About splunkernator

splunkernator · ‎10-10-2023

if only it was supported in dashboard studio! will use classic for the time being - thank you!

splunkernator · ‎10-10-2023

Hi Forum, I have written a script that pull off the receive power from optical transceivers on every hour. All is well with this except, as the values are a measurement in loss, they are negative values in bells. I would really like to represent this with the single value radial - I can get it to work with a perfectly with a marker gauge but having that "rev counter" type representation would not only be so cool bit so useful to get power readings at glance on our long range transmission kit, its such a perfect representation I think for this kind of measurement, and would really appeal to that more "scientific" engineering type of audience. When I use the single value radial I cannot for the life of me work out where I can adjust the scale (ideally -40dBm to 0dBm. I just expected this to be like managing any other sort of float (I am working with a decimal number, not a string or anything), just to happens to be a negative value. Am I just missing something really silly? Any help would be gratefully received - I'm using dashboard studio if that makes a difference. Thank you

splunkernator · ‎10-06-2023

wow - I like that - looks perfect thank you for the ideas 😀

splunkernator · ‎10-06-2023

I do agree with you and that was a first practical choice I was thinking of. There is a risk I may be over engineering an answer, but the goal would be to get a simple view of "where the gaps are". I find the more elaborate visualisations particularly helpful as they allow me to take dry technical topics and present to non technical people, who often control budgets, and I can automate the creation of data and feed into existing automated workflows, alerting, ticketing and so on; which for me results in the approach running itself so I can move on to something else. This is really the my goal in practice. Really appreciate the quick feedback - starting simple sound very sensible!

splunkernator · ‎10-06-2023

Hi Forum, I want to chart a list - say for example {1..100} and represent this in a mosaic type visual presentation., if a number has been used, or not. So I would probably look to introduce a second dimension, 1 = used , 0 = unused. Punch card looks interesting - anyone done anything similar - maybe ip addressing or something else? my use case is charting ldap attributes (I generate the data with a script so I can control the shape of it) Want to get everyone away from spreadsheets....

splunkernator · ‎10-12-2022

Hi forum! getting a bit muddled here, I want to statistically demonstrate a recurring weekly trend , so timewrap sounds great. Then again I want to work out a 95% variation of this, so predict sounds awesome. I want to do this so that I can hopefully create an action (alert) condition based on overlaying this variance on a real time data series: enabling me (hopefully) to answer the question "is this normal or not?" When I look at what the two commands do, they seem to want to do different things - I mean how can you predict a timewrap that circles back by design? So splunk - understandably errors - an I ask for forgiveness of my bad logic 🙂 . Can anyone give me any advice?

splunkernator · ‎07-28-2022

Hi thanks - I have had to basically make this up, so the shape of the data below is broadly the same, but utterly fabricated to protect my client. 2019-07-29T05:29:26.762Z DEBUG <foo-5-thread-2> [BarAgent] The asynchronousNotification message is: <TERMINALRESPONSE> <SERVERDN>cn=00e5934f-12be-4cbf-8608-a75905dadbe7,ou=foo,dc=bar,dc=hyper,dc=out</SERVERDN> <SERVERPOOLDN>cn=foo-bar-agent,ou=server groups,dc=bar,dc=hyper,dc=out</SERVERPOOLDN> <SERVERDNSNAME>FOO-FB02Z-BAR019</SERVERDNSNAME> What is interesting it the data doesn't seem "clean" - that there is no closing tag for <foo-5-thread-2> (i.e. no </foo-5-thread> ; and in other instances there is - if you can provide an example, I can take this away and work on it, much appreciated.

splunkernator · ‎07-28-2022

I got some embedded XML in a Syslog message. I have no access to get under the bonnet in an admin sense. I need to "grok" the message - ideally into stages 1 - extract xml 2 - parse xml, split up with eval or something I have seen a bunch of stuff around props.conf - but I guess I need to go to one of the "collector" nodes so it parses at source?

splunkernator · ‎07-28-2022

have you got any good links? else I'll just search

splunkernator · ‎07-28-2022

couldnt see where to use that so I created two drop downs and put Time Range Currently using Start Time input $earliest_time$ - $latest_time$ in the data definition I can link these two variables into all graphs - couldnt find the bog standard time picker

splunkernator · ‎07-10-2022

Anyone know if there is a schema I can load into my IDE so when I modify a dashboard json definition I can detect errors and invalid kv pairs?

splunkernator · ‎07-10-2022

Code is easier to explain: I wanted a bunch of new categories and i found eval especially useful - here is an obfuscated example | index=my_index CONNECTED source="/var/log/vmware/my_log.log" | eval vdi_pool=case( match(name,"1A-VDI\d{3}"), "pool1", match(name,"1B-VDI\d{3}"), "pool2", match(name,"2A-VDI\d{3}"), "pool3", match(name,"2B-VDI\d{3}"), "pool4", match(name,"3A-VDI\d{3}"), "pool5", match(name,"3B-VDI\d{3}"), "pool6", 1=1, "unclassified" ) | timechart span=1h count by vdi_pool This made the subsequent querys super easy. Irritatingly within the dashboard, if I add a new value I need to update all of the queries - this vexes me greatly 😥 I have noticed the entire definition can be downloaded as a json doc - so Im tempted to start templating this in python - this does not seem sane - ideally I'd like to create blocks of repeatable logic I can assemble together to show different scenarios. Anyone done anything similar to achieve this kind of capability - but more "splunkonic"?

splunkernator · ‎07-10-2022

Howdy Splunkers! WARNING: NEWBIE I was after a preset drop down, and I'm after something more 'splunkonic' on the dashboard studio. Classic dashboards seem to come with the convenience of the relative timeset and so on: really useful. Dashboard Studio is quite nice and after head scratching I wanted feature parity. So to either completely substitute the queryParameters dictionary with a bunch of drop downs - or create an object like this: "queryParameters": { "earliest": "$query.earliest_time$", "latest": "$query.latest_time$" } If I was using python Id create a class or just insert a dict - how is everyone else managing? Currently I have a ealiest_time input and a latest_time input drop down and substitute he values of the keys above: "queryParameters": { "earliest": "$earliest_time$", "latest": "$latest_time$" }

Posts	13
Solutions	1
Karma Given	5
Karma Received	0
Member Since	‎07-10-2022

Online Status	Offline
Date Last Visited	‎10-10-2023 03:21 PM

Single Value Radial - negative values

Data Visualisation Advice: Representing a Range of...

Do predict and timeswrap mix?

How to extract XMP, parse XML, and split it up wit...

Schema for Dashboard JSON?

Reuse-able Pattern matching blocks for eval?

Dashboard Studio and Relative Timing Presets

Re: Single Value Radial - negative values

Single Value Radial - negative values

Re: Data Visualisation Advice: Representing a Rang...