About mythili

mythili · ‎09-11-2024

Hi all, I am trying to show the connected duration, which is calculated using transaction command in a timechart. When I try below query, the entire duration shows in the earliest timestamp(start time) as a single column. I would like to show the connected duration in a column chart, with area between start and end time colored. For example, if device was connected from 20th August to 23rd August, I want the column to extend across these days. Currently, the entire duration is shown on the 20th date alone. Kindly let me know your suggestions to implement this. Query: | transaction dvc_id startswith="CONNECTED" endswith="DISCONNECTED" | timechart sum(duration) by connection_protocol

mythili · ‎07-01-2024

Hi @ITWhisperer , Thank you for the suggestions. This seems to work.

mythili · ‎06-19-2024

Hi @ITWhisperer , Please find below the cut down version of the code: <init> <set token="showExpandLink5">true</set> </init> <row depends="$alwaysHideCSSStyleOverride$"> <panel> <html> <style> div[id^="linkCollapse"], div[id^="linkExpand"]{ width: 32px !important; float: right; } div[id^="linkCollapse"] button, div[id^="linkExpand"] button{ flex-grow: 0; border-radius: 50%; border-width: thick; border-color: lightgrey; border-style: inset; width: 32px; padding: 0px; } div[id^="linkCollapse"] label, div[id^="linkExpand"] label{ display:none; } div[id^="panel"].fieldset{ padding: 0px; } </style> </html> </panel> </row> <row> <panel> <title>Chart title</title> <input id="linkCollapse5" type="link" token="tokLinkCollapse5" searchWhenChanged="true" depends="$showCollapseLink5$"> <label></label> <choice value="collapse">-</choice> <change> <condition value="collapse"> <unset token="showCollapseLink5"></unset> <set token="showExpandLink5">true</set> <unset token="form.tokLinkCollapse5"></unset> </condition> </change> </input> <input id="linkExpand5" type="link" token="tokLinkExpand5" searchWhenChanged="true" depends="$showExpandLink5$"> <label></label> <choice value="expand">+</choice> <change> <condition value="expand"> <set token="showCollapseLink5">true</set> <unset token="showExpandLink5"></unset> <unset token="form.tokLinkExpand5"></unset> </condition> </change> </input> <table rejects="$showExpandLink5$"> <search> <query> My query </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> It occurs in both larger and small dashboards but not often. It occurs mostly for fresh browser load. It occurs with different browsers, I tried with Chrome and Edge. Do you have any suggestions on this?

mythili · ‎06-18-2024

Hi Team, We are currently using Classic XML and have made the panels Collapsible/Expandable using HTML/CSS with suggestion from below thread: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-feature-expand-or-collapse-panel-in-dashboard-using/m-p/506986 However, sometimes during first dashboard load, both the "+" and "-" sign are visible. This happens occasionally, so I am not able to find the cause for this. Do you have any suggestions or ideas to fix this? Thank you!

mythili · ‎05-24-2024

Hi @gcusello, Thanks for the suggestion. This work-around works for me. But any idea regarding this behavior? Is this a known issue from Splunk?

mythili · ‎05-23-2024

Hi @gcusello, I need the timestamp of the 2nd event in the transaction, i.e, the stop time. When it showed empty value, I tested getting both the values and noticed this behavior.

mythili · ‎05-23-2024

Hi All, I am using transaction command to group events and get stop time of a device. | transaction sys_id startswith="START" endswith="STOP" | eval stop_time=strftime(mvindex(sys_time,1), "%Y-%m-%d %H:%M:%S.%2N") | table sys_id stop_time However, when a field has same value for startswith and endswith, (for example, sys_time is same for both) then, mvindex(sys_time,1) is empty whereas mvindex(sys_time,0) gives the value. If the values are different, then it works fine. Does anyone have any idea on this behavior and on how to work around this to get the value regardless?

mythili · ‎03-19-2024

In our dashboard, a user reported that she got "Search was cancelled" message when she used it. I came to know that multiple searches were run concurrently. Hence, it could have been cancelled. But when I tried to reproduce this issue, the searches kept getting queued and ran but was never delayed. What are the scenario when a search is queued vs when it is cancelled?

mythili · ‎11-30-2023

Hi @bowesmana , This works when I use table in the dashboard. However for custom search from drilldown, the structure is a below: <drilldown> <link target="_blank">search?xxxxxxxxxxxxx(custom search)|table field_1 field_2 ;earliest=$time_selection_earliest$&latest=$time_selection_latest$</link> </drilldown> I cannot add the table id as "id" is an invalid attribute for both drilldown and link tags.

mythili · ‎11-30-2023

Hi All, How do you customize the table width of results of custom search from a drilldown? I am not able to find any documentation on this.

mythili · ‎07-03-2023

Hi @gcusello , Please refer below for the license details. The creation time seems to be valid and the expiration time is mentioned as 0 which can be the problem I think. <payload> <type>fixed-sourcetype</type> <group_id>Enterprise</group_id> <window_period>30</window_period> <creation_time>1688083200</creation_time> <expiration_time>0</expiration_time> Yes, I loaded the certificate from the gui.

mythili · ‎07-03-2023

Hi @gcusello , The license was provided by my manager who generates it using Splunk Partnerverse portal. No, we do not have license with more than 1 year expiration. Thank you, We will raise a support ticket for this and check

mythili · ‎07-03-2023

Hi All, When I tried to add the new license, I am getting an error , "Bad Request — xxxx: failed to parse license because: Creation does not precede expiration; license can never be valid " What might cause this error and how to resolve it?

Posts	13
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎07-03-2023

Online Status	Offline
Date Last Visited	‎09-16-2024 04:41 AM

How to display duration(start and end time) in a c...

Inconsistency in displaying Collapse/Expand button...

When using Transaction command startswith and ends...

Dashboard "Search was cancelled"

Customize table width in results of drilldown to a...

Error while adding new license : failed to parse l...

How to display duration(start and end time) in a c...

Re: Inconsistency in displaying Collapse/Expand bu...