×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
gsmith93
Engager
Member since: ‎06-21-2023
‎09-25-2023
Community Statistics
Posts 6
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-21-2023
View All

Re: How to Create Multiple Tables in One Dashboard...

by in Splunk Search
‎09-25-2023 01:42 PM
‎09-25-2023 01:42 PM
ITWisperer: Thank you so much for the response.  I believe what you gave me will do the job; however, I have some questions. Here is the code I used and how it turned out. For expediency, I just used one 'SectionName' ... this field holds the name of the section in WebSphere that holds the attributes of a section of the Application Server.  index = websphere_cct (Object= "HJn3server2" Env="Prod") OR (Object = "HJn8server3" Env="UAT") SectionName="JVM Configuration"      | foreach Attributes.*           [| eval name=SectionName.".<<MATCHSEG1>>"            | eval {name}='<<FIELD>>'] | fields - Attributes.* name SectionName | stats values(*) as * by Object | transpose column_name='SectionName.Attribute' header_field=Object | eval match = if('HJn3server2' == 'HJn8server3', "y", "n") And here are the results: My questions are: 1) How does the command 'stats values(*) as * by Object' work? The 'Object' field is the name of the application server is this case.  How does that command group the values of the Attributes by Object?  2) Why are there so many extra fields in the table? Such as: Order, OrderType, Index, etc (per below) Why do these get included and is the only way to get rid of these fields is thru the 'fields' command? (ie fields - Order - Ordertype - Index ..) Thank you very much for the help !!! ... View more

Re: How to Create Multiple Tables in One Dashboard...

by in Splunk Search
‎09-21-2023 01:12 PM
‎09-21-2023 01:12 PM
ITWhisperer: Thank you for the reply. Combining the 'SectionName' with each attribute makes sense; however, I can't get your code to resolve correctly.  Here are my results with the following code: index = websphere_cct (Object= "HJn5server1" Env="UAT") OR (Object = "HJn2server1" Env="Prod")       | foreach Attributes.*              [| eval name=SectionName.".<<MATCHSEG1>>"                | eval {name}='<<FIELD>>'] | fields - Attributes.* name SectionName | fillnull value="" | transpose column_name=Attribute header_field=Object | eval match = if('HJn5server1' == 'HJn7server3', "y", "n") I can't seem to get the value of the "Attributes" field to printout.    ... View more

Re: How to Create Multiple Tables in One Dashboard...

by in Splunk Search
‎09-21-2023 11:35 AM
‎09-21-2023 11:35 AM
yuanliu:   Thank you for the reply. As per having a illustrating sample data, I went over the character limit; however, I could have just made another post. Anyway, here is what I am looking for. It is muptiple tables in one dashboard where the tables are ordered by SectionName followed by the Attributes for that section and a column stating the attributes match or do not match.    * *  I will look at the rest of your post now.  ... View more

How to Create Multiple Tables in One Dashboard?

by in Splunk Search
‎09-20-2023 12:49 PM
‎09-20-2023 12:49 PM
I am trying to create a Dashboard that hold multiple table of WebSphere App Server configuration data.  The data I have looks like this: {"ObjectType ":"AppServer","Object":"HJn6server1","Order":"147","Env":"UAT","SectionName":"Transport chain: WCInboundDefaultSecure:Channel HTTP", "Attributes":{"discriminationWeight": "10","enableLogging": "FALSE","keepAlive": "TRUE","maxFieldSize": "32768","maxHeaders": "500","maxRequestMessageBodySize": "-1","maximumPersistentRequests": "100","name": "HTTP_4","persistentTimeout": "30","readTimeout": "60","useChannelAccessLoggingSettings": "FALSE","useChannelErrorLoggingSettings": "FALSE","useChannelFRCALoggingSettings": "FALSE","writeTimeout": "60"}} Where every event is a configuration section within an appserver where: ObjectType - AppServer Object - Name of Appserver (ex. "HJn6server1") Env - Environment. (ex. Test, UAT, PROD) SectionName - name within the appserver configuration that holds attributes. Attributes - configuration attributes for a SectionName I have been able to create one table per SectionName, but can't extend that to multiple sections.  I used the following code to make one table:  index = websphere_cct (Object= "HJn5server1" Env="Prod") OR (Object = "HJn7server3" Env="UAT") SectionName="Process Definition" Order [ search index=websphere_cct SectionName | dedup Order | table Order ] | fields - _* | fields Object Attributes.* SectionName | eval Object = ltrim(Object, " ") | rename Attributes.* AS * | table SectionName Object * | fillnull value="" | transpose column_name=Attribute header_field=Object | eval match = if('HJn5server1' == 'HJn7server3', "y", "n") Output:  Attribute HJn7server3 HJn5server1 match SectionName Process Definition Process Definition y IBM_HEAPDUMP_OUTOFMEMORY     y executableArguments [] [] y executableTarget com.ibm.ws.runtime.WsServer com.ibm.ws.runtime.WsServer y executableTargetKind JAVA_CLASS JAVA_CLASS y startCommandArgs [] [] y stopCommandArgs [] [] y terminateCommandArgs [] [] y workingDirectory ${USER_INSTALL_ROOT} ${USER_INSTALL_ROOT} y   What I would like to do is to create as many tables as there are SectionNames for a given comparison between two Objects. But I cannot figure out how to modify the code for allowing to have several tables in one dashboard for multiple SectionNames with their associated Attributes for two appservers in comparison.  Please help.    ... View more

Unable to access event data for comparison reasons

by in Splunk Search
‎07-14-2023 11:36 AM
‎07-14-2023 11:36 AM
I have ingested configuration information from WebSphere Application Server. Specifically, appserver configuration data. The events look like the following: {  Attributes: {  : -DFileNet.Content.DownloadServerAffinityEnabled: TRUE -DFileNet.Content.GetBlockSizeKB: 4096 -DFileNet.Content.PutBlockSizeKB: 4096 -DFileNet.Content.UploadServerAffinityEnabled: TRUE -DFileNet.WSI.AutoDetectLTPAToken: is not set -Dappdynamics.agent.applicationName: is not set -Dappdynamics.agent.nodeName: is not set -Dcom.filenet.authentication.token.userid: is not set -Dcom.filenet.authentication.wsi.AutoDetectAuthToken: is not set -Dcom.filenet.repositoryconfig.allowWSIOnWAS: is not set -Dcom.ibm.mq.cfg.jmqi.UnmappableCharacterAction: is not set -Dcom.ibm.mq.cfg.jmqi.UnmappableCharacterReplacement: is not set -Dfilenet.pchconfig: is not set -Djava.awt.headless: TRUE -Djava.security.auth.login.config: ${USER_DIR}/DocumentRepository/jaas.conf.WebSphere -Djaxws.payload.highFidelity: is not set -Xdump: system:none -Xgcpolicy: is not set -Xmn2048M: is not set -Xmn512M: is not set -Xquickstart: is set -Xverbosegclog: is not set -javaagent: is not set -server: is set genericJvmArguments: -Xgcpolicy:gencon -Djaxws.payload.highFidelity=true -Dfilenet.pchconfig=${USER_DIR}\HJIPDash\PchConfig.properties -Xmn512M -Dcom.filenet.authentication.token.userid=sso:ltpa -DFileNet.WSI.AutoDetectLTPAToken=true -Dcom.filenet.authentication.wsi.AutoDetectAuthToken=true -Dcom.filenet.repositoryconfig.allowWSIOnWAS=true -DFileNet.Content.PutBlockSizeKB=10240 -DFileNet.Content.GetBlockSizeKB=10240 } Env: UAT Object: HJn8server3 (HJn8, UAT-230612150440) SectionName: JVM Arguments } The eveants field are made up of the following: Objects: AppServer Names SectionName: Are the various sections of an application server. For example: "JVM Configuratioin" Attributes: Are all the configurations for a give SectionName I have been unable to traverse the "Attributes" field of these events. I have tried making the Attributes field into an JSON Array and/or Object but have had no luck.  My search code has gotten so convoluted, I don't know where to start. The code I use to create a table listing the attributes of two appserver is:   index=websphere_cct SectionName      [ search index=websphere_cct         | dedup SectionName         | streamstats count as "RowCount"         | eval newfield="panel".RowCount         | head 1         | tail         | head 1         | table SectionName] Object=" HJn6server1 (HJn6, PROD-230612151857)" OR Object=" HJn4server1 (HJn4, PROD-230612151857)" | table Object, SectionName, Attributes.* | transpose 0 header_field=Object | fields - Attributes.* This produces the table:   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-25-2023 06:44 PM