About asabatini

asabatini · ‎09-07-2024

Hi @bowesmana , @ITWhisperer , Ok this method works fine, I'll explain what I did. first I created a multivalue field with "sex, and S_n_mm" fields. | eval value=mvappend(sex,'S_N mm') after this I created the condition directly on the XML code dashboard. <format type="color" field="value"> <colorPalette type="expression">case(mvindex(value, 1) >"79" AND mvindex(value, 0) == "male","#00FF00",mvindex(value, 1) >"74" AND mvindex(value, 0) == "female","#00FF00")</colorPalette> </format>

asabatini · ‎09-06-2024

Hi @bowesmana I tried our suggestion but doesn't works maybe I wrong something? <dashboard version="1.1" theme="light"> <label>ID patient</label> <row> <panel> <html depends="$hidden$"> <style> #coloured_cell table tbody td div.multivalue-subcell[data-mv-index="0"]{ display: none; } </style> </html> <table id="coloured_cell"> <search> <query>sourcetype=csv | eval value=mvappend(sex,'S_N mm') | table Age id sex "S_N mm" N_S_Ba value</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="id"></format> <format type="color" field="value"> <colorPalette type="expression">case(mvindex(value, 1) >"79" AND mvindex(value, 0) == "male","#00FF00")</colorPalette> </format> </table> </panel> </row> </dashboard>

asabatini · ‎09-06-2024

Hi folks, I have a quick question based on this kind of data. consider this table Age sex id ^N-S-Ba S-N mm 17 male 1 125 84 17 female 2 133 75 I have to create a dynamic range for the field "S-N mm" for the female is from 74,6 to 77 for the male is from 79,3 to 87,7 I need to create a table that when one of these values is within range it should turn green thanks for the support Ale

asabatini · ‎02-28-2024

Hi @scelikok I agree with you, I would show you my props and transforms conf file props.conf [custom_syslog] transforms-rebuild = group1 SHOULD_LINEMERGE = false Transforms [group1] REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group3>[^,]+).+username.:.(?<group4>[^,]+).+sourceIPs....(?<group5>\d+.\d+.\d+.\d+) FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5 Did I forget something in the conf files? Regards Alessandro

asabatini · ‎02-27-2024

Hi Folks, I have a quick question. currently I have a syslog event and I need to see in splunk the raw data the info in different order: Example original syslog (?<field1>REGEX),(?<field2>REGEX),(?<field3>REGEX), etc....... what I want to see indexed in splunk (?<field1>REGEX),(?<field3>REGEX),,(?<TIMESTAP>REGEX),(?<field2>REGEX). I tried with SED command in props.conf is really useful to clean the data but not to reorder the info. Thanks in advance Alex

Posts	5
Solutions	0
Karma Given	4
Karma Received	2
Member Since	‎04-27-2023

Online Status	Offline
Date Last Visited	‎09-09-2024 03:52 AM

SPL dynamic range

rebuild a syslog event

Re: SPL dynamic range

Re: SPL dynamic range

SPL dynamic range

Re: rebuild a syslog event

rebuild a syslog event