About Zero

Zero · ‎07-22-2024

Thanks for your reply. Sorry for the two identical token name, this was a typo and I have corrected it. If there are three or more years, I want to find the earliest year and the latest year, and use the date as tokens. (I just want to find the smallest time range that covers all those years.) And I want to use the tokens for time range of searches in dashboard. Like this: <search> <query>| index=abc</query> <earliest>$timeRangeEarliest$</earliest> <latest>$timeRangeLastet$</latest> </search>

Zero · ‎07-21-2024

I have a mutiselect input like this <input type="multiselect" token="year"> <label>Year</label> <choice value="*">All</choice> <delimiter> OR year=</delimiter> <fieldForLabel>year</fieldForLabel> <fieldForValue>year</fieldForValue> <search> <query>| inputlookup supported_years.csv | dedup year | table year</query> </search> <default>2023</default> <initialValue>2023</initialValue> </input> I want to set the time range token to the result of the input selection above. If 2023 was chosen, the token value for $timeRangeEarliest$ should be 2023/01/01 and the token value for $timeRangeLastet$ should be 2023/12/31. If 2021 and 2023 was chosen, the token value for $timeRangeEarliest$ should be 2021/01/01 and the token value for $timeRangeLastet$ should be 2023/12/31. Etc. I want to use this two tokens for time range in search. Don't know how to do it. Please help. Many thanks.

Zero · ‎04-23-2023

Thanks a lot for your advice! I'll try to find these materials and think more about it.

Zero · ‎04-23-2023

Thanks for your advice. I actually need to do some machine learning work with the data. It can work to get the timechart data with spl from the original data each time I need them. But the search job runs too slow. So I thought maybe I can store these timecharts in splunk. Now I guess the better way is to store the data somewhere else.

Zero · ‎04-23-2023

Yeah, that's right. Sorry for not describing clearly enough...

Zero · ‎04-23-2023

That's very help information. Thanks for your reply! There is still a problem in my use case. I do not have just 1 field that needs to be processed in this way. I have more than 100 field (field2, field3, ......). So, I need to set more than 100 summary indices for them. Don't know if there's any solution for this.

Zero · ‎04-23-2023

Thanks for your reply. What I try to do is: I use spl like this ``` index=examplea source=exampleb | timechart span=1w count by field1 ``` to get a timechart. now I need to get such timechart for more than 100 fields and store them in some way. I need to update these timecharts with latest week's data per week. So I try to find a way to do all these things with splunk. Don't know if I explain clearly enough.

Zero · ‎04-22-2023

I need to get timecharts of more than 100 fields from an index and save them back to splunk. And I need to update these timecharts regularly (say per week). I can find a good way to do it. btw Chatgpt suggest data model. But I failed to ask for a more specific answer from it. Please help. Many thanks.

Posts	8
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎04-22-2023

Online Status	Offline
Date Last Visited	‎07-22-2024 05:56 AM

set time range token with multiselect input

How to save timecharts of a lot of fields?

Re: set time range token with multiselect input

set time range token with multiselect input

Re: how to save timecharts of a lot of fields

Re: how to save timecharts of a lot of fields

Re: how to save timecharts of a lot of fields

Re: how to save timecharts of a lot of fields

Re: how to save timecharts of a lot of fields

How to save timecharts of a lot of fields?

Are you a member of the Splunk Community?