About splunk_enjoyer1

splunk_enjoyer1 · ‎01-03-2023

I thought there would be a way to query each row using the _key field or query the whole KVstore to find out when a certain row was added or edited by maybe using a hidden system field like _time for example. Unfortunately other than that there is no real way for me to find out or have an accurate estimation of when certain rows were added or edited inside the KVstores 😞

splunk_enjoyer1 · ‎01-02-2023

Basically we had a few scripts that were being ran via cronjobs and those scripts would update the KVstores periodically. But at some point in time some scripts stopped working and I wanted to know if there was any way possible to check in Splunk when a KVstore was last updated. Is there any way to check when a row was added/edited to a KVstore? Through querying the _key for example.

splunk_enjoyer1 · ‎01-02-2023

Hello, The question is pretty simple, is there any way to query a KVstore to be able to find the last time that KVstore was updated? I know how to do what for an Index but the query doesn't work for KVstores 😞 Thank you

splunk_enjoyer1 · ‎10-03-2022

I managed to do this myself and forgot to close the post. I was already doing the token part with the job.resultCount, but the issue I was having is that the XML code for the colour range of the single value panel wouldn't accept a variable as a number, it had to be a normal, so I wasn't able to use the token. Basically I had to do the eval on panel A with the token and then giving the result as "severe" or "low", etc, to match the colour I wanted and use those hard-coded splunk colours and for that to work I had to delete the XML code that was tied to the single panel colouring. Making panel A depended on the result token is not needed 🙂 Thank you for your input though 🙂

splunk_enjoyer1 · ‎09-29-2022

Hello, I apologize if this is not in the correct location. Basically, in order to simplify things, let's say I have a dashboard with 2 panels doing 2 seperate search queries. Both are a "| stats count" and they both return values. What I want to do is change the color of the value of Panel A based on the result of Panel B, and if for example the value of Panel B is 50% larger or smaller than Panel A, then the value of Panel A should turn yellow. But I don't know how to turn the value of a panel into a variable or a token and use that variable or token to create a range based on a % of that value. Is this possible? I did some research in splunk doccumentation and I thought I found a way to make it work but I don't know if it works because I'm not able to get it working. Basically I tried doing <set token="result_token">$job.resultCount$</set> which in my mind would use the result count of the panel and convert that result into the "result_token" and then I would be able to use that "result_token" to do something like <option name="drilldown">none</option> <option name="rangeColors">["yellow","purple"]</option> <option name="rangeValues"> "result_token" > 50% = yellow</option> <option name="rangeValues"> "result_token" < 50% = yellow</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> I don't know if I made any sense.

Posts	5
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎09-29-2022

Online Status	Offline
Date Last Visited	‎01-06-2023 04:34 PM

How to find KVstore last update date?

How to turn panel results into a variable?

Re: How to find KVstore last update date

Re: How to find KVstore last update date

How to find KVstore last update date?

Re: How to turn panel results into a variable?

How to turn panel results into a variable?