About mjon395

mjon395 · ‎10-14-2022

Perfect, as desired. I don't think I was close to the change and == eval tokens as you set, so you saved me a lot (more) headache. I have additionally added extra tokens so only the specific dashboards load the query (I think?). So instead of all 40 dashboards loading in the background, the queries fail to load unless the respective token is true. <form> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="dashboard"> <label>Dashboard Selection</label> <fieldForLabel>Picker</fieldForLabel> <fieldForValue>Picker</fieldForValue> <search> <query>| makeresults | eval Picker = "Apple,Orange" | eval Picker = split(Picker,",") | stats count by Picker</query> </search> <change> <eval token="showapple">if("Apple"==$value$, "TRUE", null())</eval> <eval token="searchapple">if($showapple$=="TRUE","| makeresults", null())</eval> <eval token="showorange">if("Orange"==$value$, "TRUE", null())</eval> <eval token="searchorange">if($showorange$=="TRUE","| makeresults", null())</eval> </change> </input> </fieldset> <row> <panel> <html>DEBUG TOKENS : : : showapple - $showapple$ ($searchapple$) || showorange - $showorange$ ($searchorange$) || dashboard - $dashboard$</html> </panel> </row> <row> <panel depends="$showapple$"> <title>Apple Dashboard</title> <table> <search> <query>$searchapple$ | eval Events = "10.10.10.10" | table Events</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$showorange$"> <title>Orange Dashboard</title> <table> <search> <query>$searchorange$ | eval Events = "192.168.1.1" | table Events</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> Is there an issue with this method to prevent the "inactive" panels from queueing up queries? (searchapple, searchorange)

mjon395 · ‎10-14-2022

In the actual dashboard, the dropdown search is looking for all values within a lookup. These values never change; it's just simpler to use the lookup to spit the values out rather than typing in the values one by one. The only reason I mentioned that the dropdown panel uses a search for the values was because I was not sure if this would change the solution needed compared to using static options.

mjon395 · ‎10-14-2022

Hi All, I have a dashboard with a dropdown of about 40 choices that come from a search query (not static). Each choice should "unhide" the respective panel on the dashboard. I do not think I am grasping the <done>, <change>, <finalized>, <condition match>, etc elements I need to figure this out. I have created a dummy version of my actual dashboard below: <form> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="dashboard"> <label>Dashboard Selection</label> <fieldForLabel>Picker</fieldForLabel> <fieldForValue>Picker</fieldForValue> <search> <query>| makeresults | eval Picker = "Apple,Orange" | eval Picker = split(Picker,",") | stats count by Picker</query> </search> </input> </fieldset> <row> <panel> <html>DEBUG TOKENS : : : showapple - $showapple$ || dashboard - $dashboard$</html> </panel> </row> <row> <panel depends="$showapple$"> <title>Apple Dashboard</title> <table> <search> <query>| makeresults | eval Events = "10.10.10.10" | table Events</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$showorange$"> <title>Orange Dashboard</title> <table> <search> <query>| makeresults | eval Events = "192.168.1.1" | table Events</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> You will notice I do not have any code to decipher when showapple or showorange is true. I basically tried iterations of this code to make it work: <done> <condition> <eval token="showapple">if($dashboard$="Apple","TRUE",null())</eval> <eval token="showorange">if($dashboard$="Orange","TRUE",null())</eval> </condition> </done> I have tried using the above in different areas, and I always get null(). I also tried doing <change> instead of <done> so the dashboards would change depending on the dropdown value instantly, but I did not have success there either.

mjon395 · ‎07-15-2022

This is more efficient (I think) because I have ~40 saved searches, but yes; same results. Thank you for all the help.

mjon395 · ‎07-15-2022

This seems to be working, thank you! Brings me to a new question that I thought of after seeing it working. When I append multiple saved searches together, what would be the best approach to making the new eval field? For example (group_name exists in the savedsearches already): | loadjob artifact_offset=0 savedsearch="named_search_A" ```current week for A group``` | append [| loadjob artifact_offset=0 savedsearch="named_search_B"] ```current week for B group``` | eval artifact_offset=0 | append [| loadjob artifact_offset=1 savedsearch="named_search_A" ```previous iteration for A group``` | eval artifact_offset=1] | append [| loadjob artifact_offset=1 savedsearch="named_search_B" ```previous iteration for B group``` | eval artifact_offset=1] | stats dc(hosts) as hosts by artifact_offset group_name Is the above code the most efficient approach? It would seem I need to add the artifact_offset eval after each "1 offset" for each group. I can't do [ append [ append [| loadjob artifact_offset=1 savedsearch="named_search_A"] [| loadjob artifact_offset=1 savedsearch="named_search_B"] | eval artifact_offset=1 ] The 'append' command cannot be the first command in a search

mjon395 · ‎07-14-2022

Most of my operations are based off of saved searches and these are saved a few times weekly or monthly. The columns available should always align. I tried to get the base SPL down so I could have an output with a table showing one column with result from offset=0 (current iteration), and another column with results from offset=1 (1 previous iteration), but I could not get this to work. I was expecting the below: Available Columns Value from Offset=0 Value from Offset=1 # of hosts 1000 955 As an example, the current query would look like this: | loadjob artifact_offset=0 savedsearch="named_search" ```current week``` | loadjob artifact_offset=1 savedsearch="named_search" ```previous iteration``` Once the table gets figured out, I'm not sure how I could even use the data for a single value visualization, because it would need | timechart count to operate, but my "time" is the value from "artifact_offset" So, 2 things: Any help with the table to visualize differences between 2 jobs based on artifact_offset? With that table, would it even be possible to use the outputs to populate the single value visual? Any help here? Or any other questions I need to answer?

mjon395 · ‎06-29-2022

Thanks! This worked perfectly, and the nested cases instead of ifs really makes it a lot more understandable for me. I'm pretty sure I will need to go one step deeper, so a nested nested case, but should be doable with some trial and error! Thanks for pointing me the right way.

mjon395 · ‎06-27-2022

Hello, It's possible that I've had too long of a day, but I can't wrap my head around nesting many ifs. Is anyone willing to help me out? I am really bad at writing out SPL queries to make it visually understanding with parentheses and commas. Does anyone have some additional tips on that as well that would be useful for these nested scenarios? For example: | eval new_field = if(pass_fail="fail", if(importance="0" OR importance="1", case( Days<7 OR State="Online","Gold", Days >=7 AND Days<14,"Orange", Days>=14,"Red"), if(importance="2", case( Days<30 OR State="Online","Gold", Days >=30 AND Days<60,"Orange", Days>=60,"Red"), if(importance="3", case( Days<60 OR State="Online","Gold", Days >=60 AND Days<120,"Orange", Days>=120,"Red"), "importance_3_false"), "importance_2_false"), "importance_1_0_false"), "main_if_fail") The idea is to break out into a newfield by first looking at only the "fail" items, and then further breaking down the "fail" items by their importance (which can be 0, 1, 2, 3) where 0&1, 2, and 3 have their own case statements. All the case statements and ifs should be true, and the "importance_3_false" (for example) are more for debugging and should never actually show in my output. I appreciate any help and thank you. Error in 'eval' command: The arguments to the 'if' function are invalid.

mjon395 · ‎06-13-2022

Perfect! That worked. Did a quick check with both invalid and valid IDs and the expected result occurred. Thank you!

mjon395 · ‎06-10-2022

Hmm, no luck with that either. showpanel is actually setting to null instead of true, which seems like evn:user isn't passing, but the simple html debug shows the id as being fine.

mjon395 · ‎06-10-2022

Hello, I'm working on showing a panel if the $env:user$ is a match based on a search. The search that I'm using works for this use case: | rest /services/authentication/current-context splunk_server=local | fields username | rename username AS id This retrieves the appropriate ID (otherwise, I would just use the $evn:user$ for conditional visibility, but this never works). With the query result, I set a token envid to $result.id$ I then do a condition match where $envid$==uu_33 (uu_33 represents the user ID required to display a panel). The result of the query is always correct with "uu_33", which matches the condition I have written. I have tried following the splunk guides, and I have tried the following condition matches: <condition match="'$envid$'=="uu_33""> (current) <condition match="$envid$=="uu_33""> <condition match="'$envid$'==uu_33"> <condition match="$envid$==uu_33"> Nothing makes the panel show. Here is my XML. Any help would be appreciated. <dashboard> <label>testenvid</label> <row> <panel> <html> <b>hi. your current id is $env:user$. The current result is $envid$ is set to be equal to $result.id$.</b> </html> </panel> <panel depends="$showpanel$"> <table> <search> <finalized> <set token="envid">$result.id$</set> </finalized> <done> <condition match="'$envid$'=="uu_33""> <set token="showpanel">TRUE</set> </condition> </done> <query>| rest /services/authentication/current-context splunk_server=local | fields username | rename username AS id</query> <earliest>-60m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard>

mjon395 · ‎04-15-2022

Hello, I've been trying a few different ways, with no luck, to represent some server counts that I see happening on Thursday, Friday, Saturday, Sunday, Monday(sometimes). Unfortunately, it seems like I can't do this count "per week" as we need to count per the last "scan time" which will start thursday and end on the latest Monday. I started looking into my possible options, and think I have half an idea of how to accomplish it, but if there's better ideas then that would be awesome as well. Is it possible to do a sum based on "grouped days") Thurs+Fri+Sat+Sun+Mon, or dayofweek 4,5,6,0,1? The main thing I can't get over is how to differentiate the "grouped days"? We like to evaluate based on the "current week" of the year, but this would bring our "grouped days" to persisting through multiple "current weeks" of the year (this is variable 'weekofyear'). Essentially, I need to count weekofyear where the output would be like: Department Week of Year (technically, this is our "scan cycle") Server Count (Server_Responses) Dept.A 10 (this would be combined between Thurs,Fri,Sat,Sun,Mon...) 100 (ie; we saw 3 thurs, 90 fri, 3 sat, 3 sun, 1 mon...) Dept.B 10 200 Dept.A 11 105 (ie; we saw 10 thurs, 80 fri, 10 sat, 3 sun, 2 mon...) Dept.B 11 203 I haven't really gotten any further than just evaluating date commands to evaluate my options. Other than that, I just have a line chart indicating a day of week over the counts... It's not very pretty. index blah sourcetype blah search blah ```what i have been looking at so far...``` | rename server_id as "Server_Responses" ```at this point I was just looking at the possibilities to count by an aggregated "day of week in number" or by "dayofweek(short|full)", and real all possibilities``` | eval dayofweekshort=strftime(_time,"%a") | timechart count(ping.status) as pingstats, dc("Server_Responses") by Department span=1w@1w ```Start evaluating possible days, weeks, months, current weeks, etc``` | eval dayofweekshort=strftime(_time,"%a") | eval dayofweekfull=strftime(_time,"%A") | eval dayofweekasnumber=strftime(_time,"%w") | eval dayofmonth=strftime(_time,"%d") | eval weekofmonth=floor(dayofmonth/7)+1 | eval weekofyear=strftime(_time,"%U") | fields - day

Posts	12
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-15-2022

Online Status	Offline
Date Last Visited	‎10-14-2022 01:12 PM

How to achieve a token value change based on dropd...

How to compare savedsearch loadjob artifacts, and ...

How to work with nested Ifs and cases in a query?

How to set token from search and then conditionall...

Column Chart over repeating day ranges- Is it poss...

Re: Token Value Change Based on Dropdown?