×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
asabatini
Splunk Employee
Member since: ‎04-27-2023
Monday
Community Statistics
Posts 5
Solutions 0
Karma Given 4
Karma Received 2
Member Since ‎04-27-2023
Activity Feed
View All

Re: SPL dynamic range

by Splunk Employee in Dashboards & Visualizations
‎09-07-2024 04:23 AM
1 Karma
‎09-07-2024 04:23 AM
1 Karma
Hi @bowesmana , @ITWhisperer ,   Ok this method works fine, I'll explain what I did. first I created a multivalue field with "sex, and S_n_mm"  fields. | eval value=mvappend(sex,'S_N mm')   after this I created the condition directly on the XML code dashboard.   <format type="color" field="value"> <colorPalette type="expression">case(mvindex(value, 1) &gt;"79" AND mvindex(value, 0) == "male","#00FF00",mvindex(value, 1) &gt;"74" AND mvindex(value, 0) == "female","#00FF00")</colorPalette> </format> ... View more

Re: SPL dynamic range

by Splunk Employee in Dashboards & Visualizations
‎09-06-2024 02:03 PM
1 Karma
‎09-06-2024 02:03 PM
1 Karma
Hi @bowesmana  I tried our suggestion  but doesn't works maybe I wrong something?   <dashboard version="1.1" theme="light"> <label>ID patient</label> <row> <panel> <html depends="$hidden$"> <style> #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="0"]{ display: none; } </style> </html> <table id="coloured_cell"> <search> <query>sourcetype=csv | eval value=mvappend(sex,'S_N mm') | table Age id sex "S_N mm" N_S_Ba value</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="id"></format> <format type="color" field="value"> <colorPalette type="expression">case(mvindex(value, 1) &gt;"79" AND mvindex(value, 0) == "male","#00FF00")</colorPalette> </format> </table> </panel> </row> </dashboard> ... View more

SPL dynamic range

by Splunk Employee in Dashboards & Visualizations
‎09-06-2024 09:13 AM
‎09-06-2024 09:13 AM
Hi folks,   I have a quick question based on this kind of data. consider this table    Age sex id ^N-S-Ba S-N mm 17 male 1 125 84 17 female 2 133 75   I have to create a dynamic range for the field "S-N mm" for the female is from 74,6  to 77 for the male is from 79,3 to 87,7 I need to create a table that when one of these values ​​is within range it should turn green thanks for the support Ale ... View more
Labels

Re: rebuild a syslog event

by Splunk Employee in Getting Data In
‎02-28-2024 03:05 AM
‎02-28-2024 03:05 AM
Hi @scelikok  I agree with you, I would show you my props and transforms conf file props.conf [custom_syslog] transforms-rebuild = group1 SHOULD_LINEMERGE = false   Transforms [group1] REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group3>[^,]+).+username.:.(?<group4>[^,]+).+sourceIPs....(?<group5>\d+.\d+.\d+.\d+) FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5   Did I forget something in the conf files? Regards Alessandro ... View more

rebuild a syslog event

by Splunk Employee in Getting Data In
‎02-27-2024 09:32 AM
‎02-27-2024 09:32 AM
Hi Folks,   I have a quick question. currently I have a syslog event and I need to see in splunk the raw data the info in different order: Example original syslog (?<field1>REGEX),(?<field2>REGEX),(?<field3>REGEX),  etc....... what I want to see indexed in splunk (?<field1>REGEX),(?<field3>REGEX),,(?<TIMESTAP>REGEX),(?<field2>REGEX). I tried with SED command in props.conf is really useful to clean the data but not to reorder the info.   Thanks in advance Alex   ... View more
Contact Me
Online Status
Offline
Date Last Visited
Monday
Karma from
View All
Karma given to