About incognito

incognito · ‎04-26-2022

Hello, I have the following 2 events : 1st event : { [-] dimensionMap: { [-] User type: Real users dt.entity.application_method.name: Application } dimensions: [ [-] APPLICATION_METHOD ] timestamps: [ [-] 1650966840000 1650966900000 1650966960000 1650967020000 1650967080000 1650967140000 1650967200000 1650967260000 1650967320000 1650967380000 1650967440000 ] values: [ [-] 0.47 0.67 0.37 0.45 0.44 0.57 0.48 0.47 0.69 0.70 0.40 ] } 2nd event : { [-] dimensionMap: { [-] dt.entity.application_method.name: Application } dimensions: [ [-] APPLICATION_METHOD ] timestamps: [ [-] 1650966840000 1650966900000 1650966960000 1650967020000 1650967080000 1650967140000 1650967200000 1650967260000 1650967320000 1650967380000 1650967440000 ] values: [ [-] 18 27 23 19 17 21 24 30 13 10 5 ] } I would like to bind each value of the 1st event to each value of the 2nd event. I tried some join commands using the timestamps as a common value, but it didn't work. At the end, I would like the following table (result = value1*value2) : Timestamp Value1 Value2 Result 1650966840000 0.47 18 0.47*18 1650966900000 0.67 27 0.67*27 1650966960000 0.37 23 0.37*23 1650967020000 0.45 19 0.45*19 1650967080000 0.44 17 0.44*17 1650967140000 0.57 21 0.57*21 1650967200000 0.48 24 0.48*24 1650967260000 0.47 30 0.47*30 1650967320000 0.69 13 0.69*13 1650967380000 0.70 10 0.70*10 1650967440000 0.40 5 0.40*5 Thank you. Regards,

ITWhisperer · ‎02-24-2022

| spath timestamps{} output=timestamps | spath values{} output=values | eval timestampsvalues=mvzip(timestamps,values) | mvexpand timestampsvalues | eval timestamps=mvindex(split(timestampsvalues,","),0) | eval values=mvindex(split(timestampsvalues,","),1) | table timestamps values

incognito · ‎12-31-2021

Hello, index="supervision_software" source="API" earliest=-1m | spath path=hosts{}.modules{}.instances{}.moduleVersion output=moduleVersion2 | stats count by moduleVersion2 Displays : This one is correct (total = 1290 moduleversions). The problem here is that I don't have anymore my 'hostInfo' fields and so I can't sort the moduleversions by host. index="supervision_software" source="API" earliest=-1m | spath | stats count(hosts{}.modules{}.instances{}.moduleVersion) Displays : 1345 isn't right (there are around 1270 - 1295 moduleVersion, it depends on when the API call is done). With this search, even if I try to table displayName, moduleversion and instanceName, it seems like they are not linked at all (but they are in the JSON) because the results are nonsense (e.g. a host has at least 50 moduleversion but it display only 1 for that host, it's like there is no relationships). Best regards,

ITWhisperer · ‎12-16-2021

The times created by timechart represent the start of the period / span so aligning to the axis marker makes sense i.e. the anchor for the label is to the left and the data at this point in the chart is no earlier than the value of the label. There is no anchor point in the middle of the bar in the barchart with which to align the text even if you wanted to. You might be able to hack around this by formatting the time (strftime) with leading spaces, however, you may find that the chart viz will strip leading/trailing spaces before displaying the x-axis label anyway.

Posts	7
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎12-15-2021

Online Status	Offline
Date Last Visited	‎04-26-2022 05:36 AM

How to Bind 2 events?

How to parse JSON arrays together?

JSON parsing problem

Center _time on a column chart

How to Bind 2 events?

Re: How to parse JSON arrays together?

Re: JSON parsing problem

Re: Center _time on a column chart

Are you a member of the Splunk Community?