Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About saleshai
saleshai
Explorer
Member since:
04-27-2023
05-24-2024
Community Statistics
| Posts | 6 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-27-2023 |
Activity Feed
- Posted Re: SingleId color change in dashboard on Splunk Search. 05-24-2024 05:07 AM
- Posted Re: SingleId color change in dashboard on Splunk Search. 05-22-2024 09:42 AM
- Tagged SingleId color change in dashboard on Splunk Search. 05-22-2024 03:52 AM
- Tagged SingleId color change in dashboard on Splunk Search. 05-22-2024 03:52 AM
- Tagged SingleId color change in dashboard on Splunk Search. 05-22-2024 03:52 AM
- Tagged SingleId color change in dashboard on Splunk Search. 05-22-2024 03:52 AM
- Posted SingleId color change in dashboard on Splunk Search. 05-22-2024 03:51 AM
- Posted Re: How to set workload management rules? on Getting Data In. 06-18-2023 11:40 PM
- Posted How to set workload management rules? on Getting Data In. 06-15-2023 07:54 AM
- Posted What are some ways to keep the DDAS usage in check? on #Random. 04-27-2023 11:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-24-2024
05:07 AM
Thanks for your suggestion, I tried using it. But instead adding a radio button & having a token assigned to the values, I simply replaced the over & under with 1,0 (because I'm dependent on the value based on comparison between 2 sizes than having a default value assigned to a radio button) but the color still doesn't change.
I also ran the query separately for a specific index & it returns 1 when currentsize>maxsize but somehow when including in the dashboard code, the color is still not being picked despite using rangevalues & rangeColors both. Is there anything I'm missing here?
<single id="CurrentUtilisation">
<search>
<query>
<![CDATA[
index=usage_index_summary
| fields Index as sourceIndex, totalRawSizeGB
| where Index="$single_index_name$"
| stats latest(totalRawSizeGB) as CurrentSize by Index
| join left=L right=R where L.Index=R.extracted_Index
[ search index=index_configured_limits_summary
| stats
latest(maxGlobalDataSizeGB) as MaxSizeGB
by extracted_Index
]
| rename L.CurrentSize as CurrentSizeGB, R.MaxSizeGB as MaxSizeGB, L.Index as Index
| eval unit_label = if(CurrentSizeGB < 1, "MB", "GB")
| eval CurrentSizeGB = if(CurrentSizeGB < 1, CurrentSizeGB*1024, CurrentSizeGB)
| eval CurrentSizeDisplay = round(CurrentSizeGB) . if(unit_label == "MB", "MB", "GB")
| eval CurrentSizeDisplay = if(CurrentSizeGB == 0, "None", CurrentSizeDisplay)
| eval value=if(CurrentSizeGB > MaxSizeGB, "1", "0")
| table CurrentSizeDisplay, value
]]>
</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0xdc4e41"]</option>
<option name="rangeValues">[0,1]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="underLabel">Current Utilisation</option>
<option name="useColors">1</option>
</single>
... View more
05-22-2024
09:42 AM
I tried that but my range values are "over" & "under" which rangevalues did not accept. Also tried replacing the string with numeric [1,0] values but no luck with this also Do you have any suggestion based on what might have worked for you incase of a similar usecase?
... View more
05-22-2024
03:51 AM
Hi, I tried to add a piece of code to change the color of values based on certain condition, but it is not reflecting the change in my dashboard. Can you please check & advise what is going wrong?
New code added -
<single id="CurrentUtilisation">
<search>
<query>
<![CDATA[
index=usage_index_summary
| fields Index as sourceIndex, totalRawSizeGB
| where Index="$single_index_name$"
| stats latest(totalRawSizeGB) as CurrentSize by Index
| join left=L right=R where L.Index=R.extracted_Index
[ search index=index_configured_limits_summary
| stats
latest(maxGlobalDataSizeGB) as MaxSizeGB
by extracted_Index
]
| rename L.CurrentSize as CurrentSizeGB, R.MaxSizeGB as MaxSizeGB, L.Index as Index
| eval unit_label = if(CurrentSizeGB < 1, "MB", "GB")
| eval CurrentSizeGB = if(CurrentSizeGB < 1, CurrentSizeGB*1024, CurrentSizeGB)
| eval CurrentSizeDisplay = round(CurrentSizeGB) . if(unit_label == "MB", "MB", "GB")
| eval CurrentSizeDisplay = if(CurrentSizeGB == 0, "None", CurrentSizeDisplay)
| eval range=if(CurrentSizeGB > MaxSizeGB, "over", "under")
| table CurrentSizeDisplay, range
]]>
</query>
</search>
<option name="colorBy">value</option>
<option name="drilldown">none</option>
<option name="rangeColors">["red", "white"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="underLabel">Current Utilisation</option>
<option name="useColors">1</option>
</single>
What I want - If Currentsize > Maxsize then the value should display in Red else White. The query on being run independently is showing correct results for the range & current size maxsize values but the color does not change in the dashboard. I have looked up this in the community & tried using the same logic mentioned in this successful solution but to no avail.
Reference used - https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.splunk.com%2Ft5%2FDashboards-Visualizations%2FHow-can-I-change-Splunk-Dashboard-single-value-field-color-of%2Ftd-p%2F596833&data=05%7C02%7Csaleha.shaikh%40here.com%7C8e67306234504904e1c008dc7a4ac122%7C6d4034cd72254f72b85391feaea64919%7C0%7C0%7C638519708691080704%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=iJit6osuY09q25VX8pWiUcuylKtrNczG4H%2BhCfSgEbo%3D&reserved=0
... View more
Labels
- Labels:
-
fields
06-18-2023
11:40 PM
Hi, So it did not work even with taking the = sign out. I figured, the workload rules execute as per sequence. The order of the rules is important. Rules are evaluated in order from top to bottom. When I changed the sequence of both rules, it worked correctly - Rule 1 - search_type=adhoc AND runtime>10m Rule 2 - search_type=adhoc AND runtime>1m (I removed the extra conditions & simplified the query)
... View more
06-15-2023
07:54 AM
Hi,
I'm trying to set 2 rules in my workload management pool -
search_type=adhoc AND runtime>1m -> Move search to alternate Pool: limited_perf
&
search_type=adhoc AND runtime>10m -> Abort search
The second condition is not getting picked & I still see many long running searches under the Expensive search dashboard. I thought it is a problem with the way these conditions are defined, so I tried changing it to -
search_type=adhoc AND (runtime>1m AND runtime<=10m) - But its throwing error
ERROR: Workload rule "move_longrunning_to_limited_pool" validation failed with error=invalid predicate format 'runtime<=10m'
Where am I going wrong?
... View more
Labels
- Labels:
-
monitor
04-27-2023
11:44 AM
In Splunk Cloud if we run out of storage with daily ingestion in DDAS, the storage automatically gets expanded and we are charged for the additional DDAS units at the end of each quarter we are above our licensed DDAS limit. What are some best practices to keep the DDAS limits in check & prevent from exceeding the subscribed limit?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-24-2024
11:46 AM
|
