occur from the start of the time that field 1 occurred ? I was hoping to do this in the where clause.... | where Field1-Field2>1440
... View more
- Tags:
- where
11-14-2021
11:17 PM
Hello All, Anyone out there know how I can search for an event that is supposed to occur within 24 hours but has not? Example: 1 - Invite is sent, if invite is not marked received in 24 hours it is a failure. So, lets say --- invite was sent 11/14/21 and it is received on 11/16/21 this is a failure. The start time would not be now() or relateive_time function because the start time would be the time the invite was sent. Any help is greatly appreciated.
... View more
- Tags:
- Time Modifiers
11-11-2021
08:49 PM
Hello There, I'm a bit rusty when it comes to the syntax and I am trying to get a better grasp. I have an if else function, so if lets say ABC is greater than 3600 add 21600 seconds else don't add any time. I have 3 of these types of conditions, but they are all under the same field name. The struggle for me is combining these if else functions into one multi conditional function. I have spent a while looking at how to do this, but I didn't run into any examples that included strftime or strptime. Any guidance on this type of syntax is apricated. | eval SLA_Breach=case(ABC>3600, strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +21600, "%Y-%m-%d %H:%M:%S.%6N"),"none")
| eval SLA_Breach=if(DEF>2800,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +172800, "%Y-%m-%d %H:%M:%S.%6N"),"none")
| eval SLA_Breach=if(GHI>1400,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +86400, "%Y-%m-%d %H:%M:%S.%6N"),"none")
... View more
11-11-2021
03:02 PM
Thanks, basically it was my syntax that was throwing me off... since I had: | eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y") I was not sure of the syntax therefore I was not seeing expected results - and you demonstrated the correct syntax: | eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y"), "none")
... View more
11-10-2021
10:08 PM
Hey There, Below I have a field in where ABC > 2500 cuz the value is actually 2800. So then If ABC>than 2500 add 1 day to the Human_readable field. I have already created the logic to adding 1 day to the Human_readable field.... Question now is how can I write the logic for it in a nested loop? So If ABC>2500 add 1 day to human readable. This is my logic that I have thus far: | eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y") This is what I have so far: | makeresults
| eval ABC="2800", DEF="3", GHI="5"
| eval rel_Time="11102021"
| eval Epoch_Time=strpTime(rel_Time,"%m%d%Y")
| eval Human_readable=strfTime(Epoch_Time, "%B %d, %Y")
| eval Service=if(ABC>2500, "Send Alert", "No Alert")
| eval Add_1Day=strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")
| eval Then_Set=if(ABC>2500,strftime(strptime(Human_readable,"%B %d, %Y") +86400, "%B %d, %Y")
| table Service Epoch_Time Human_readable Add_1Day Then_Set
... View more
- Tags:
- IF ELSE
Labels
- Labels:
-
eval
11-10-2021
03:49 PM
Hi All, Need guidance on how to approach this. I need help with creating an alert that triggers during different times, for instance: Alert will trigger if: If Y-email was sent over 1 day ago If Z-email was sent over 2 days ago if M-email was sent over 3 days ago All these triggers will be a part of 1 email... can this be done with cron schedule alone or will the time need to be hard coded in the code itself? Or will I need separate alerts?
... View more
- Tags:
- alert
Labels
- Labels:
-
alert action
-
alert condition
-
cron
-
email
06-01-2021
08:43 AM
@bowesmana Thanks for your help, going to review the docs you sent to help me understand.
... View more
06-01-2021
08:42 AM
Thanks @kamlesh_vaghela I don't see the table anymore using CSS you have provided - which is what I wanted. I appreciate all your help.
... View more
05-31-2021
10:05 PM
@kamlesh_vaghela Thanks, this hides my table, but I still cant get my query to display. Where should the tokens below go? I put them in my query search after | search, but still no results. Below is also my query $tkn_data1$ $tkn_data2$ My query: <dashboard>
<label>Only Search</label>
<search>
<query>| rest /servicesNS/-/-/data/lookup-table-files search="*_Report.csv"
| eval updated=strptime(updated,"%FT%T%:z")
| eval desired_time=strftime(updated, "%B %d, %Y")
| rename desired_time as "Last Updated" title as Team
| search $tkn_data1$ $tkn_data2$
| table "Last Updated", Team
</query>
<done>
<set token="tkn_data1">$result.data1$</set>
<set token="tkn_data2">$result.data2$</set>
</done>
</search>
<row>
<panel>
<html>
<h1>Use below token in any search or label</h1>
tkn_data1 : $tkn_data1$ <br />
tkn_data2: $tkn_data2$
</html>
</panel>
</row>
</dashboard>
... View more
05-31-2021
09:21 PM
Hi @bowesmana I'm not a developer and new to Splunk, so this is tricky for me. Below is my code: <table depends="$non_existant_token$">
<search>
<query>| rest /servicesNS/-/-/data/lookup-table-files search="*_Report.csv"
| eval updated=strptime(updated,"%FT%T%:z")
| eval desired_time=strftime(updated, "%B %d, %Y")
| rename desired_time as "Last Updated" title as Team
| table "Last Updated", Team
<done>
<set token="tkn_data1">$result.data1$</set>
<set token="tkn_data2">$result.data2$</set>
... View more
