Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About GaryZ
GaryZ
Path Finder
Member since:
03-31-2023
05-02-2024
Community Statistics
| Posts | 44 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 03-31-2023 |
Activity Feed
- Posted how to read nested dictionary where the keys are dotted-strings on Dashboards & Visualizations. 05-02-2024 12:58 PM
- Posted Re: Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. 04-26-2024 09:45 AM
- Posted Re: Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. 04-25-2024 11:41 AM
- Posted Re: Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. 04-24-2024 11:22 AM
- Posted Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. 04-23-2024 10:31 AM
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. 04-22-2024 05:27 PM
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. 04-22-2024 04:55 PM
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. 04-22-2024 04:28 PM
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. 04-22-2024 04:24 PM
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. 04-22-2024 04:19 PM
- Posted Why does my search return shortened number of results on Dashboards & Visualizations. 04-22-2024 04:02 PM
- Posted How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Posted Re: Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 04:56 PM
- Posted Re: Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 04:54 PM
- Karma Re: Inside drilldown tags - how to apply transformative operations on set tags - <set> for ITWhisperer. 12-07-2023 04:54 PM
- Posted Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 11:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-02-2024
12:58 PM
how to read nested dictionary where the keys are dotted-strings I have the following posted dictionary process_dict = { task.com.company.job1 { duration = value1 } task.com.company.job2 { duration = value2 } task3.com.company.job1 = { duration = value3 } } I did the following | spath path=result.process_dict output=process_data
| eval d_json = json(process_data), d_keys = json_keys(d_json), d_mv = json_array_to_mv(d_keys)
...
| eval duration_type = ".duration"
...
| eval duration = json_extract(process_data, d_mv.'duration_type') I am not able to capture the value from "duration" key. HOWEVER, if the key was just a single word (without '.'), this would work. ie. task_com instead of task.com.company.job2 TIA
... View more
04-26-2024
09:45 AM
@bowesmana Thank you for confirming. That was how I understood this as well. I was curious if there were options I wasn't aware of. Thank you once again.
... View more
04-25-2024
11:41 AM
@bowesmana Is there a way to switch from chart to table? The options given earlier seems to only apply to variations of charts. Curious if there's options to go from chart to table.
... View more
04-24-2024
11:22 AM
Hello @danspav , Is there a listing of all the different charting options? I've tried to use what are some of the possible names for the different charting types. Some worked and some didn't. I'm sure there's some that I've missed as well. Is there an option where I can also switch from a chart to a table? TIA The following work <choice value="line">Line Chart</choice>
<choice value="column">Bar Chart</choice>
<choice value="area">Area</choice>
<choice value="bar">Bar</choice>
<choice value="pie">Pie</choice>
<choice value="scatter">scatter</choice>
<choice value="bubble">bubble</choice> The following DIDN'T work <choice value="box-plot">boxplot</choice>.
<choice value="histogram">histogram</choice>
<choice value="horizon">horizon</choice>
<choice value="scatterline">scatterline</choice>
... View more
04-23-2024
10:31 AM
Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? At the moment, I've created multiple charts and utilizing show and hide (depending on the options selected), to serve this purpose. I was wondering if there's an easier/cleaner/simpler way of achieving this.
... View more
04-22-2024
05:27 PM
Thank you @bowesmana, I was looking for | where (Check_Feature_Availability="false") AND ("a" IN ("a")) Thank you.
... View more
04-22-2024
04:55 PM
I'm looking for a particular string in the list of strings. The "a" in the first part is not from a field, it's just a string that I'm trying to compare against. I'm trying to implement the following logic in python "word1" in ['word1', 'word2', ..., 'word_x', ]
... View more
04-22-2024
04:28 PM
|search (Check_Feature_Availability=false) AND NOT ("Choice1" IN ("Choice1", "Choice2", "Choice3")) OR
(Check_Feature_Availability=true) AND ("Choice1" IN ("Choice1", "Choice2", "Choice3")) The list is really all the options from a multi-valued dropdown menu. The values are all different.
... View more
04-22-2024
04:24 PM
I am trying to dynamically alter my searched data, by utilizing a value from my data source (Check_Feature_Availability - boolean data) with a selected value from a multi-dropdown in the dashboard (list of strings).
... View more
04-22-2024
04:19 PM
What I'm trying to achieve from this, is try to implement an "exclusive or" logic. |search (Check_Feature_Availability=false) AND NOT ("a" IN ("a", "b", "c")) OR
(Check_Feature_Availability=true) AND ("a" IN ("a", "b", "c")) TIA
... View more
04-22-2024
04:02 PM
I apologize if the following question might be a bit basic. But I'm confused with the results. When I append the following code into the "search" line, it returns a shortened list of results. (from 47 to 3) AND ("a" in ("a")) original code. index=main_service ABC_DATASET
Arguments.email="my_email@company_X.com"
| rename device_model as hardware,
device_build as builds,
device_train as trains,
ABC_DATASET.Check_For_Feature_Availability as Check_Feature_Availability
| search (Check_Feature_Availability=false) AND ("a" in ("a"))
| table builds, trains, Check_Feature_Availability I was expecting to see the same number of results. Am I wrong about my expectations, or am I missing something here? TIA index=main_service ABC_DATASET Arguments.email="my_email@company_X.com" | rename device_model as hardware, device_build as builds, device_train as trains, ABC_DATASET.Check_For_Feature_Availability as Check_Feature_Availability | search (Check_Feature_Availability=false) AND ("a" in ("a")) | table builds, trains, Check_Feature_Availability
... View more
Labels
- Labels:
-
Classic dashboard
-
single value
-
table
-
token
12-11-2023
02:17 PM
Is there a way of creating a search where we can have both LIKE and NOT LIKE, based on user selected option? ie. if $user_option_tk$ == True: | where NOT (error_string LIKE "%$filter_tk$%") else: | where error_string LIKE "%$filter_tk$%"
... View more
12-07-2023
04:56 PM
@bowesmana You are correct. I did have to change my index to point at 0 instead of 1
... View more
12-07-2023
11:01 AM
Can you apply transformative operations inside set tags from drilldown tags? ex: <drilldown> <set token="form.builds_tk">$click.value$</set> </drilldown> Would like to take the value captured from click value, split it (or regex), then use the first value. ex: <drilldown> <set token="form.builds_tk">mvindex(split("$click.value$", "-"), 1)</set> </drilldown>
... View more
Labels
- Labels:
-
app
-
modular input
-
other
-
simple XML
-
visualization
10-30-2023
02:03 PM
Thanks!!! @ITWhisperer
... View more
10-30-2023
12:23 PM
I am looking to create an acronym from a dynamic string, by capturing the first letter of each broken substring How do I write the script, so I can capture whatever number of substrings gets generated from the original string? ie. "Hello_World_Look_At_Me" => "HWLAM" "Hello_World" => "HW" I'm thinking of doing the following, but this seems to be pretty lengthy. Would like to know if there's a more efficient way of getting this done. | eval txt1 = "Hello_World_Look_At_Me" | eval tmp = split(txt1, "_") | eval new_word = substr(mv_index(tmp,1), 1) + ...
... View more
10-06-2023
03:18 PM
@bowesmana Thank you. Your example helped me grasp this better.
... View more
10-05-2023
10:16 AM
@bowesmana I've used this code to check on the values <html>
<h3>Token values</h3>
<table border="0" cellpadding="12" cellspacing="0">
<tr>
<td>
<p>
<b>Time range (epoch time)</b>
</p>
<p>
<b>$$timeSelect1.earliest$$</b>: $timeSelect1.earliest$<br/>
<b>$$timeSelect1.latest$$</b>: $timeSelect1.latest$<br/>
<b>$$timeSelect1.earliest_ts$$</b>: $timeSelect1.earliest_ts$<br/>
<b>$$timeSelect1.latest_ts$$</b>: $timeSelect1.latest_ts$<br/>
<b>$$earliest$$</b>: $earliest$<br/>
<b>$$latest$$</b>: $latest$<br/>
<b>$$table_minutes_away$$</b>: $table_minutes_away$<br/>
<b>$$drilldownsettingtimerange$$</b>: $drilldownsettingtimerange$<br/>
</p>
</td>
<td>
<p>
<b>Filter Values</b>
</p>
<p>
<b>$$displayUnits$$</b>: $displayUnits$<br/>
<b>$$filterBy$$</b>: $filterBy$<br/>
<b>$$removeParam$$</b>: $removeParam$<br/>
<b>$$rankBy$$</b>: $rankBy$<br/>
<b>$$filterNWCompletionCode$$</b>: $filterNWCompletionCode$<br/>
<b>$$filterNWPredictionCode$$</b>: $filterNWPredictionCode$<br/>
<b>$$useLoad$$</b>: $useLoad$<br/>
<b>$$showLive$$</b>: $showLive$<br/>
</p>
</td>
<td>
<p>
<b>Click Values</b>
</p>
<p>
<b>$$job.runDuration$$</b>: $job.runDuration$<br/>
<b>$$whereclick$$</b>: $whereclick$<br/>
<b>$$clickname$$</b>: $click.name$<br/>
<b>$$clickvalue$$</b>: $click.value$<br/>
<b>$$clickname2$$</b>: $click.name2$<br/>
<b>$$clickvalue2$$</b>: $click.value2$<br/>
<b>$$clickearly$$</b>: $clickearly$<br/>
<b>$$clicklate$$</b>: $clicklate$<br/>
<b>$$row.duration$$</b>: $row.duration$<br/>
<b>$$rownode$$</b>: $rownode$</p>
</td>
<td>
<p>
<b>Search Values</b>
</p>
<p>
<b>$$radar|s$$</b>: $radar|s$<br/>
<b>$$form.pre_source$$</b>: $form.pre_source$<br/>
<b>$$form.source|s$$</b>: $form.source|s$<br/>
<b>$$source$$</b>: $source$<br/>
<b>$$form.terms|s$$</b>: $form.terms|s$<br/>
<b>$$terms$$</b>: $terms$<br/>
<b>$$subsystems|s$$</b>: $subsystems|s$<br/>
<b>$$categories|s$$</b>: $categories|s$<br/>
<b>$$hidden$$</b>: $hidden$<br/>
<b>$$mlModelsAvailable$$</b>: $mlModelsAvailable$</p>
</td>
<td>
<p>
<b>Search Values</b>
</p>
<p>
<b>$$search_results$$</b>: $search_results$<br/>
</p>
</td>
</tr>
</table>
</html> This is what I see when I clicked on any parts of the stacked charts (no difference in values)
... View more
10-04-2023
02:12 PM
@bowesmana I'm using the stats statement to help with debugging the actions I'm doing on the UI. I've tried adding a html panel to help better understand the various actions from the drill down. However I'm not seeing what I'm expecting to see. I currently have a stacked column chart. I would like to hover or click on any of the data in the stacked chart, to get the x,y, z data. (i.e. x = build, y = duration time, and z= name of task/column-segment) Do you happen to know how I can capture this information, when I click on a point in the stacked column?
... View more
09-26-2023
01:37 PM
@bowesmana , I've created the tokens via Drilldown Editor. However when I try using the tokens in a panel, ie. | stats values($value2$), values($trellis_split$), values($trellis_value$), values($row_axis_name$), values($row_fieldname$), values($d_trellis_split$), values($d_trellis_value$), values($d_trellis_name$), values($d_value1$), I'm only seeing name1 & trellis_name. Everything else is blanked.
... View more
09-25-2023
03:08 PM
Is there a way of capturing the x, y and z data from a stacked chart? At the moment, my x and y are as follows x = build info y = duration z = process name. (various names stacked in the same column)
... View more
Labels
- Labels:
-
chart
-
field extraction
-
lookup
-
other
-
stats
09-07-2023
04:52 PM
@yuanliu I'm fairly new to Splunk this year. Can you explain what you mean? - "You can still use the fields in statistical functions" I've tried | tstats count where index=abc Arguments.email=“myemail@abc.com" by device_build, Arguments.test_url, UserKey_ABC.job1 | rename UserKey_ABC.Day as day, UserKey_ABC.job1 as job1 But that didn't work for me either. Thanks.
... View more
09-07-2023
02:58 PM
I'm having trouble capturing the custom key - "UserKey_ABC" in the following script. With the following code, I'm not able to see any results. However, if I remove "UserKey_ABC", I am able to get the results. I'm certain I do have this key in my events. How do I approach this issue? | tstats count where index=abc Arguments.email=“myemail@abc.com" by device_build, Arguments.test_url, UserKey_ABC | rename UserKey_ABC.Day as day, UserKey_ABC.job1 as job1, UserKey_ABC.Version as version, Arguments.test_url as test_url, device_build as build | table build, lib, day, job1, version, test_url
... View more
Labels
- Labels:
-
field extraction
-
fields
-
metadata
-
subsearch
-
tstats
07-06-2023
03:04 PM
I am looking to dynamically update the Splunk Dashboard panel title, depending on options I've chosen from a dropdown menu in Splunk Dashboard. I've tried the following <row>
<panel>
<title>Panel1: (Hardware: $hardware1$ - $unit_used$</title>
...
<search base="main_search">
<query>
...
| eval _unit_used = "ms"
</query>
<done>
<set token="unit_used">$result._unit_used$</set>
</done>
</search> However when the script runs, I am seeing "Hardware: abc - $result.unit_used$". instead of seeing "Hardware: abc - ms" Is there a way of achieving this? Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-02-2024
04:19 PM
|
