Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashutoshwalke
ashutoshwalke
Explorer
Member since:
04-05-2021
07-01-2021
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 04-05-2021 |
Activity Feed
- Posted Re: How to give Line break in eval and display the same in single value chart on Splunk Search. 07-01-2021 06:01 PM
- Karma Re: How to give Line break in eval and display the same in single value chart for kamlesh_vaghela. 07-01-2021 06:00 PM
- Posted Re: How to give Line break in eval and display the same in single value chart on Splunk Search. 06-30-2021 05:53 PM
- Posted Re: How to give Line break in eval and display the same in single value chart on Splunk Search. 06-30-2021 09:47 AM
- Posted How to give Line break in eval and display the same in single value chart on Splunk Search. 06-29-2021 06:13 PM
- Karma Re: How to hide X axis scale in a bar chart for ITWhisperer. 04-08-2021 09:26 AM
- Posted Re: How to hide X axis scale in a bar chart on Splunk Search. 04-08-2021 09:25 AM
- Posted Re: How to hide X axis scale in a bar chart on Splunk Search. 04-08-2021 06:29 AM
- Posted How to hide X axis scale in a bar chart on Splunk Search. 04-08-2021 06:27 AM
- Karma Re: How to get last weekday of last month and check logs for an date field in the logs having that value for ITWhisperer. 04-05-2021 10:41 AM
- Karma Re: How to get last weekday of last month and check logs for an date field in the logs having that value for ITWhisperer. 04-05-2021 10:39 AM
- Posted Re: How to get last weekday of last month and check logs for an date field in the logs having that value on Splunk Search. 04-05-2021 10:38 AM
- Posted Re: How to get last weekday of last month and check logs for an date field in the logs having that value on Splunk Search. 04-05-2021 10:17 AM
- Posted Re: How to get last weekday of last month and check logs for an date field in the logs having that value on Splunk Search. 04-05-2021 06:57 AM
- Posted How to get last weekday of last month and check logs for an date field in the logs having that value on Splunk Search. 04-05-2021 05:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-01-2021
06:01 PM
@kamlesh_vaghela It worked like a charm, Thanks a lot for your help 🙂
... View more
06-30-2021
05:53 PM
@kamlesh_vaghela Please advise ?
... View more
06-30-2021
09:47 AM
Hello Kamlesh, Thank you for your response. The query you have provided does work when run in splunk search but not when used in dashboard to display this data in single value chart. Also, not sure why is it showing an comma now in the chart with you query. RESULT (I got with your query in single value chart) ======================================= OK,EndTime Please advise.
... View more
06-29-2021
06:13 PM
Hello, I am trying to display some data in field "result" for me in a single value chart using below query, and color/severity rule is based on keywords instead of numbers. i.e. OK = GREEN and NOTOK = RED Below code works for me but the only issue is I am unable to break the line in the chart. I want it as OK/NOTOK on the top and then the EndTime or anything that I may concatenate further below the result field. Example, ============================================ result as "OK/NOTOK" EndTime ============================================ I have tried using regex/sed or actually using (shift + enter) in my splunk query and it does works but in search only not in the dashboard. Code ============================================ index=xyz | eval SLA=9.0 | eval Date=strftime(_time, "%m-%d-%y") | eval EndTime=strftime(_time, "%H.%M") | eval result=if(EndTime<SLA, "OK"."\n".EndTime, "NOTOK") | table result EndTime | eval severity=case(result="OK"." ".EndTime, 0, result="NOTOK", 1) | rangemap field=severity low=0-0 default=severe ============================================ Can someone please advise ? I had seen few posts that this could be achieved using some CSS/JS scripts but I do not have much knowledge on it. Any help appreciated. @niketn @ITWhisperer @Ayn @woodcock Regards
... View more
Labels
- Labels:
-
eval
04-08-2021
09:25 AM
Thanks a lot 🙂 It has helped Though I struggled a bit to find where exactly this code should be placed in the xml, maybe as I am new to this 🙂 I put it below anyway just if it helps anyone. Also, for reference on how to check in "Inspect/Developers Tool" see below link https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-customizing-simplexml-dashboards-with-inline-css.html <row> <panel> <html depends="$alwaysHideCSSStyleHTML$"> <style> #chart5 g.highcharts-yaxis-labels{ display: none; } </style> </html> <chart id="chart5"> <title> HI </title> <search base="base"> <query> my search query </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisY.scale">linear</option> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked100</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">1</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.placement">top</option> <option name="height">229</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row>
... View more
04-08-2021
06:27 AM
Hi, I am unable to hide the X-axis scale in the bar chart. See below screenshot, I am plotting the chart using below query, where date is a dated field in my logs and name is name for something. index=* "some splunk query" | chart count(date) by name date Below are my charting options. I have tried multiple options here as you see below but none of it is actually helping me to hide the X-axis scale. <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisLabelsX.majorTickVisibility">hide</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisLabelsY.majorTickVisibility">hide</option> <option name="charting.axisLabelsY2.majorTickVisibility">hide</option> <option name="charting.axisY.scale">linear</option> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.stackMode">stacked100</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">1</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.placement">top</option> <option name="height">229</option> <option name="refresh.display">progressbar</option> </chart> Can someone please help ? Thanks in advance
... View more
Labels
- Labels:
-
chart
04-05-2021
10:38 AM
I was able to do it after I change fieldformat to eval here | fieldformat last_weekday=strftime(last_weekday,"%Y-%m-%d") TO | eval last_weekday=strftime(last_weekday,"%Y-%m-%d")
... View more
04-05-2021
10:17 AM
Thanks a lot, that worked like a charm 🙂 Just one question, I am unable to compare it with my date field in the log using a WHERE clause. I could see both the dates are in same format. index=* | eval last_day=relative_time(now(),"+0mon@mon-1d") | eval dotw=tonumber(strftime(last_day,"%w")) | eval adjust=case(dotw=0,2,dotw=6,1,1==1,0) | eval last_weekday=last_day-(adjust * 24 * 60 * 60) | fieldformat last_weekday=strftime(last_weekday,"%Y-%m-%d") | table last_weekday date When I run above query it does gives me a table as below, also when i search just using date=2021-03-31 it does gives me the results. last_weekday date 2021-03-31 2021-04-02 2021-03-31 2021-03-23 2021-03-31 2021-03-23 I also tried doing below to convert my date field just in case, | fieldformat date=strftime(date,"%Y-%m-%d") but that didn't help. Can you advise ? Thanks
... View more
04-05-2021
06:57 AM
Hi, Thank you for your response. From your query I get the day number and is not helpful. I need the date of last weekday in previous month, say 2021-03-31 and then I need to check in my logs looking in the date field if date=2021-03-31 is present or not. If yes , I use the logs. Logically may be it could be something like below, but I am not getting the correct syntax or way of doing it, | makeresults | eval current_month_last_day=relative_time(now(),"@mon-1d") | fieldformat current_month_last_day=strftime(current_month_last_day,"%Y-%m-%d")| eval day_value = case(date_wday=="saturday", "1d", date_wday="sunday", "2d") | eval current_month_last_day=relative_time(current_month_last_day-day_value) | table current_month_last_day Explanation ------------------------------------------------------------------------------------------------------------------------------------ 1. | makeresults | eval current_month_last_day=relative_time(now(),"@mon-1d") | fieldformat current_month_last_day=strftime(current_month_last_day,"%Y-%m-%d") --- with this is get the last date of previous month 2. | eval day_value = case(date_wday=="saturday", "1d", date_wday="sunday", "2d") | eval current_month_last_day=relative_time(current_month_last_day-day_value)--- here i try to check if it is not a weekend, if it happens to be then minus 1 day or 2 day from the date calculated in step 1. ------------------------------------------------------------------------------------------------------------------------------------ Please help. Thanks
... View more
04-05-2021
05:36 AM
I have something that runs every day but i need to see it only for previous EOM which is also a weekday I have a field as date =2021-03-31 in the logs I am not sure how can I get the previous EOM(weekday) and compare it with my date field value. I have already tried answer given here but has not helped. https://community.splunk.com/t5/Archive/Function-To-Return-Last-Weekday/m-p/172413#M25201 Any help appreciated. Thanks in advance.
... View more
Labels
- Labels:
-
eval
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-01-2021
09:22 PM
|
