Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nithys
nithys
Communicator
Member since:
09-13-2023
05-01-2025
Community Statistics
| Posts | 84 |
| Solutions | 2 |
| Karma Given | 20 |
| Karma Received | 0 |
| Member Since | 09-13-2023 |
Activity Feed
- Posted Dashboard-Data and search as one query on Splunk Search. 05-01-2025 03:48 PM
- Posted Re: Count of requests processed by each API service per minute. on Splunk Search. 04-02-2025 10:00 AM
- Karma Re: Count of requests processed by each API service per minute. for yuanliu. 04-02-2025 10:00 AM
- Posted Count of requests processed by each API service per minute. on Splunk Search. 04-01-2025 08:54 PM
- Posted Re: submit button not working on Splunk Search. 03-30-2025 04:08 PM
- Posted Re: submit button not working on Splunk Search. 03-29-2025 07:54 AM
- Karma Re: custom Dropdrown with "ALL' for ITWhisperer. 03-29-2025 07:01 AM
- Karma Re: dashboard submit button for ITWhisperer. 03-29-2025 06:52 AM
- Posted Re: dashboard submit button on Dashboards & Visualizations. 03-29-2025 06:48 AM
- Posted dashboard submit button on Dashboards & Visualizations. 03-28-2025 11:57 PM
- Posted Re: custom Dropdrown with "ALL' on Splunk Search. 03-23-2025 08:27 AM
- Tagged Re: custom Dropdrown with "ALL' on Splunk Search. 03-23-2025 08:27 AM
- Posted custom Dropdrown with "ALL' on Splunk Search. 03-22-2025 01:38 PM
- Posted submit button not working on Splunk Search. 03-22-2025 11:16 AM
- Karma Re: capture error 4xx/5xx for bowesmana. 03-21-2025 03:50 PM
- Karma Re: spl qquery for PickleRick. 03-17-2025 05:47 AM
- Karma Re: set token with multiple values to different query for ITWhisperer. 03-17-2025 05:46 AM
- Karma Re: set token with multiple values to different query for ITWhisperer. 03-17-2025 05:46 AM
- Posted Re: set token with multiple values to different query on Dashboards & Visualizations. 03-16-2025 07:24 PM
- Posted Re: set token with multiple values to different query on Dashboards & Visualizations. 03-16-2025 12:16 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-01-2025
03:48 PM
Hi Team, Currently in my dashboard i am using two separate query for data and search lambda separetly and added to the dashboard 1.I want a combine query which works for both data and search lambda together an display reult as below GET /data/v1/amaz 1601 GET /search/v1/amaz 159 GET /data/v1/product 3 GET /search/v1/product 186 GET /data/v1/hack 373 GET /data/v1/cb1 1127 GET /search/v1/hack 297 Data lambda query: index=np source IN ("/aws/lambda/p-api-data-test-*") "gemini:streaming:info:*:*:responseTime"
| eval Entity = requestType . "/data/" . entity
| stats
sum(responseTime) as totalResponseTime,
avg(responseTime) as avgResponseTime,
count as totalTimeBuckets
by Entity
| eval avgResponseTime = round(avgResponseTime, 2)
| rename totalResponseTime as "totalResponseTime(ms)", avgResponseTime as "avgResponseTime(ms)", totalTimeBuckets as "totalTimeBuckets"
| table Entity "avgResponseTime(ms)"
| sort - "totalResponseTime(ms)" Data lambda Event: { [-]
apiResponseTime: 222
awsRequestId:
client: Joshu
domain: product
entity: product
hostname:
level: 30
msg: gemini:streaming:info:product:data:responseTime
pid: 8
queryParams: { [+]
}
requestType: GET
responseTime: 285
time: 2025-05-01T21:59:06.588Z
v: 0
} Search lambda: index=np source="/aws/lambda/p-api-search-test-*" "gemini:streaming:info:*:search:response:time"
| rex field=source "/aws/lambda/pdp-pc-api-search-test-(?<entity>[^/]+)"
| eval Entity = requestType . " search/" . entity
| stats
sum(responseTime) as totalResponseTime,
avg(responseTime) as avgResponseTime,
count as totalTimeBuckets
by Entity
| eval avgResponseTime = round(avgResponseTime, 2)
| rename totalResponseTime as "totalResponseTime(ms)", avgResponseTime as "avgResponseTime(ms)", totalTimeBuckets as "totalTimeBuckets"
| table Entity "avgResponseTime(ms)"
| sort - "totalResponseTime(ms)" Search lambda Event: { [-]
apiResponseTime: 146
client: Joshua.Be
domain: product
entity: amaz
level: 30
msg: gemini:streaming:info:amaz:search:response:time
pid: 8
queryHits: 50
queryParams: { [+]
}
requestType: GET
responseTime: 149056
time: 2025-05-01T22:01:35.622Z
v: 0
} 2.Data api msg: will be: gemini:streaming:info:product:data:responseTime Search api msg: will be: gemini:streaming:info:amaz:search:responseTime so in query i added keyword as "gemini:streaming:info:*:*:responseTime" but througing error as "The term '"gemini:streaming:info:*:*:responseTime"' contains a wildcard in the middle of a word or string. This might cause inconsistent results if the characters that the wildcard represents include punctuation"
... View more
Labels
- Labels:
-
field extraction
04-02-2025
10:00 AM
Thank you @yuanliu It worked
... View more
04-01-2025
08:54 PM
Hi I am working on below query to get Count of requests processed by each API service per minute index=np source IN ("/aws/lambda/api-data-test-*") "responseTime" | eval source = if(match(source, "/aws/lambda/api-data-test-(.*)"), replace(source, "/aws/lambda/api-data-test-(.*)", "data/\\1"), source) | bucket _time span=1m | stats count by source, _time i get below result for one source "name" ,second source by address,third source by city . How can i represent different api source with per minute in good understandable format...either graph or pictorial representation source _time count data/name 2025-03-02 08:13:00 2 data/name 2025-03-02 08:14:00 57 data/name 2025-03-02 08:15:00 347 data/name 2025-03-02 08:16:00 62 data/name 2025-03-02 08:17:00 48 data/address 2025-03-02 08:18:00 21 data/city 2025-03-02 08:19:00 66 data/city 2025-03-02 08:20:00 55 data/address 2025-03-02 08:21:00 7 name event {"name":"log","awsRequestId":"aws","hostname":"1","pid":8,"level":30,"requestType":"GET","entity":"name","client":"Ha2@gmail.com","domain":"name.io","queryParams":{"identifier":"977265"},"responseTime":320,"msg":"responseTime","time":"2025-03-02T03:23:40.504Z","v":0} address event {"name":"log","awsRequestId":"aws","hostname":"1","pid":8,"level":30,"requestType":"GET","entity":"address","client":"Harggg2@gmail.com","domain":"name.io","queryParams":{"identifier":"977265"},"responseTime":320,"msg":"responseTime","time":"2025-03-02T03:23:40.504Z","v":0}
... View more
03-30-2025
04:08 PM
I tried the above dashboard code . At the first screenshot...no dropdown is selected Second screenshot :test envis selected and the query started running query for "Unique User/Unique Client) The "np-" value to index source="/aws/lambda/g-lambda-au-test" "test" is substituted to the query already without selecting data Entity dropdown or time it autoran
... View more
03-29-2025
07:54 AM
Hi I tried with fieldset in the form ..but its still fetch result based on first dropdown and runs the result Current Behavior: The dashboard fetches results immediately when the "env" dropdown is selected (e.g., "test" or "prod"). Results are fetched without considering other filters like "data entity" or "time." Expected behaviour The dashboard should wait for the user to: Select a value from the "env" dropdown (e.g., "test" or "prod"). Select a value from the "data entity" dropdown. Specify a time range. Only after all selections are made and the "Submit" button is clicked, the query should execute and fetch results. Could someone help on this .I tried adding fieldset <form version="1.1" theme="dark">
<label>Metrics222</label>
<fieldset>
<input type="dropdown" token="indexToken1" searchWhenChanged="false">
<label>Environment</label>
<choice value="prod-,prod,*">PROD</choice>
<choice value="np-,test,*">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
</input>
<input type="dropdown" token="entityToken" searchWhenChanged="false">
<label>Data Entity</label>
<choice value="*">ALL</choice>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API USAGE STATISTICS</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique User / Unique Client</title>
<search>
<query>index=$indexToken$ AND source="/aws/lambda/g-lambda-au-$stageToken$"
| stats dc(claims.sub) as "Unique Users", dc(claims.cid) as "Unique Clients" BY claims.cid claims.groups{}
| rename claims.cid AS app, claims.groups{} AS groups
| table app "Unique Users" "Unique Clients" groups</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<html id="nspCounts">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">NSP STREAM STATISTICS</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique Consumer</title>
<search>
<query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| sort -_time
| head 1
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name="*costing*"
| table Name, DistinctAdminUserCount</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<title>Event Processed</title>
<search>
<query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "success Published to NSP3 objectType*"
| rex field=msg "objectType\s*:\s*(?<objectType>[^\s]+)"
| stats count by objectType</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<table>
<title>Number of Errors</title>
<search>
<query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp"
"error*" | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>API : Data/Search Count</title>
<html id="errorcount5">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user"> API COUNT STATISTICS</h2>
</html>
</panel>
</row>
<row>
<panel>
<title>Total Request Data</title>
<table>
<search>
<query>(index=$indexToken$ source="/aws/lambda/api-data-$stageToken$-$entityToken$" OR source="/aws/lambda/api-commands-$stageToken$-*") ge:*:init:*:invoke
| spath path=event.path output=path
| spath path=event.httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Total Request Search</title>
<table>
<search>rliest><query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") ge:init:*:invoke
| spath path=path output=path
| spath path=httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Total Error Count :</title>
<table>
<search>rliest><query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") msg="error*"
(error.status=4* OR error.status=5*)
| eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Response Time Count in ms</title>
<table>
<search>rliest><query>index=np-papi source IN ("/aws/lambda/api-search-test-*") "ge:init:search:response"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="Search API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
| append [
search index=np-papi source IN ("/aws/lambda/api-data-test-*") msg="ge:init:data:*"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="DATA API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
]
| table API, TotalResponseTime, AvgResponseTime</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<html id="errorcount16">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">Request per min</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=$indexToken$ source IN ("/aws/lambda/api-data-$stageToken$-$entityToken$","/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:*:*"
| timechart span=1m count by source
| untable _time source count
| stats sum(count) as TotalCount, avg(count) as AvgCountPerMin by source
| eval AvgCountPerMin = round(AvgCountPerMin, 2)
| eval source = if(match(source, "api-data-test-(.*)"), replace(source, "/api-data-test-(.*)", "data-\\1"),
if(match(source, "/aws/lambda/api-data-prod-(.*)"), replace(source, "/aws/lambda/api-data-prod-(.*)", "data-\\1"),
if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda/api-search-test-(.*)", "search-\\1"),
replace(source, "/aws/lambdaapi-search-prod-(.*)", "search-\\1"))))
| table source, TotalCount, AvgCountPerMin</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>SLA % :DATA API</title>
<table>
<search>
<query>index=$indexToken$ source IN ("/aws/lambdaapi-data-$stageToken$-$entityToken$") "ge:init:data:responseTime"
| eval SLA_threshold = 113
| eval SLA_compliant = if(responseTime <= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "DATA API"
| table source, SLA_percentage, totalRequests, SLA_passed</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>SLA % :SEARCH API</title>
<table>
<search>
<query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:search:response:time"
| eval SLA_threshold = 100
| eval SLA_compliant = if(responseTime <= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "SEARCH API"
| eval source = if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda\api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambda/api-search-prod-(.*)", "search-\\1"))
| table source, SLA_percentage, totalRequests, SLA_passed</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
03-29-2025
06:48 AM
Thank you for your feedback. I appreciate the time and expertise you and others volunteer here. My intention wasn’t to exclude anyone.I’ll keep your advice in mind for future posts to ensure all contributions are valued equally. And will repost without tagging anyone
... View more
03-28-2025
11:57 PM
Hi I have a dasahboard below code currently it gets result whenever the env dropdown is selected either test or prod.My use case is once select env from drop down+select data entity+time ...then when i hit submit button.It should fetch resu;t based on all these selection done <form version="1.1" theme="dark">
<label>Metrics222</label>
<fieldset>
<input type="dropdown" token="indexToken1" searchWhenChanged="false">
<label>Environment</label>
<choice value="prod-,prod,*">PROD</choice>
<choice value="np-,test,*">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
</input>
<input type="dropdown" token="entityToken" searchWhenChanged="false">
<label>Data Entity</label>
<choice value="*">ALL</choice>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API USAGE STATISTICS</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique User / Unique Client</title>
<search>
<query>index=$indexToken$ AND source="/aws/lambda/g-lambda-au-$stageToken$"
| stats dc(claims.sub) as "Unique Users", dc(claims.cid) as "Unique Clients" BY claims.cid claims.groups{}
| rename claims.cid AS app, claims.groups{} AS groups
| table app "Unique Users" "Unique Clients" groups</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<html id="nspCounts">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">NSP STREAM STATISTICS</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique Consumer</title>
<search>
<query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| sort -_time
| head 1
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name="*costing*"
| table Name, DistinctAdminUserCount</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<title>Event Processed</title>
<search>
<query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "success Published to NSP3 objectType*"
| rex field=msg "objectType\s*:\s*(?<objectType>[^\s]+)"
| stats count by objectType</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<table>
<title>Number of Errors</title>
<search>
<query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp"
"error*" | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>API : Data/Search Count</title>
<html id="errorcount5">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user"> API COUNT STATISTICS</h2>
</html>
</panel>
</row>
<row>
<panel>
<title>Total Request Data</title>
<table>
<search>
<query>(index=$indexToken$ source="/aws/lambda/api-data-$stageToken$-$entityToken$" OR source="/aws/lambda/api-commands-$stageToken$-*") ge:*:init:*:invoke
| spath path=event.path output=path
| spath path=event.httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Total Request Search</title>
<table>
<search>rliest><query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") ge:init:*:invoke
| spath path=path output=path
| spath path=httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Total Error Count :</title>
<table>
<search>rliest><query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") msg="error*"
(error.status=4* OR error.status=5*)
| eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Response Time Count in ms</title>
<table>
<search>rliest><query>index=np-papi source IN ("/aws/lambda/api-search-test-*") "ge:init:search:response"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="Search API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
| append [
search index=np-papi source IN ("/aws/lambda/api-data-test-*") msg="ge:init:data:*"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="DATA API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
]
| table API, TotalResponseTime, AvgResponseTime</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<html id="errorcount16">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">Request per min</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=$indexToken$ source IN ("/aws/lambda/api-data-$stageToken$-$entityToken$","/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:*:*"
| timechart span=1m count by source
| untable _time source count
| stats sum(count) as TotalCount, avg(count) as AvgCountPerMin by source
| eval AvgCountPerMin = round(AvgCountPerMin, 2)
| eval source = if(match(source, "api-data-test-(.*)"), replace(source, "/api-data-test-(.*)", "data-\\1"),
if(match(source, "/aws/lambda/api-data-prod-(.*)"), replace(source, "/aws/lambda/api-data-prod-(.*)", "data-\\1"),
if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda/api-search-test-(.*)", "search-\\1"),
replace(source, "/aws/lambdaapi-search-prod-(.*)", "search-\\1"))))
| table source, TotalCount, AvgCountPerMin</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>SLA % :DATA API</title>
<table>
<search>
<query>index=$indexToken$ source IN ("/aws/lambdaapi-data-$stageToken$-$entityToken$") "ge:init:data:responseTime"
| eval SLA_threshold = 113
| eval SLA_compliant = if(responseTime <= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "DATA API"
| table source, SLA_percentage, totalRequests, SLA_passed</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>SLA % :SEARCH API</title>
<table>
<search>
<query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:search:response:time"
| eval SLA_threshold = 100
| eval SLA_compliant = if(responseTime <= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "SEARCH API"
| eval source = if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda\api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambda/api-search-prod-(.*)", "search-\\1"))
| table source, SLA_percentage, totalRequests, SLA_passed</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
Classic dashboard
-
Dashboard Studio
03-23-2025
08:27 AM
@ITWhisperer @catdadof3 yes want to set $entityTokenFirst$ to * when the user selects "ALL" in the dropdown, observing that search queries are being executed automatically (auto-run) whenever you switch dropdown values or filters, without explicitly hitting the submit button. looking for an alternative way to achieve this behavior without triggering auto-run searches. HOw to apply multiple condition only when they hit a submit <change>
<condition value="ALL">
<set token="entityTokenFirst">*</set>
</condition>
<condition>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","),1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval>
</condition>
</change> below dashboard is working only when i hit submit button,no condition is being used below <form>
<label>stats Clone metrics</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1" searchWhenChanged="false">
<label>Environment</label>
<choice value="prod,prod">PROD</choice>
<choice value="np,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np,test</default>
</input>
<input type="dropdown" token="entityToken" searchWhenChanged="false">
<label>Data Entity</label>
<choice value="target">Target </choice>
<choice value="product">Product</choice>
<choice value="*">ALL</choice>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
</form>
... View more
- Tags:
- tables
03-22-2025
01:38 PM
Hi I have dashboard with Data Entity drop down ,i want to add a drop drown "ALL" ,if i select ALL and hit submit button, It shows for all data api "/aws/lambda/api-data-$stageToken$-*" <query>index=$indexToken$ source IN ("/aws/lambda/api-data-$stageToken$-$entityTokenFirst$") msg="data:invoke" <form version="1.1" theme="dark" submitButton="true">
<label>Stats</label>
<fieldset>
<input type="dropdown" token="indexToken1" searchWhenChanged="false">
<label>Environment</label>
<choice value="prod,prod">PROD</choice>
<choice value="np,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np,test</default>
</input>
<input type="dropdown" token="entityToken" searchWhenChanged="false">
<label>Data Entity</label>
<choice value=“name,0”>name</choice>
<choice value="targetProduct,*-test-target">Target </choice>
<choice value="product,*-test-product">Product </choice>
<choice value=“address,0”>address</choice>
<change>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","),1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval>
</change>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Distinct Consumer Count</title>
<single>
<search>
<query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$searchName$
| sort -_time
| head 1
| appendpipe
[ stats count
| eval Name=if(count==0 OR isnull("$searchName$") OR "$searchName$"=="", "No NSP", "$searchName$")
| fields DistinctAdminUserCount
]</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
<panel>
<title>Event Processed</title>
<single>
<search>
<query>index="$indexToken$" source="publish-$entityTokenFirst$-$stageToken$-nsp"
* Published to NSP3 objectType* | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Total Request :</title>
<single>
<search>
<query>index=$indexToken$ source IN ("/aws/lambda/api-data-$stageToken$-$entityTokenFirst$") msg="data:invoke" | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="height">317</option>
<option name="rangeColors">["0xcba700","0xdc4e41"]</option>
<option name="rangeValues">[200]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
count
-
field extraction
03-22-2025
11:16 AM
Hi Submit button is not working 1.First time when i load the dashboard ,i select data Data Entity from dropdown and hit submit button .It works and fetch the result of that selecte Data Entity 2.Second time from dropdown selected the another entity without hitting submit button .the search started running for the selected drop down and gets the result.Help needed to fix it 3.In choice Value field "*-test-target" or *-test-product" wanted to be auto populate test or prod based on Env ($stageToken$) <label>Data Entity</label> <choice value=“name,0”>name</choice> <choice value="targetProduct,*-test-target">Target </choice> <choice value="product,*-test-product">Product </choice> <form version="1.1" theme="dark" submitButton="true">
<label>Stats</label>
<fieldset>
<input type="dropdown" token="indexToken1" searchWhenChanged="false">
<label>Environment</label>
<choice value="prod,prod">PROD</choice>
<choice value="np,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np,test</default>
</input>
<input type="dropdown" token="entityToken" searchWhenChanged="false">
<label>Data Entity</label>
<choice value=“name,0”>name</choice>
<choice value="targetProduct,*-test-target">Target </choice>
<choice value="product,*-test-product">Product </choice>
<choice value=“address,0”>address</choice>
<change>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","),1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval>
</change>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Distinct Consumer Count</title>
<single>
<search>
<query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$searchName$
| sort -_time
| head 1
| appendpipe
[ stats count
| eval Name=if(count==0 OR isnull("$searchName$") OR "$searchName$"=="", "No NSP", "$searchName$")
| fields DistinctAdminUserCount
]</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
<panel>
<title>Event Processed</title>
<single>
<search>
<query>index="$indexToken$" source="publish-$entityTokenFirst$-$stageToken$-nsp"
* Published to NSP3 objectType* | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Total Request :</title>
<single>
<search>
<query>index=$indexToken$ source IN ("/aws/lambda/api-data-$stageToken$-$entityTokenFirst$") msg="data:invoke" | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="height">317</option>
<option name="rangeColors">["0xcba700","0xdc4e41"]</option>
<option name="rangeValues">[200]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form>
... View more
03-16-2025
07:24 PM
@ITWhisperer still seeing same error with below dashboard code . <form version="1.1" theme="dark">
<label>Stats local Clone1</label>
<fieldset submitButton="true">
<input type="dropdown" token="entityToken">
<label>Select Data Entity</label>
<!-- Set two values for each choice -->
<choice value="target,*-test-targetf">Target </choice>
<choice value="CB,*-test-cb">CB</choice>
<default>target,*-test-targetf</default>
<change>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","), 1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
</change>
</input>
<input type="time" token="timeToken">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Distinct Consumer Count for $entityLabel$</title>
<search>
<query>
index="" source="**"
| spath path=test.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$searchName$
| sort -_time
| head 1
| fields DistinctAdminUserCount
</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Total Request :</title>
<single>
<search>
<query>
index="$indexToken$" source IN ("/aws/lambda/-data-$stageToken$-$entityTokenFirst$") msg="gemini:streaming:info:*:init:data:invoke"
| stats count
</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="height">317</option>
<option name="rangeColors">["0xcba700","0xdc4e41"]</option>
<option name="rangeValues">[200]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form>
... View more
03-16-2025
12:16 PM
@ITWhisperer i am using the correct $entityTokenFirst$ in the eval token and query in the provided dashboard code .looks like i typed mistakenly as $entityToken$ <change> <!-- Split the value and set tokens for both parts --> <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","), 1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval> </change> <query> index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke" | stats count </query> <form version="1.1" theme="dark">
<label>Stats local Clone1</label>
<fieldset submitButton="true">
<input type="dropdown" token="entityTokenFirst">
<label>Select Data Entity</label>
<!-- Set two values for each choice -->
<choice value="target,*-test-targetf">Target </choice>
<choice value="CB,*-test-cb">CB</choice>
<default>target,*-test-targetf</default>
<change>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","), 1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
</change>
</input>
<input type="time" token="timeToken">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Distinct Consumer Count for $entityLabel$</title>
<search>
<query>
index="" source="**"
| spath path=test.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$searchName$
| sort -_time
| head 1
| fields DistinctAdminUserCount
</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Total Request :</title>
<single>
<search>
<query>
index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke"
| stats count
</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="height">317</option>
<option name="rangeColors">["0xcba700","0xdc4e41"]</option>
<option name="rangeValues">[200]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form>
... View more
03-16-2025
08:53 AM
Hi The problem is token substitution in the dropdown input. Specifically: Issue with entityToken Substitution: The first value of the dropdown choice (e.g., target or CB) is not being correctly substituted into the $entityToken$ token. <form version="1.1" theme="dark">
<label>Stats local Clone1</label>
<fieldset submitButton="true">
<input type="dropdown" token="entityTokenFirst">
<label>Select Data Entity</label>
<!-- Set two values for each choice -->
<choice value="target,*-test-targetf">Target </choice>
<choice value="CB,*-test-cb">CB</choice>
<default>target,*-test-targetf</default>
<change>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","), 1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
</change>
</input>
<input type="time" token="timeToken">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Distinct Consumer Count for $entityLabel$</title>
<search>
<query>
index="" source="**"
| spath path=test.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$searchName$
| sort -_time
| head 1
| fields DistinctAdminUserCount
</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Total Request :</title>
<single>
<search>
<query>
index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke"
| stats count
</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="height">317</option>
<option name="rangeColors">["0xcba700","0xdc4e41"]</option>
<option name="rangeValues">[200]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form> This is causing the $entityToken$ token to not reflect the expected value in queries where it is used, such as: source IN ("/aws/lambda/*-data-$stageToken$-$entityToken$" Correct Substitution for searchName: The second value of the dropdown choice (e.g., -test-targetf or *-test-cb) is being correctly substituted into the $searchName$ token. This indicates that the <eval> logic for searchName is working as expected: <eval token="searchName">mvindex(split($value$, ","), 1)</eval> Potential Cause of the Problem: The <eval> logic for entityToken might not be working as expected: <eval token="entityToken">mvindex(split($value$, ","), 0)</eval? This could be due to: A syntax issue in the <eval> block. A conflict with the token name entityToken elsewhere in the dashboard. The $value$ token not being properly passed or split. Problem: The first value of the dropdown choice (e.g., target or CBD) is not being correctly substituted into the $entityToken$ token in the Splunk dashboard. This is causing queries that rely on $entityToken$ to fail or use incorrect values. Expected Behavior: $entityToken$ should be set to the first value of the selected dropdown choice (e.g., target or CB). $searchName$ should be set to the second value of the selected dropdown choice (e.g., *-test-targetf or *-test-cb). Current Behavior: $searchName$ is correctly set to the second value of the dropdown choice. $entityToken$ is not being set to the first value of the dropdown choice. Impact: Queries that rely on $entityToken$ are failing or using incorrect values, such as:
... View more
- Tags:
- dashboard
Labels
- Labels:
-
Classic dashboard
03-15-2025
09:15 AM
Hi @PickleRick @gcusello In below dashboard I want To fetch the DistinctAdminUserCount for a specific Name (e.g., "-target") DistinctAdminUserCount Name -target 3 Name -product 2 Problem 1:with below query it is working if i manually add searchName either test or prod.But if want to work from dashboard the search is not substituting for entityTokennsp Problem2:search Name can be test or prod based on env selection that also need to be fixed if it is test,search Name="*-test-target" if it is pro,search Name="*-prod-target" Appraoch: Use the entityToken token to store the dropdown value (e.g., target). Dynamically derive the required values (target or *-test-targetfob) directly in the queries using the eval and case commands. entityToken is correctly substituted in dashboard entityTokennsp is not substituted under below query Query used in Dashboard: <query>index="np" source="**" sourcetype="n"
| spath path=test.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$entityTokennsp$
| sort -_time
| head 1
| fields DistinctAdminUserCount</query> splunk query working in search separately if i given name manually: index="np" source="**" sourcetype="n"
| spath path=test.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name="-test-target"
| sort -_time
| head 1
| fields DistinctAdminUserCount Das <form version="1.1" theme="dark">
<label>Stats </label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1" searchWhenChanged="false">
<label>Environment</label>
<choice value="prod,prod">PROD</choice>
<choice value="np,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np,test</default>
</input>
<input type="dropdown" token="entityToken" searchWhenChanged="false">
<label>Data Entity</label>
<choice value="targetFO">Target FO</choice>
<choice value="productFO">Product FO</choice>
<change>
<eval token="entityToken">case(
$value$=="targetFO", "Target",
$value$=="productFO", "Product",
true(), ""
)</eval>
<!-- Token for the second query -->
<eval token="entityTokennsp">case(
"entityToken"=="targetFO", "test-target",
"entityToken"=="productFO", "test-product",
true(), ""
)</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Distinct Consumer Coun</title>
<search>
<query>index="np" source="**" sourcetype="n"
| spath path=test.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$entityTokennsp$
| sort -_time
| head 1
| fields DistinctAdminUserCount</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Total Request :</title>
<single>
<search>
<query>index=np source IN ("*-$stageToken$-$entityToken$") msg="data:invoke" | stats count</query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="height">317</option>
<option name="rangeColors">["0xcba700","0xdc4e41"]</option>
<option name="rangeValues">[200]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form>
... View more
- Tags:
- dashboard
03-14-2025
05:49 AM
Help to modify existing query to add all Name,DistinctAdminUserNames,DistinctAdminUserCount when trying with search = "hi-cost-test-sample" OR "hi-cost-test-name" .It didnt work Name DistinctAdminUserNames DistinctAdminUserCount hi-cost-test-sample “Technology”,”2”,3””,”4”,”5” 5 hi-cost-test-name "preprod”,2”,3””,”4”,”5” 3 index="*" source="**" sourcetype="*"
| spath test.nsp3s{} output=nsps3s
| mvexpand nsp3s
| spath input=nsp3s Name output=Name
| spath input=nsp3s DistinctAdminUserNames{} output=DistinctAdminUserNames
| search Name="hi-cost-test-sample" OR "hi-cost-test-name"
| stats values(DistinctAdminUserNames) as DistinctAdminUserNames by Name
| rename Name as EntityName
| table EntityName DistinctAdminUserNames
... View more
- Tags:
- rex
03-14-2025
05:43 AM
I am looking to have three column one for Name(EntityName) another for DistinctAdminUserNames and third one for DistinctAdminUserCount of each associated Name inside test or prod object.can you modify query in order to fetch like below Name DistinctAdminUserNames DistinctAdminUserCount hi-cost-test-sample “Technology”,”2”,3””,”4”,”5” 5 hi-cost-test-name 3 getting error as shown in picture [idx-i-010ab3eb96c032aa1.om,idx-i-021ad0bda97800234.nike.splunkcloud.com,idx-i-0267c01401cb1d8ed..com,idx-i-06c8fc857ab0b62ea.nike.splunkcloud.com,idx-i-0804ced14f96f4517.kcloud.com,idx-i-0a6073abaabb5902b.nike.splunkcloud.com,idx-i-0ea40148068176b7f.noud.com] Field 'nsp3s' does not exist in the data. query index="*" source="**" sourcetype="*"
| spath test.nsp3s{} output=nsps3s
| mvexpand nsp3s
| spath input=nsp3s Name output=Name
| spath input=nsp3s DistinctAdminUserNames{} output=DistinctAdminUserNames
| search Name="hi-cost-test-sampleDistinctAdminUserNamesDistinctAdminUserNamesDistinctAdminUserNamesDistinctAdminUserNames"
| stats values(DistinctAdminUserNames) as DistinctAdminUserNames by Name
| rename Name as EntityName
| table EntityName DistinctAdminUserNames splunk data {"prod":{},"test":{"DistinctAdminUser":["streaming","Create","","Application.","App.","App.","obi","Users","platform",],"TotalSinkAdminUsers":33,"TotalNSP3Count":11,"TotalSourceAdminUsers":10,"DistinctAdminUserCount":11,"TotalStreamAdminUsers":12,"TotalAdminUser":55,"nsp3s":[{"StreamAdminUserNames":["App."],"SourceAdminUserNames":["preprod"],"DistinctAdminUserCount":5,"SinkAdminUserCount":5,"SourceAdminUserCount":1,"DistinctAdminUserNames”:[“Technology”,”2”,3””,”4”,”5”],”StreamAdminUserCount":1,"TotalAdminUserCount":7,"SinkAdminUserNames":["obi"],"Name”:”hi-cost-test-sample“},{“StreamAdminUserNames":["preprod"],"SourceAdminUserNames":["admin.preprod"],"DistinctAdminUserCount":3,"SinkAdminUserCount":3,"SourceAdminUserCount":1,"DistinctAdminUserNames":["preprod”,2”,3””,”4”,”5”],”StreamAdminUserCount":1,"TotalAdminUserCount":5,"SinkAdminUserNames":["ops-tform"],"Name”:”hi-cost-test-name”},”subscriberId":"NSP3"}
... View more
- Tags:
- rex
03-13-2025
04:27 PM
Hi Need help in finding DistinctAdminUserCount and DistinctAdminUserNames of each associated Name inside test or prod object {"prod":{},"test":{"DistinctAdminUser":["streaming","Create","","Application.","App.","App.","obi","Users","platform",],"TotalSinkAdminUsers":33,"TotalNSP3Count":11,"TotalSourceAdminUsers":10,"DistinctAdminUserCount":11,"TotalStreamAdminUsers":12,"TotalAdminUser":55,"nsp3s":[{"StreamAdminUserNames":["App."],"SourceAdminUserNames":["preprod"],"DistinctAdminUserCount":5,"SinkAdminUserCount":5,"SourceAdminUserCount":1,"DistinctAdminUserNames”:[“Technology”,”2”,3””,”4”,”5”],”StreamAdminUserCount":1,"TotalAdminUserCount":7,"SinkAdminUserNames":["obi"],"Name”:”hi-cost-test-sample“},{“StreamAdminUserNames":["preprod"],"SourceAdminUserNames":["admin.preprod"],"DistinctAdminUserCount":3,"SinkAdminUserCount":3,"SourceAdminUserCount":1,"DistinctAdminUserNames":["preprod”,2”,3””,”4”,”5”],”StreamAdminUserCount":1,"TotalAdminUserCount":5,"SinkAdminUserNames":["ops-tform"],"Name”:”hi-cost-test-name”},”subscriberId":"NSP3"} index="*" source="*"
| spath test.nsps{} output=nsps
| mvexpand nsps
| spath input=nsps Name output=Name
| spath input=nsps ReadOnlyConsumerNames{} output=ReadOnlyConsumerNames
| search Name=""
| stats values(ReadOnlyConsumerNames) as ReadOnlyConsumerNames by Name
| rename Name as EntityName
| table EntityName ReadOnlyConsumerNames Need
... View more
03-13-2025
03:56 PM
Hi Using below query to capture 4xx,5xx error ,but getting as no result found index=* source IN ("/aws/lambda/*") msg="**"
(error.status=4* OR error.status=5*)
| eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status {"name":"","","pid":8,"level":50,"error":{"message":"Request failed with status code 500","name":"AxiosError","stack":"AxiosError: Request failed with status code 500\n )","config":{"transitional":{"silentJSONParsing":true,"forcedJSONParsing":true,"clarifyTimeoutError":false},"adapter":["xhr","http"],"transformRequest":[null],"transformResponse":[null],"timeout":0,"xsrfCookieName":"X","xsrfHeaderName":"X-","maxContentLength":-1,"maxBodyLength":-1,"env":{},"headers":{"Accept":"application/json, text/plain, */*","Content-Type":"application/json","Authorization":"","User-Agent":"","Accept-Encoding":"gzip, compress, deflate, br"},"method":"get",""},"code":"ERR_BAD_RESPONSE","status":500},"eventAttributes":{"Identifier":2025732,"VersionNumber":"A.43"},"msg":"msg:data:error","time":":48:38.213Z","v":0} this is my raw event format mostly looks like
... View more
03-08-2025
06:02 AM
It will work if i give the keyword as *init:data:invoke* runs in dashboard and also in the search of Edit search part. but if i run *name:init:data:invoke* it runs in dashboard but not in particular Edit search if it is *$entityToken:init:data:invoke* not running in dashboard nor in particular Edit search
... View more
03-07-2025
11:03 PM
My source is like below i want whatever "$entityToken$" value=name is ,i want it to assign to the keyword also in *$entityToken$:init:data:invoke* ex ("/a/b/api-data-$stageToken$-name") *name:init:data:invoke* <query>index=* source IN ("/a/b/api-data-$stageToken$-$entityToken$") *$entityToken$:init:data:invoke* | eval identifier=coalesce('queryParams.identifier', 'event.queryStringParameters.identifier') | eval msg=coalesce(msg, null) | where isnotnull(identifier) and isnotnull(msg) | stats count</query>
... View more
03-07-2025
10:56 PM
Hi I am adding the query to my dashboard and when i click on highlighted run search it is not taking to the search one. after index and source the keyword search is *word:is:info:name:in:data:invok*..Not sure why it is not taking to search page
... View more
Labels
- Labels:
-
Classic dashboard
03-05-2025
04:35 PM
@gcusello @yeahnah I want to display in the similar tabular way what showed but not giving on specific json as taking as makeresult... I have the event flowing in two format which i shared earlier in the splunk.can you help on this
... View more
03-04-2025
06:17 AM
Hi @yeahnah @gcusello I used in below way where unique user count is not matching ,why i need to provide specify json...I want to fetch from all event from the splunk log give the unique user list for their specify group .group can respresent in [group 1,group 2] or [group1]...then fetch unique user list of [App.Au1,App.Au2] in one row and unique user list of [App.Au1] in second row
... View more
03-03-2025
04:45 PM
Hi Need to find Unique Users(Count of distinct business users )& Clients(Count of distinct system client accounts ) I want to have Unique Users and unqiue client based on cid.id and its associated groups example app unique user unique client groups name.id 22 1 app.preprod.name address.id 1 1 app.preprod.address,app.preprod.zipcode index= AND source="*" | stats dc( claims.sub) as "Unique Users" ``` dc(claims.sub) as "Unique Users" count(claims.sub) as "Total" ``` ```| addcoltotals labelfield="Grand Total"` {"name":"","hostname":"1","pid":8,"level":,"claims":{"ver":1,"jti":"h7","iss":"https","aud":"https://p","iat":1,"exp":17,"cid":"name.id","uid":"00","scp":["update:","offline_access","read:","readall:","create:","openid","delete:","execute:","read:"],"auth_time":17,"sub":"name@gmail.com","groups":["App.PreProd.name"]},"msg":" JWT Claims -API","time":"2025","v":0} unique client index=* AND source="*" | stats dc( claims.cid) as "Unique Clients" ``` dc(claims.sub) as "Unique Users" count(claims.sub) as "Total" ``` ```| addcoltotals labelfield="Grand Total"``` "name":"","hostname":"1","pid":8,"level":,"claims":{"ver":1,"jti":"h7","iss":"https","aud":"https://p","iat":1,"exp":17,"cid":"address.id","uid":"00","scp":["update:","offline_access","read:","readall:","create:","openid","delete:","execute:","read:"],"auth_time":17,"sub":"name@gmail.com","groups":["App.PreProd.address,app.preprod.zipcode"]},"msg":" JWT Claims -API","time":"2025","v":0}
... View more
- Tags:
- dashboard
03-03-2025
04:05 PM
yes it worked .Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-01-2025
02:53 PM
|
Karma given to
