About ktanwar

ktanwar · ‎10-19-2022

Hi all, So lets suppose I have the following table: Job_ID Parameter_A Parameter_B 1 "Car" "Red" 2 "Bus" "Blue" I want to get value "Red" and use it in an eval function. How to do it? Thanks! @bowesmana calling you for help like always!!!

ktanwar · ‎10-19-2022

Thanks @bowesmana for always coming to help a noob like me!

ktanwar · ‎10-17-2022

Thanks a lot @bowesmana for the quick response! Looks like @chrisyounger has done some amazing development for use. Since I have never added any add on top of standard Splunk xml, can you give some pointers on how to use these apps with Splunk dashboard?

ktanwar · ‎10-16-2022

This worked. Thanks @bowesmana!

ktanwar · ‎10-15-2022

I am using a normal pie chart to visualise data on Splunk Dashboard. I would really love if I can add a donut pie chart instead of normal pie chart. Is it possible to add it on Splunk?

ktanwar · ‎10-13-2022

Hi @bowesmana, sadly this isn't working, ``` table ver verdict.$campaigns_included$ ``` this piece of query is creating 2 columns (ver and verdict.$campaigns_included$) but ver column is empty while verdict.$campaigns_included$ column has the value Pass. Not sure what's missing here.

ktanwar · ‎10-13-2022

Hi all, I have a single value visualisation added in a dashboard. Its background colour depends on the value shown. (Green for 'Pass' and red for 'Fail'). But somehow it's always giving red background eventhough the value is 'Pass'. Here is the code I use: ``` <panel depends="$hide_css$"> <html> <style> #verdict rect { fill: $verdict_background$ !important; } #verdict text { fill: $verdict_foreground$ !important; } </style> </html> </panel> <panel> <single id="verdict"> <search> <query>index=temp_index | search splunk_id=$splunk_id$ | eval ver = verdict.$campaigns_included$ | table verdict.$campaigns_included$ </query> <done> <eval token="verdict_background">if($result.ver$=="Pass", "green", "red")</eval> <set token="verdict_foreground">black</set> </done> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="height">60</option> <option name="rangeColors">["0x53a051","0xdc4e41"]</option> <option name="rangeValues">[0]</option> <option name="useColors">1</option> </single> </panel> ``` $campaigns_included$ is the value that's chosen on a dropdown. Pls help, any help would be appreciated. @bowesmana requesting for expertise here!

ktanwar · ‎10-11-2022

Hi all, sorry for asking a very basic question, quite new to Splunk world. I have a piechart created by following code: ``` <panel> <chart> <search> <query> index=test_index | search splunk_id="$splunk_id$" | table campaign_data.All.total_passed campaign_data.All.total_failed campaign_data.All.total_not_run | rename campaign_data.All.total_passed as "Passed" campaign_data.All.total_failed as "Failed" campaign_data.All.total_not_run as "Not Run" | eval name="No of Tests" | transpose 0 header_field=name </query> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"Failed": 0xFF0000, "Not Run": 0x808080, "Passed":0x009900, "NULL":0xC4C4C0}</option> <option name="refresh.display">progressbar</option> </chart> </panel> ``` it gives the following output: When 1 hover over a part it shows 3 rows of data. What I want is in the 3rd row, the percentage should be cutoff by 2 decimal pts. Also can we change the label "No of tests%" to "Percentage" but keep 2nd row data value as it is? Is it possible? Thanks!

ktanwar · ‎10-11-2022

Just 1 pie chart related question @bowesmana , asking it here just for ease of use. I have a piechart created by following code: ``` <panel> <chart> <search> <query> index=test_index | search splunk_id="$splunk_id$" | table campaign_data.All.total_passed campaign_data.All.total_failed campaign_data.All.total_not_run | rename campaign_data.All.total_passed as "Passed" campaign_data.All.total_failed as "Failed" campaign_data.All.total_not_run as "Not Run" | eval name="No of Tests" | transpose 0 header_field=name </query> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"Failed": 0xFF0000, "Not Run": 0x808080, "Passed":0x009900, "NULL":0xC4C4C0}</option> <option name="refresh.display">progressbar</option> </chart> </panel> ``` it gives the following output: When 1 hover over a part it shows 3 rows of data. What I want is in the 3rd row, the percentage should be cutoff by 2 decimal pts. Also can we change the label "No of tests%" to "Percentage" but keep 2nd row data value as it is? Is it possible? Thanks!

ktanwar · ‎10-11-2022

It worked @bowesmana. Thanks a lot!

ktanwar · ‎10-10-2022

Hi all, I have just started using Splunk dashboards to visualise my data, sorry for asking such a simple question. I have added single value panel on my dashboard which shows the verdict of the test performed. I am using the following the source code: ``` <row> <panel> <single> <title>Verdict</title> <search> <query>index=test_index | search splunk_id="$splunk_id$" | table verdict </query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="height">60</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="useColors">1</option> </single> </panel> </row> ``` It creates a panel with black background colour with text in white colour at the centre. So verdict will give only 2 values ('Pass' or 'Fail'). What I want is the panel should have green background colour is verdict is 'Pass' and red colour background if verdict is 'Fail'. Along with this I would like to have 'Pass' and 'Fail' written in black colour rather than white colour. I am not the admin of the Splunk server so I cant add and javascript file or css file to the source code. Any help would be hugely appreciated. Thanks! @bowesmana can you help me out here if you can? Thanks!

ktanwar · ‎10-03-2022

Thanks @bowesmana !

ktanwar · ‎10-02-2022

Thanks a lot @bowesmana. Tried it, works like a charm! 1 follow up question on this, how can I change the colour of the pie chart sections and the name of the fields shown on the pie chart section (instead of total_passed, I would like to see Total Passed). Thanks a lot mate for helping me out here!

ktanwar · ‎10-02-2022

Hi guys, I am quite new to the Splunk world, pls forgive me for asking a very basic question. So I have a table as following: job_id total_passed total_failed total_not_run 9 14 20 6 10 25 31 9 and so on. I want to create a pie chart for different job_ids (lets say 9), with total_passed, total_failed, total_not_run values (14, 20, 6) and total_passed, total_failed, total_not_run as the headers of the chart in Splunk dashboard. how to do it? any help will be deeply appreciated.

Posts	14
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-02-2022

Online Status	Offline
Date Last Visited	‎10-20-2022 09:21 AM

How to fetch value of column in Splunk table?

How to add a donut pie chart in Splunk Dashboard?

If condition in eval token not working?

How do I edit info shown by the pie chart on Splun...

How to add background colour to single value visua...

How to create pie charts with column values?

How to fetch value of column in Splunk table?

Re: How to add a donut pie chart in Splunk Dashboa...

Re: How to add a donut pie chart in Splunk Dashboa...

Re: If condition in eval token not working?