About piukr

piukr · ‎02-22-2022

It might be useful for someone who works on a similar query. I understand why my query returned no data, it all got to do with the field name as it seems rename didn't take effect on the pre-stats fields. The correct query is the one below. | tstats prestats=true values(Traffic.reason), sum(Traffic.duration), sum(Traffic.sent), sum(Traffic.rcvd), count AS count FROM datamodel=Network_Log.Traffic BY _time span=auto | stats values(Traffic.reason) AS reason, sum(Traffic.duration) AS duration, sum(Traffic.sent) AS sent, sum(Traffic.rcvd) AS rcvd, count by _time

piukr · ‎02-16-2022

I've been using tstats in many queries that I run against accelerated data models, however most of the time I use it with a simple count() function in the following format: | tstats prestats=true count AS count FROM datamodel=... WHERE ... BY ... | eval ... | lookup ... | stats count BY ... This time, I will need to add sum() and values() functions to the tstats, but it seems I am unable to get it working. If someone could take a look at the queries and let me know what I am doing wrong, that would be great. The following query (using prestats=false option) works perfectly and produces output (i.e. the reason, duration, sent and rcvd fields all have correct values). | tstats prestats=false values(Traffic.reason), sum(Traffic.duration), sum(Traffic.sent), sum(Traffic.rcvd), count AS count FROM datamodel=Network_Log.Traffic BY _time span=auto | rename "values(Traffic.reason)" AS reason, "sum(Traffic.duration)" AS duration, "sum(Traffic.sent)" AS sent, "sum(Traffic.rcvd)" AS rcvd When I try to re-write the above query with the prestats=true option and use stats to summarize on the prestats format, the reason, duration, sent, and rcvd fields are all null. The count field is calculated correctly and displayed in the statistics table. | tstats prestats=true values(Traffic.reason), sum(Traffic.duration), sum(Traffic.sent), sum(Traffic.rcvd), count AS count FROM datamodel=Network_Log.Traffic BY _time span=auto | rename "values(Traffic.reason)" AS reason, "sum(Traffic.duration)" AS duration, "sum(Traffic.sent)" AS sent, "sum(Traffic.rcvd)" AS rcvd | stats values(reason) AS reason, sum(duration) AS duration, sum(sent) AS sent, sum(rcvd) AS rcvd, count by _time By the way, I followed this excellent summary when I started to re-write my queries to tstats, and I think what I tried to do here is in line with the recommendations, i.e. I repeated the same functions in the stats command that I use in tstats and used the same BY clause. https://community.splunk.com/t5/Splunk-Search/What-exactly-are-the-rules-requirements-for-using-quot-tstats/m-p/319801 Regards, Robert

piukr · ‎01-18-2022

Hi @tscroggins, thank you for the detailed explanation, and also for pointing out where I should look for the answer the next time 🙂 BR, Robert

piukr · ‎01-13-2022

Hello, I am trying to format multi-value cell data in a dashboard table using mvmap in an eval token before passing it on to a drilldown, however I am unable to figure out how to format the eval function and if this approach would work at all. I would appreciate if someone could tell me why this function fails. I have included a test dashboard which shows sample data (sample column) and the format that I would like to create (test column). Unfortunately, the 'temptoken' token never gets evaluated. Note, I understand that I could use different workarounds to avoid using mvmap in an eval token, such as creating a hidden field in the table and use it for drilldown, or using different eval functions (depending on the use case). I am specifically interested in the format of using mvmap in an eval token, as this function could be really useful in more complex cases that I have to deal with. <dashboard> <label>mvmap in eval token</label> <row> <panel> <table> <search> <query> <![CDATA[ | makeresults | fields - _time | eval sample = "text1 -> text2,text3 -> text4" | eval sample = split(sample, ",") ``` the SPL above this line will generate the sample data ``` | eval test = mvmap(sample, split(sample, " -> ")) ]]> </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <condition match="$click.name2$=="sample"">  <eval token="temptoken">mvmap('row.sample', split('row.sample', " -> "))</eval> </condition> <condition match="$click.name2$=="test""> <eval token="temptoken2">'row.test'</eval> </condition> </drilldown> </table> </panel> </row> <row> <html> <p> temptoken: $temptoken$ </p> <p> temptoken2: $temptoken2$ </p> </html> </row> </dashboard> Best Regards, Robert

piukr · ‎09-29-2021

Thank you, this works perfectly! Regards

piukr · ‎09-29-2021

Hello, I use the following grid structure to define source and destination filters in one of my dashboards. I would like to add a button to each panel to reset the content of the input text box, however I am struggling to create the CSS code to align the link list input correctly. I would like to move them to the top-right corner of the wide input panels (the position is highlighted with a red box on the screenshot). Could someone please help me write the correct CSS code which would align the button correctly? I have added a run anywhere dashboard with the CSS scripts included. <form theme="dark"> <label>Dashboard CSS Alignment Example</label> <fieldset submitButton="false"></fieldset> <row> <panel id="inputFilterFirstColumnRow1"> <title>Filters</title> <html/> </panel> <panel id="inputFilterSecondColumnRow1"> <input type="link" token="tokClearSrcFilter" searchWhenChanged="true" id="button_clear_src_filter"> <label></label> <choice value="clear_src_filter">X</choice> <change> <condition value="clear_src_filter"> <unset token="tokClearSrcFilter"></unset> <unset token="form.tokClearSrcFilter"></unset> <set token="tokSrcFilter">*</set> <set token="form.tokSrcFilter">*</set> </condition> </change> </input> <input type="text" token="tokSrcFilter" searchWhenChanged="true" id="wideInputBox_SourceFilter"> <label>Source Filter</label> <default>*</default> </input> </panel> <panel id="inputFilterThirdColumnRow1"> <input type="link" token="tokClearDestFilter" searchWhenChanged="true" id="button_clear_dest_filter"> <label></label> <choice value="clear_dest_filter">X</choice> <change> <condition value="clear_dest_filter"> <unset token="tokClearDestFilter"></unset> <unset token="form.tokClearDestFilter"></unset> <set token="tokDestFilter">*</set> <set token="form.tokDestFilter">*</set> </condition> </change> </input> <input type="text" token="tokDestFilter" searchWhenChanged="true" id="wideInputBox_DestinationFilter"> <label>Destination Filter</label> <default>*</default> <initialValue>*</initialValue> </input> </panel> </row> <row depends="$alwaysHideCSSStyleOverride$"> <panel> <html> <style> /* Wide text input box style. Use id="wideInputBox_unique_id" in the input header */ div[id^="wideInputBox"] .splunk-textinput { min-width: 20vw !important; width: 40vw !important; max-width: 40vw !important; color: yellow; } div[id^="wideInputBox"] .splunk-textinput input[type="text"] { min-width: 20vw !important; width: 40vw !important; max-width: 40vw !important; color: yellow; } </style> <style> /* This section sets the width of the three columns of secondary filter panels - 10% - 45% - 45% */ div[id^="inputFilterFirstColumn"]{ width:10% !important; } div[id^="inputFilterSecondColumn"]{ width:45% !important; } div[id^="inputFilterThirdColumn"]{ width:45% !important; } </style> <style> /* Clear Button positioned to the right side of the panel */ div[id^="button_clear"]{ width:20px !important; float: right; } div[id^="button_clear"] button[data-test="option"]{ flex-grow: 0; border-radius: 2px; border-width: thin; border-color: lightgrey; border-style: inset; width: 20px; padding: 2px 2px; } div[id^="button_clear"] label{ display:none; } div[id^="button_clear"] span[data-test="label"]:hover{ } div[id^="panel"].fieldset{ padding: 0px; } </style> </html> </panel> </row> <row> <panel> <table> <search> <query> | makeresults | eval src=$tokSrcFilter|s$, dest = $tokDestFilter|s$ | table src, dest </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> Regards

piukr · ‎09-21-2021

Thank you! It's not an ideal solution to include hidden fields, as those will show up once the users open the query in an external search, but I understand that there are no good options at the moment. BR

piukr · ‎09-21-2021

I have a dashboard with several multi-value fields containing IP details. I applied the following fieldformat command to truncate the result of such fields for the dashboard view. | fieldformat iplist=mvjoin(mvindex(iplist, 0, 9), ", ").if(mvcount(iplist)>10, " (".(mvcount(iplist)-10)." IPs truncated...)","") The goal is to create a field similar to the output below: 10.10.10.1, 10.10.10.2, 10.10.10.3, 10.10.10.4, 10.10.10.5, 10.10.10.6, 10.10.10.7, 10.10.10.8, 10.10.10.9, 10.10.10.10 (3 IPs truncated...) The fields are displayed in a dashboard table view according to the formatting, however when I try to drill down on these fields, the drilldown will carry over the formatted value, not the original multi-value content. I have included a test dashboard to demonstrate the behaviour. How can I modify the fieldformat command to truncate the field but also enable the dashboard to use the original field value in drilldowns? Thanks <form> <label>Fieldformat Test</label> <fieldset submitButton="false" autoRun="true"> <input type="text" token="tokIPList" searchWhenChanged="true"> <label>IP List</label> <default>10.10.10.1 10.10.10.2 10.10.10.3 10.10.10.4 10.10.10.5 10.10.10.6 10.10.10.7 10.10.10.8 10.10.10.9 10.10.10.10 10.10.10.11 10.10.10.12 10.10.10.13</default> </input> </fieldset> <row> <panel> <title>IP List input text displayed as multi value field</title> <table> <search> <query>| makeresults | fields - _time | eval iplist=$tokIPList|s$ | eval iplist=split(iplist, " ") | table iplist </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">row</option> <drilldown> <set token="tokDrilldown">$row.iplist$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>IP List input text displayed with fieldformat applied</title> <table> <search> <query> <![CDATA[ | makeresults | fields - _time | eval iplist=$tokIPList|s$ | eval iplist=split(iplist, " ") | table iplist | fieldformat iplist=mvjoin(mvindex(iplist, 0, 9), ", ").if(mvcount(iplist)>10, " (".(mvcount(iplist)-10)." IPs truncated...)","") ]]> </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">row</option> <drilldown> <set token="tokDrilldown">$row.iplist$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>Drilldown test</title> <table> <search> <query>| makeresults | fields - _time | eval formatted_iplist=$tokDrilldown|s$ | table formatted_iplist </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>

Posts	8
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎09-09-2021

Online Status	Offline
Date Last Visited	‎02-22-2022 11:19 AM

How to make tstats prestats=true with values() and...

Using mvmap in eval token

Alignment of link list on dashboard

Applying fieldformat and using the original field ...

Re: How to make tstats prestats=true with values()...

How to make tstats prestats=true with values() and...

Re: Using mvmap in eval token

Using mvmap in eval token

Re: Alignment of link list on dashboard

Alignment of link list on dashboard

Re: Applying fieldformat and using the original fi...

Applying fieldformat and using the original field ...