About Altoid17

Altoid17 · ‎09-22-2022

Hi, I am looking to grab a hand at turning 8 product charts into one table with Sparkline's if possible for trend tracking. I am currently using Trellis split on my dashboard to populate these 8 line charts showing the number of hits per month over the course of 12 months for which product. My data is stored on a lookup table.csv. My date field is stored as 04/02/2022 0:00 (4th feb). ProductType has things like - Candles, Teaset, Books I would instead prefer to show the Products in one table with a trendline/sparkline for each product tracking the last 12 months. To get the trellis working i currently use the below. Which seems to work well and as needed with expected results. | inputlookup XXX.csv | search ProductType="*" | search ProductDate="*2022*" | eval Date=strftime(strptime(ProductDate,"%d/%m/%Y"),"%b-%y") | chart count(ProductType) by Date, ProductType limit=0 | fields - OTHER, "-" | eval rank=case(ProductDate like "Jan-%",1,ProductDate like "Feb-%",2,ProductDate like "Mar-%",3,ProductDate like "Apr-%",4,ProductDate like "May-%",5,ProductDate like "Jun-%",6,ProductDate like "Jul-%",7,ProductDate like "Aug-%",8,ProductDate like "Sep-%",9,ProductDate like "Oct-%",10,ProductDate like "Nov-%",11,ProductDate like "Dec-%",12,1=1,13) | rex field=ProductDate "-(?<rank_year>\d+)" | sort 0 rank_year, rank | fields - rank rank_year However, when trying to get the sparklines/trendlines working using the below two attempts i do not get the results required. All Sparklines show a value of 0 - yet there are results for these fields being purchased on all these diff dates. i have changed the search times, tried to add buckets, spans... even eval _time over Date and not having much luck. | inputlookup XXX.csv | search ProductType="*" | search ProductDate="*2022*" | eval Date=strftime(strptime(ProductDate,"%d/%m/%Y"),"%b-%y") | chart sparkline count(Date) by ProductType, ProductDate limit=0 | fields - OTHER, "-" | eval rank=case(ProductDate like "Jan-%",1,ProductDate like "Feb-%",2,ProductDate like "Mar-%",3,ProductDate like "Apr-%",4,ProductDate like "May-%",5,ProductDate like "Jun-%",6,ProductDate like "Jul-%",7,ProductDate like "Aug-%",8,ProductDate like "Sep-%",9,ProductDate like "Oct-%",10,ProductDate like "Nov-%",11,ProductDate like "Dec-%",12,1=1,13) | sort 0 rank_year, rank | fields - rank rank_year And | inputlookup XXX.csv | search ProductType="*" | search ProductDate="*2022*" | eval Date=strftime(strptime(ProductDate,"%d/%m/%Y"),"%d/%m/%Y") | chart sparkline count(ProductDate) by AppType limit=0 I believe i am going wrong with the date eval but have tried a fair few combos now with nearly all same results with sparklines always showing 0. I have a about a years worth of data i want to track in the one visual table ( Very similar to how splunk does there own EQ example. ( to many products to show nicely on a line graph). Thanks

Altoid17 · ‎03-21-2022

Thanks for the quick reply, i will have a look and see if the above is a more efficient way of doing things.. It seems like it may be. I did manage to get my code working by adding a new line to the source and then by changing the panels search to reflect $new_search$ & $new_search1$ - then when utilising the drop down, it changes both panels on each different month as wanted .. now just need to add all the rest of the panels and months. <set token="new_search">| inputlookup Janstats.csv | stats count by Priority </set> <set token="new_search1">| inputlookup Janstats.csv | stats sum(Duration) AS total by Entry </set>

Altoid17 · ‎03-21-2022

Hi All, I have 12 months worth of data that is contained on individual separate .csv files within my lookup tables. Ie - | inputlookup JanStats.csv & | Inputlookup FebStats.csv etc I have a dashboard that has about 12 different panels each showing different stats and visuals all coming from the one lookup table. Ie- one panel is showing how many hours spent in which category : | inputlookup JanStats.csv | stats sum(Duration) as total by Entry Instead of creating 12 different monthed dashboards with all the same panels, I want to be able to use a drop down input button to select the month and have that months data from the individual lookup to display across the 12 panels on the one dash. I started mucking around with this below, which works as such, but it is only showing the 1 panel search..where as i have 12 panels to search each time the drop down is selected - i am struggaling to figure out how to add in the extra panels i have ( they are of similar searchs, ie stats sum(Recovery) by User. <form> <label>Drop Down Testing</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="dropdown" token="Month" searchWhenChanged="true"> <choice value="1">January</choice> <choice value="2">February</choice> <choice value="3">March</choice> <default></default> <change> <condition value="1"> <set token="new_search">| inputlookup JanStats.csv | stats sum(Duration) AS total by Entry | table total</set> </condition> <condition value="2"> <set token="new_search">| inputlookup FebStats.csv | stats sum(Duration) AS total by Entry | table total</set> </condition> <condition value="3"> <set token="new_search">| inputlookup MarchStats.csv | stats sum(Duration) AS total by Entry | table total</set> </condition> </change> </input> <single> <search> <query>$new_search$</query> <earliest>-4h@m</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> </panel> </row> </form>

Altoid17 · ‎03-02-2022

That worked perfectly. .. wow, thank you I didn't know that function existed, I had seen it written before in others comments, but never really sure how it worked or constructed itself....I now get it from the way that you have written your response.. Thank you, I've been looking for this for months and your answer, is so simple compared to way I was trying to go and has taught me something new for the day. Cheers, Lou

Altoid17 · ‎03-01-2022

Hi All, Have searched for many months and unable to locate what i need. something i believe should be so simple is alluding me..looking for some help on this. I am trying to change the colour of a bar / column chart to represent a different colour per the size of the shop and showing how many alarm incidents they have had. Visually this should allow me to see a comparison of alerts across my Large shops / my Small Shops by looking at a color only and not having to remember each shops size. ie all green shops are small. My test table is as followed : On my Graph i would like for the Size of the Shop to be color coded - Large - blue, Medium-yellow, Small-green ( the color of the 3 sizes i am not fussy on) . Shop Size TypeReport NoEvents A Large FrontAlarm 76 A Large BackAlarm 115 B Small FrontAlarm 37 B Small BackAlarm 132 C Medium FrontAlarm 81 C Medium BackAlarm 39 D Large FrontAlarm 159 D Large BackAlarm 110 E Small FrontAlarm 26 E Small BackAlarm 71 F Medium FrontAlarm 113 F Medium BackAlarm 49 I have tried several Evals but just do not see to be able to get this right. I have tried to follow several answers within the splunk community on this topic, but due to the answers evaluating time - its throwing me out and thus losing that last piece to the puzzle - i have been trying things such as - | inputlookup Testcolor.csv | search TypeReport="FrontAlarm" | stats count by NoEvents | eval {NoEvents}=count | fields - count and changing the source with the below but still no luck. <option name="charting.fieldColors">{"A":#32a838,"B":#006D9C,"C":#006D9C,"D":#32a838,"E":#006D9C,"F":#006D9 }</option> To even trying | inputlookup Testcolor.csv | search TypeReport="FrontAlarm" | stats count by NoEvents | eval Shop="A, B, C, D, E, F" | makemv Shop delim="," | mvexpand Shop | eval count=NoEvents | table Shop count | eval {Shop}=count | fields - count The above Seemed to get me close but no cigar. I have another 6 weeks before i really need to figure this out, any help would be appreciated. ( Id also prefer to build this in dashboard studio if that does help my problem - i am also only using static data so times are pulled in) Cheers

Altoid17 · ‎08-16-2021

Hi All, Looking for some help on a new cloud instance we have and to understand it a bit better. 5gb per day. I have a Non IT Sec Background. I have checked the CMC dashboard overview and am showing a 0GB ingest Volume. Throughput by index is showing values with a max of 11.597kb (last 24 hours) When i go to the CMC dash / License Usage / Ingest - everything is blank and no figures showing ( but search is working) When i go to the CMC dash / Workload - i can see SVC usage at its highest at 5.418 Current Searchable index storage at 16gb _Internal = 11 _metrics = 4 _introspection = 1 Data Ingested Graph = "no results found" I have so far ingested a small 8kb excel csv file to a lookup table and created a small inputlookup dashboard from here with a few graphs and charts. I have not set up any UF or any API feeds etc. Is the CMC not showing my daily usage quota as my files i have imported are so tiny ? if so is there a way to show the kb/mb and not GBs at this stage? or a way to show a simple bar graph of daily License 5 g and what total of this i have used per day ? ( i believe i used to have this simple to read info under licence when i had the enterprise, but do not seem to get the same results on cloud) Thank You All.

Posts	6
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-16-2021

Online Status	Offline
Date Last Visited	‎09-23-2022 12:53 AM

Is it possible to turn 8 product charts into one t...

Dashboard - Using Dropdown to select which month d...

How to get a Column / Bar Chart change color of ba...

Splunk Cloud - CMC dashboard help

Is it possible to turn 8 product charts into one t...

Re: Dashboard - Using Dropdown to select which mon...

Dashboard - Using Dropdown to select which month d...

Re: Column / Bar Chart change colour of bar per Si...

How to get a Column / Bar Chart change color of ba...

Splunk Cloud - CMC dashboard help