Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About paritoshs24
paritoshs24
Path Finder
Member since:
01-28-2022
10-16-2022
Community Statistics
| Posts | 24 |
| Solutions | 1 |
| Karma Given | 19 |
| Karma Received | 0 |
| Member Since | 01-28-2022 |
Activity Feed
- Posted Re: Automate splunk to reproduce data set from multiple indices and create their patterns on Dashboards & Visualizations. 10-15-2022 02:31 AM
- Posted Automate splunk to reproduce data set from multiple indices and create their patterns? on Dashboards & Visualizations. 10-14-2022 10:09 PM
- Karma Re: Diff between 2 tables for kamlesh_vaghela. 06-26-2022 11:17 PM
- Posted Re: Use the results of subsearch to rename those results with other name in new search on Splunk Search. 06-26-2022 12:44 AM
- Karma Re: Use the results of subsearch to rename those results with other name in new search for ITWhisperer. 06-26-2022 12:44 AM
- Karma Re: Use the results of subsearch to rename those results with other name in new search for gcusello. 06-26-2022 12:39 AM
- Posted Re: Use the results of subsearch to rename those results with other name in new search on Splunk Search. 06-26-2022 12:38 AM
- Posted Use the results of subsearch to rename those results with other name in new search on Splunk Search. 06-23-2022 10:33 PM
- Tagged Use the results of subsearch to rename those results with other name in new search on Splunk Search. 06-23-2022 10:33 PM
- Tagged Use the results of subsearch to rename those results with other name in new search on Splunk Search. 06-23-2022 10:33 PM
- Posted Re: Obtain data from one search and store it in a variable to search data in another search on Splunk Search. 06-21-2022 01:12 AM
- Posted Re: Obtain data from one search and store it in a variable to search data in another search on Splunk Search. 06-21-2022 01:10 AM
- Karma Re: Obtain data from one search and store it in a variable to search data in another search for richgalloway. 06-21-2022 01:10 AM
- Karma Re: Obtain data from one search and store it in a variable to search data in another search for PickleRick. 06-21-2022 01:10 AM
- Posted Re: Dashboard studio inputs : Waiting for input- Is there any option for refresh button? on Dashboards & Visualizations. 06-20-2022 09:41 PM
- Karma Re: Dashboard studio inputs : Waiting for input- Is there any option for refresh button? for elizabethl_splu. 06-20-2022 09:41 PM
- Posted Re: Obtain data from one search and store it in a variable to search data in another search on Splunk Search. 06-20-2022 09:22 AM
- Posted How to obtain data from one search and store it in a variable to search data in another search? on Splunk Search. 06-20-2022 09:21 AM
- Karma Re: Dashboard studio inputs : Waiting for input- Is there any option for refresh button? for marysan. 06-19-2022 12:18 PM
- Posted Re: Dashboard studio inputs : Waiting for input- Is there any option for refresh button? on Dashboards & Visualizations. 06-19-2022 05:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-15-2022
02:31 AM
Some Answers to the above queries . @PickleRick My events may look like..the following This is from index 1 14/10/2022 00:59:30.000 { [-] par a lkg 1 target 8 workweek ww_41_2022 } Show as raw text We have similar events for different par's having different lkg and different targets. Also we have multiple such index/sources which again contain multiple events like above. @gcusello workweek is a number or a date? its shown above...its a string -----a mix of numerals and alphabets the cross between workweek and par is a count or the value of lkg? its the value of lkg.....i cant specify numbers due to data copyrights 🙂 the relation par-target is always 1:1? yes its a 1:1......... for every par we have a lkg we have a target and a corresponding workweek. par, lkg, target and workweek are all in the same event (record) in all the three indexes? yes all the multiple indices have events which contain same info like par its target its lkg and corresponding ww info...and many other info but they are irrelevant as of now. when you say line chart, are you meaning one line chart or one for each workweek? When i say line chart i mean to say the summary that i need to create shud have par/targets/and lkg from each ww and a line chart showing how lkg is changing for each par across all workweeks.......for my line chart y axis wud contain lkg while x axis wud contain the ww par Target ww1 ww2 ww3 line chart a 8 1 5 4 b 9 2 6 5 c 7 3 7 8 d 6 4 8 2
... View more
10-14-2022
10:09 PM
Hi Team my data across multiple indices looks like this from latest index to oldest
oldest
latest
Index 1
index 2
index 3
par
lkg
target
workweek
par
lkg
target
workweek
par
lkg
target
workweek
a
1
8
ww1
a
5
8
ww2
a
4
8
ww3
b
2
9
ww1
b
6
9
ww2
b
5
9
ww3
c
3
7
ww1
c
7
7
ww2
c
8
7
ww3
d
4
6
ww1
d
8
6
ww2
d
2
6
ww3
I want to recreate data like this
par
Target
ww1
ww2
ww3
line chart
a
8
1
5
4
b
9
2
6
5
c
7
3
7
8
d
6
4
8
2
The major catch is .... we do not know how many indices are there .....we do no know how many par are there in any index and how to automate splunk to create line chart for each of these par showing lkg trend across the workweeks.
@Richfez @richgalloway @ITWhisperer @aljohnson_splun @PickleRick autom
... View more
Labels
- Labels:
-
Dashboard Studio
-
table
06-26-2022
12:44 AM
Thanks !! My queries/data base is not fixed. I used selfjoin though as it made my life simpler thanks for your explanation too.
... View more
06-26-2022
12:38 AM
Thanks for your answer...at the end i used selfjoin command ......Voila ! ITs done ! 🎉
... View more
06-23-2022
10:33 PM
Hi All, I have this data in index 1 input active Idle a d g b e h c f i I have this data in index 2 input TEST pwr a d 1 b e 2 c f 3 a g 4 b h 5 c i 6 Now i want to change these d , e, f to active and g, h, i to idle so my data in index looks like this input TEST pwr a active 1 b active 2 c active 3 a idle 4 b idle 5 c idle 6 and then i want to run my final search. I tried sub searches and all, but unable to do this. I have given small example there are 100s of active and idle entries
... View more
06-21-2022
01:12 AM
Can you please point out how subsearch could be escaped ?
... View more
06-21-2022
01:10 AM
Hi .... Its working...thanks for the help. One more thing to ad in subsearch : Can I use IN command ?? index = idx source = src data_stamp = B field1 = *lol* [ index = idx source = src data_stamp IN (A B) field1 = *lol* | return TEST=Field2 ] | table field 3 I need to pass multiple values of data_stamp.
... View more
06-20-2022
09:41 PM
Thankyou Elizabeth for wonderful explanation. I got your point. I was naive to ask such question (though i am actually naive in splunk as of now). I was focussing on my inputs and submit button so much that i forgot abt my visualizations. Though I found out different method. Removed submit button --> made each input serially dependent on its previous inputs Made all my visualizations dependent on all of these inputs. made default value of all of these inputs empty ...so there are no changes in visualisations when we are selecting inputs So untill and unless i select final input .....none of my visualisations will update. and next will update only when we have correct previous selections
... View more
06-20-2022
09:22 AM
@ITWhisperer
... View more
06-20-2022
09:21 AM
My search is like this index = idx source = src data_stamp = A field1 = *lol* | table Field2 --> This generates a column with only value which i need to store in some $VAR
index = idx source = src data_stamp = B field1 = *lol* TEST = $VAR | table field 3
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
-
table
06-19-2022
05:48 AM
Can you please elaborate ? I did not get your point.
... View more
06-18-2022
02:23 PM
index=cms_vm $ostestfield$ @DalJeanis @gbwilson instead of above command we can use index IN (cms_pc cms_vm cms_host) OperatingSystem_Code IN ($ostestfield$)
... View more
06-18-2022
02:19 PM
Dude !!!!! Your answer saved my life !! 😘
... View more
06-18-2022
12:22 PM
@gcusello @PickleRick
... View more
06-18-2022
12:28 AM
Can you look into this query ? Dashboard studio inputs : Waiting for input- Is th... - Splunk Community
... View more
06-17-2022
04:14 AM
Hi All,
I have provided multiple inputs in my dashboard studio and their tokens are being used across multiple searches in the same Dashboard.
I am seeing this issue:
I have to click submit button multiple times.
My multi select inputs look like this and they are interdependent on each other:
Example: Values of B is dependent on A
Values of C is dependent on A, B
Values of D is dependent on A, B, C
Values of E is dependent on A,B,C,D like that. Now say if i have selected A,B,C ....D will not update its values until and unless i click submit button.......similarly E will also not update its new values until and unless after selecting D, i press again submit button. Is there any option for refresh button ? If i remove submit button, my whole dashboard starts refreshing with each selection of input and this eats away a lot of time.
... View more
Labels
- Labels:
-
Dashboard Studio
-
other
-
token
05-13-2022
09:10 AM
Sorry, My Bad !! Worked for me too, it was an error on my part. Can you also please provide me a solution with field formatting, will keep that in mind for future use cases.
... View more
05-12-2022
10:54 PM
The coalesce command isn't working, its printing all the values as it is
... View more
05-12-2022
03:01 PM
Thanks for the solution. Can you also please provide the solution with FEILDFORMAT command ? 🙂 😀
... View more
05-12-2022
02:39 PM
Hi Team,
Following is my data:
SS
TT
DT
DA
LT
LA
TO
TA
a
xxx
4
3
2
3
7
6
a
yyy
2
2
2
3
4
5
b
xxx
1
1
1
1
3
3
b
yyy
1
1
1
1
1
1
following is the graph i can populate in excel
Following is the graph I was able to populate in splunk
My problem is I can "SS" written in the Splunk graph, also I can see "a" "b" written in the graph....but along from these i also need "xxx" "yyy" to appear as legend under all 4 graphs. how can we do that? MY QUERY FOR DATA |stats sum(* ) by SS,TT |foreach sum* [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ] |rename sum(*) as * |stats values(*) by SS,TT |rename values(*) as * |table SS,TT,DT,DA,LT,LA,TO,TA
... View more
05-12-2022
02:09 AM
a
b
c
d
e
f
g
xyz
1
2
3
4
5
6
My table looks like that I need the following table
a
b
c
d
e
f
g
xyz
1000.00
2000.00
3000.00
4000.00
5000.00
6000.00
but with the below command I am getting the following table : my string field gets eliminated
my query for data | foreach * [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ]
a
b
c
d
e
f
g
1000.00
2000.00
3000.00
4000.00
5000.00
6000.00
How to obtain everything above along with xyz in a column ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-16-2022
08:04 AM
|
Karma given to
