About vanheer

vanheer · ‎04-14-2022

@venky1544 Thank you very much, I haven't used xyseries before. One more optional question 😀 : I've created a manual dropdown span interval, but can we keep it automated as in timechart?

vanheer · ‎04-13-2022

Thanks @venky1544 , almost there! now I have each building in a field, |bin _time span=5m| stats count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by _time,building | eval Total=all_items-items_RG |fields - all_items,items_RG _time building Total 2022-04-13 17:20:00 GT01 24 2022-04-13 17:20:00 GT02 13 2022-04-13 17:20:00 GT03 29 2022-04-13 17:25:00 GT01 64 2022-04-13 17:25:00 GT02 52 2022-04-13 17:25:00 GT03 94 I need each building in a separate field to stack them in the graph. _time GT01 GT02 GT03 Total 2022-04-13 17:20:00 24 13 29 =24+13+29 2022-04-13 17:25:00 64 52 94 =64+52+94

vanheer · ‎04-13-2022

Hi, I have multiple fields like, counting how many items passing through gates: | timechart count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by building I want to exclude the counts of items_RG from the all_items, so I'm using : | eval Total=all_items-items_RG But it is not showing Total in the output, but when I use stats instead, I don't get the time column to show the graph as timechart. | stats count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by building | eval Total=all_items-items_RG I tried to use eventstats also couldn't get what I want.

vanheer · ‎03-17-2022

Thanks @VatsalJagani it works fine. Actually it was a stupid question, but it was going on the opposite direction all the time and couldn't think good 🙂

vanheer · ‎03-15-2022

Hi, I'm trying to query tables from postgres database. All tables there are under Foreign tables and nothing under tables. when I use db connect it get the schema name but it couldn't get the list of tables. How can I access the foreign tables using db connect?

vanheer · ‎01-20-2022

Hi all, I'm wondering how to use the icons and styles in this page: http://127.0.0.1:8000/en-US/static/docs/style/style-guide.html For example, where to find the code for using the accordion table? I don't want to use js or css, only what in this page of Splunk . Regards,

Posts	6
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎01-20-2022

Online Status	Offline
Date Last Visited	a week ago

How to combine timechart, stats, and eval?

How to retrieve list of foreign tables in splunk d...

Dashboard style

Re: How to combine timechart, stats, and eval?

Re: How to combine timechart, stats, and eval?

How to combine timechart, stats, and eval?

Re: How to retrieve list of foreign tables in splu...

How to retrieve list of foreign tables in splunk d...

Dashboard style