Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About noammeir
noammeir
Explorer
Member since:
10-19-2022
11-17-2022
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 10-19-2022 |
Activity Feed
- Karma Re: How to move all of the different searches to a single/couple of base searches and then post processing? for richgalloway. 11-17-2022 12:29 AM
- Posted Re: How to move all of the different searches to a single/couple of base searches and then post processing? on Splunk Search. 11-17-2022 12:28 AM
- Posted How to move all of the different searches to a single/couple of base searches and then post processing? on Splunk Search. 11-16-2022 06:53 AM
- Posted Re: interactive dashboard proper design on Dashboards & Visualizations. 10-23-2022 06:50 AM
- Posted How to create an interactive dashboard proper design? on Dashboards & Visualizations. 10-23-2022 03:33 AM
- Posted Re: How can I search event based on other event value and combine the results? on Splunk Search. 10-23-2022 03:16 AM
- Posted Re: How can I search event based on other event value and combine the results? on Splunk Search. 10-19-2022 11:59 AM
- Posted Re: searching event based on other event value and combining the results on Splunk Search. 10-19-2022 07:44 AM
- Posted How can I search event based on other event value and combine the results? on Splunk Search. 10-19-2022 07:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-17-2022
12:28 AM
thanks for the answer! I didnt manage to make it work with fields - if you have some working example it would be appreciated. I did manage to make something simple work with stats, however I do need the data not in the stats way since I do wish to make some more manipulations and visualizations on different fields of it. is there a good way to transfer the entire event data from base to post process? I dont mind going through stats/other and reverse it if that is possible and saves the multiple searches that currently run there
... View more
11-16-2022
06:53 AM
hi I am trying to get my dashboard better and move all of the different searches to a single/couple of base searches and then post processing. did what I saw in the forum and the documentation, didnt give any results... original code (which gives results): <form>
<label>Emulation run analysis</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="TimeRangePkr" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="steppingToken" searchWhenChanged="true">
<label>Stepping</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>stepping</fieldForLabel>
<fieldForValue>stepping</fieldForValue>
<search>
<query>index=validation_bigcore aa_data_source="core_emu_run_info" |stats count by stepping</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
</form> code I am trying with base search: <form>
<label>Emulation run analysis</label>
<search id="baseSearch">
<query>index=validation_bigcore aa_data_source="core_emu_run_info"</query>
<earliest>$TimeRangePkr.earliest$</earliest>
<latest>$TimeRangePkr.latest$</latest>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="TimeRangePkr" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="steppingToken" searchWhenChanged="true">
<label>Stepping</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>stepping</fieldForLabel>
<fieldForValue>stepping</fieldForValue>
<search base="baseSearch">
<query> |stats count by stepping</query>
</search>
</input>
</fieldset>
</form> tried playing with the earliest/latest to be in base-search, in the post processing, in both, none gave results so probably not that any ideas what am I doing wrong? thanks, Noam
... View more
10-23-2022
06:50 AM
thanks for the prompt reply 1. tried it, it works but then I cannot zoom in, just select - any way around it? 2. can give a specific example/reference on how to do it? 3. didnt get to it, lets start with #1/2 🙂 4. explanation - I'd imagine it as having some "legend" on the chart itself with certain statistics I choose to show like average/min/max/other instead of adding a new panel just for a single number. not a must, mainly for how it looks and how easy it is for me to build such things in the future. 5.explanation - looking for a way for a user to filter out anomalies so it it will be easier to understand the graph. for example - right click on a point in the chart and select to remove it. for example - if most of the points range 0-100, and there is one at 15000, you cant get anything from the graph without zooming (and I didnt find a way to only zoom on the y axis)
... View more
10-23-2022
03:33 AM
hi
I have made an interactive dashboard that allow users to filter our data according the main interesting parameters, however it seems to me that I could do better, here are my questions:
1) all the panels in the dashboard use the token from the time range picker. I would like some of the panels (the single values below for example) to re-calculate based on changing the zoom in the time chart above them. how can I implement it?
2) all the panels use the same base search and add on it. for example <base search> | table something, <base search>| get specific single value, etc. how can I save this common base search and use it properly in all the panels?
3) moreover - at the moment, for each panel a new search is being performed, quite a waste... is there a way to optimize it to run once and get the results for each panel from this search?
4) is there an option to add specific "interesting" single value or other data on top of a chart? adding a different panel for each value is annoying, wasting additional searches and in my opinion presents it in a lesser way (GUI-wise)
5) any good way to let users filter out specific anomaly events from the chart?
thanks,
noam
... View more
Labels
- Labels:
-
panel
-
single value
-
timechart
10-23-2022
03:16 AM
thanks for the suggestion! it works however I chose a different approach in this specific case - filtering the data I need before reaching the stats command: index=my_index aa_data_source="my_info" is_rerun=True | where fieldA!=fieldB ```filtering out cases``` | eval orig_some_field= if(is_rerun=="False", some_field, NULL) ```saving data to show only in original``` | eval rerun_some_field= if(is_rerun=="True", some_field, NULL) ```saving data to show only in re-run``` | eval orig_workarea=workarea_path | rex field=orig_workarea mode=sed "s@/rerun?$@@" | stats count(aa_data_source) as event_count list(*) as * by orig_workarea ```using stats to group the events together``` | where event_count==2 ```additional filtering after stats``` |table orig_some_field rerun_some_field orig_workarea
... View more
10-19-2022
11:59 AM
thanks for the prompt reply! almost there... removing some of the conditions (is_rerun=True in this simplified case) indeed grouped the relevant events together. so now I have some cases where there is a single event (no re-run exists) and some where there are two (re-run exists) 1) how do you suggest to filter out only the ones with two events? moreover - filter according to some conditions on the fields of one of the events (for example field_A_in_rerun != field_B_in_rerun) 2) once I filtered the relevant events, how can I access the specific event fields in each of them? use case example: I want to show a table of rerun_event_field_A, original_run_field_A, some_more_fields - in cases where field_A != field_B in rerun event thanks, Noam
... View more
10-19-2022
07:44 AM
forgot to mention - I might be able to use transaction or stats based on the orig_workarea value since it will be the same path with addition. however - at the point I evaluated orig_workarea, I can no longer pipe to transaction since I already eliminated some of the events in the process - the one I need included. moreover - even if I was able to use transaction - not sure how I extract the data from the fields of the two events I'd have in it once they are grouped (again, assume renaming might be required since both events have the same fields)
... View more
10-19-2022
07:39 AM
hi
our system logs test runs as single events. in some cases we would have a re-run of a test. both events are logically related but are separate for each run (the original run and the re-run).
I wish to extract data from both events and present it together, have tried several approaches but none worked so far.
step 1:
identifying the re-run event and getting a unique identifier for the original run using some textual parsing on the workarea path:
index=my_index aa_data_source="my_info" is_rerun=True
| eval orig_workarea=workarea_path
| rex field=orig_workarea mode=sed "s@/rerun?$@@"
step 2: now, I would like to find and match the original run event for each of the results.
tried map:
| map search="search index=my_index aa_data_source=my_info workarea_path=$orig_workarea$ " maxsearches=100000
this is probably wrong because it is both resource expensive and after I found the original event per result, I could only use the data of the original event (result of map) - didnt find how to combine it with the re-run event data I searched upon.
I also tried subsearch in various ways, the main problem is that the subsearch cannot use the "orig_workarea" I extract from the primary search because it runs first.
step 3 would be present the results from both events together. meaning - take field_from_eventA, field_from_eventB and place them in the same raw (note that renaming might be required for the fields since both events have the same fields)
kind of in a dead end here, could use ideas on how to implement this search. any ideas are welcome
thanks,
noam
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-17-2022
04:44 AM
|
