About dzyfer

ITWhisperer · ‎11-03-2022

bowesmana · ‎09-25-2022

A search time extraction if extract does not do what you want is (from rex statement onwards - first two lines create your sample) | makeresults | eval _raw="\"var0\":0,\"var1\":10,\"var2\":20,\"var10\":100" | rex max_match=0 "\"(?<key>var[1-9]\d*)\":(?<value>[^,]*)" | foreach 0 1 2 3 4 5 6 7 8 9 [ eval k=mvindex(key, <<FIELD>>), v=mvindex(value, <<FIELD>>), {k}=v ] | fields - key value k v

richgalloway · ‎09-21-2022

The fillnull comand should help with that. | fillnull stTestData9

bowesmana · ‎09-19-2022

Yes, it's just a token housekeeping issue - the search that calculates earliest/latest always runs, so even if you select another time window, that search always runs, so will calculate the custom time range. You just need to make the search use depends="$showCustom$" as in the attached, which you will see then prevents the search from running, so it does not overwrite the custom_* tokens if you select any of the non-custom options. Note that in your definition, "Yesterday" is not actually yesterday - it's actually last 7 days (-7d@d+7h) and last 7 days is last month... <form> <label>TEST</label> <fieldset submitButton="false"> <input type="dropdown" token="field1"> <label>Time Selection</label> <choice value="yesterday">Yesterday</choice> <choice value="-7d">Last 7 Days</choice> <choice value="mtd">Month To Date</choice> <choice value="custom">Custom Time</choice> <change> <condition label="Yesterday"> <set token="custom_earliest">-7d@d+7h</set> <set token="custom_latest">@d+7h</set> <unset token="showCustom"></unset> </condition> <condition label="Last 7 Days"> <set token="custom_earliest">-4w@d+7h</set> <set token="custom_latest">@d+7h</set> <unset token="showCustom"></unset> </condition> <condition label="Month To Date"> <set token="custom_earliest">-5mon@mon+7h</set> <set token="custom_latest">@d+7h</set> <unset token="showCustom"></unset> </condition> <condition label="Custom Time"> <set token="showCustom">Y</set> </condition> </change> <default>yesterday</default> <initialValue>yesterday</initialValue> </input> <input type="time" token="customTime" depends="$showCustom$"> <label>Time Range</label> <default> <earliest>-3d@d+7h</earliest> <latest>-2d@d+7h</latest> </default> </input> </fieldset> <row> <panel> <html> Custom:$customTime$<br/> custom_earliest:$custom_earliest$<br/> custom_latest :$custom_latest$<br/> </html> </panel> <panel> <table> <search depends="$showCustom$"> <done> <set token="custom_earliest">$result.info_min_time$</set> <set token="custom_latest">$result.info_max_time$</set> </done> <query>| makeresults | addinfo | eval min=strftime(info_min_time, "%F %T") | eval max=strftime(info_max_time, "%F %T") | fields - info_sid</query> <earliest>$customTime.earliest$</earliest> <latest>$customTime.latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

bowesmana · ‎09-13-2022

Multiple vizualisations inside a single <panel> element are laid out horizontally for SV viz and vertically for other viz, so I don't think you can do that without CSS - not sure you can drag the table to the same line as the pie with CSS, but most things are possible if you know your CSS. I have used multiple <row> elements do do this sort of thing as it's simple and you can tweak the CSS to remove row margins, to make those rows look more of a single unit.

dzyfer · ‎09-05-2022

<viz type="status_indicator_app.status_indicator"> <search> <query>...</query> <earliest>-1@min</earliest> <latest>now</latest> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="height">100</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">1</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option> </viz>

kamlesh_vaghela · ‎09-01-2022

@dzyfer Can you please try this? YOUR_SEARCH | foreach * [ eval "<<FIELD>>_row_count" = 0 ] | foreach * [ eval "<<FIELD>>_row_count" = if(isnull('<<FIELD>>'),'<<FIELD>>_row_count' ,'<<FIELD>>_row_count'+1) ] | addcoltotals | foreach * [ eval <<FIELD>>=if(isnull(Name),'<<FIELD>>'/('<<FIELD>>_row_count'),'<<FIELD>>') ] | fields - *_row_count | addtotals | eval column_count=0 | foreach * [ eval column_count=if(isnull('<<FIELD>>'),column_count ,column_count + 1)] | eval column_count = (column_count-3) | eval Avg_1 = Total/column_count | fields - column_count Total | eval Name=if(isnull(Name),"AVG_2",Name) My Sample Search : | makeresults | eval _raw="Name 03-22 04-22 05-22 06-22 07-22 08-22 A 11.11 11.11 11.11 11.11 11.11 B 22.22 22.22 22.22 22.22 22.22 22.22 C 33.33 33.33 33.33 33.33 33.33 D 44.44 44.44 44.44 44.44 44.44 44.44 E 55.55 55.55 55.55 55.55 55.55 55.55 " | multikv forceheader=1 | table Name 0* | foreach * [ eval "<<FIELD>>_row_count" = 0 ] | foreach * [ eval "<<FIELD>>_row_count" = if(isnull('<<FIELD>>'),'<<FIELD>>_row_count' ,'<<FIELD>>_row_count'+1) ] | addcoltotals | foreach * [ eval <<FIELD>>=if(isnull(Name),'<<FIELD>>'/('<<FIELD>>_row_count'),'<<FIELD>>') ] | fields - *_row_count | addtotals | eval column_count=0 | foreach * [ eval column_count=if(isnull('<<FIELD>>'),column_count ,column_count + 1)] | eval column_count = (column_count-3) | eval Avg_1 = Total/column_count | fields - column_count Total | eval Name=if(isnull(Name),"AVG_2",Name) I hope this will help you. Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

chaker · ‎08-28-2022

A few things to try: Print out the tokens in a panel to make sure they are being set to the value you expect. You may need to use dot notation, so what ever the token name of your input is. <input type="dropdown" token="my_date"> my_date.custom_earliest my_date.custom_latest Try wrapping the time modifer in quotes <set token="custom_latest">"@d+7h"</set> Try matching condition value instead of label. Should be the same, but worth a try.

dzyfer · ‎08-26-2022

Hi, is it possible to hide the values of the chart overlay on Dashboard Studio, to simulate a trend line?

dzyfer · ‎08-23-2022

Hi, how do I display my Status Indicator with dynamic colors and icons in a Trellis layout? | eval status=case(status_id==0,"Idle", status_id>=1 AND status_id<=3,"Setup/PM", status_id==4,"Idle", status_id>=5 AND status_id<=6,"Down", status_id>=7 AND status_id<=8,"Idle", status_id==9,"Running") | eval color=case(status_id=0,"#edd051", status_id>=1 AND status_id<=3,"#006d9c", status_id=4,"#edd051", status_id>=5 AND status_id<=6,"#ff0000", status_id>=7 AND status_id<=8,"#edd051", status_id=9,"#42dba0") | eval icon=case(status_id=0,"times-circle", status_id>=1 AND status_id<=3,"user", status_id=4,"times-circle", status_id>=5 AND status_id<=6,"warning", status_id>=7 AND status_id<=8,"times-circle", status_id=9,"check") | stats last(status) last(color) last(icon) BY internal_name This only displays the status with no icons and the default grey color. Thanks.

gcusello · ‎06-10-2022

Hi @dzyfer, Ok, in this case the easiest approach is schedule all your original searches (frequency depends on how many data you receive) and saving results in a summary index, then you can use this Summary index for your global timecharting. Ciao. Giuseppe

PickleRick · ‎06-07-2022

Half of the solution is almost there (filtering on weekday). You need the other half. Something like that if you want to account for the events which do not have my_var values at all, you'd probably have to fiddle with fillnull. | date_wkend = strftime(_time,"%A") | bin _time span=1d as timehelper | eventstats dc(my_var) as dc by timehelper | where NOT ((date_wkend="saturday" OR date_wkend="sunday") AND dc=1 AND my_var=0)

dzyfer · ‎05-24-2022

Hi @gcusello , I made some edits to your suggestion, and have come up with satisfiable results, thank you.

ITWhisperer · ‎05-19-2022

| table shift count

Posts	30
Solutions	0
Karma Given	9
Karma Received	0
Member Since	‎03-03-2022

Online Status	Offline
Date Last Visited	‎12-08-2022 12:12 AM

How to add empty row after each unique value in a ...

What would be the regular expression when using re...

How to let dropdown and time inputs share the same...

How to transform event data for table display?

How to combine three panels with one above and two...

How to set Status Indicator font size?

How to append a row and a column of averages?

How to run searches using different time ranges in...

How to hide values of chart overlay on Dashboard S...

How to use dynamic colors and icons for Status Ind...

Re: How to add empty row after each unique value i...

Re: Using rex to match range of digits

Re: Transforming event data for table display

Re: How to let dropdown and time inputs share the ...

Re: How to combine 3 panels with 1 above and 2 bel...

Re: How to set Status Indicator font size?

Re: How to append a row and a column of averages?

Re: How to run searches using different time range...

How to hide values of chart overlay on Dashboard S...

How to use dynamic colors and icons for Status Ind...

Re: How to sum timechart results from multiple sea...

Re: How to exclude events if results from entire d...

Re: How to append string to timechart data labels?

Re: How to split time into 3 shifts with labels on...