Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About soulmaker
soulmaker
Explorer
Member since:
09-13-2023
07-03-2024
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 09-13-2023 |
Activity Feed
- Posted Re: Chart showing "no results found" in Dashboard with using base search on Dashboards & Visualizations. 07-02-2024 05:55 PM
- Posted Chart showing "no results found" in Dashboard with using base search on Dashboards & Visualizations. 07-02-2024 04:08 PM
- Posted Re: How to remove top result or keyword from showing in searh on Dashboards & Visualizations. 06-30-2024 04:32 PM
- Karma Re: How to remove top result or keyword from showing in searh for bowesmana. 06-30-2024 04:31 PM
- Posted Re: How to change bar chart colors for single count on Dashboards & Visualizations. 06-30-2024 04:29 PM
- Karma Re: How to change bar chart colors for single count for bowesmana. 06-30-2024 04:29 PM
- Karma Re: How to change bar chart colors for single count for bowesmana. 06-30-2024 04:29 PM
- Posted Re: How to change bar chart colors for single count on Dashboards & Visualizations. 06-30-2024 04:08 PM
- Posted How to remove top result or keyword from showing in searh on Dashboards & Visualizations. 06-30-2024 04:03 PM
- Posted Re: How to change bar chart colors for single count on Dashboards & Visualizations. 06-30-2024 03:45 PM
- Posted How to change bar chart colors for single count on Dashboards & Visualizations. 06-25-2024 07:53 PM
- Posted Re: It is possible to use a variable under mstats search? on Splunk Search. 09-13-2023 10:09 PM
- Karma Re: It is possible to use a variable under mstats search? for bowesmana. 09-13-2023 10:08 PM
- Posted It is possible to use a variable under mstats search? on Splunk Search. 09-13-2023 09:11 PM
- Posted Re: How to write a search to combine the sum of three metric name into one count? on Splunk Search. 09-13-2023 04:49 PM
- Karma Re: How to write a search to combine the sum of three metric name into one count? for bowesmana. 09-13-2023 04:49 PM
- Posted How to write a search to combine the sum of three metric name into one count? on Splunk Search. 09-13-2023 02:24 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-02-2024
05:55 PM
Thanks @bowesmana for your comment. Very new to Splunk and not really sure if I do need base search, but all I want really is for these events to only search once for my dashboard to not consume a lot of memory when it is loading or refreshing. At the moment I do have 5 chart on my dashboard and I need to get the data from that event with different path to search. All the event are from that query and what is happening now is trying to do a query of that for 5x. I though base search would be the best thing to use so it will only query once on my dashboard.
... View more
07-02-2024
04:08 PM
Hello, I have some issues where using base search is not working on my dashboard. Interestingly, if I click on the search icon, it will come up with valid search query and it will shows some result. However, on my dashboard itselt it shows "no results found". Below is currently what I have set: <search id="prod_request">
<query>type="request" "request.path"="prod/"</query>
<earliest>$timerange.earliest$</earliest>
<latest>$timerange.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<chart>
<title>Top 10 request</title>
<search base="prod_request">
<query>| stats count by auth.account_namespace | sort - count | head 10 | transpose 0 header_field=auth.account_namespace column_name=account_namespace | eval account_namespace=""</query>
</search>
<option name="charting.axisTitleX.text">Account Namespace</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">right</option>
<option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f]</option>
<option name="refresh.display">progressbar</option>
</chart>
... View more
Labels
- Labels:
-
chart
-
Classic dashboard
06-30-2024
04:32 PM
Awesome, this works as well. Thanks again for your help on this one.
... View more
06-30-2024
04:29 PM
This works! thanks man for your help on this one.
... View more
06-30-2024
04:08 PM
Yeah, I am a bit confuse as well. Seems like the last part of the query "| sort - count | head 10" does not really do anything. So I've modified my search to be like: type="request" "request.path"="prod/" | stats count by account_namespace | eval namespace="" | xyseries namespace account_namespace count | sort - count | head 10 by using the above, it gives me a result where the account_namespace shows as a column with all the count as the value. In the column it is showing all of it and not only the top 10 that has highest count.
... View more
06-30-2024
04:03 PM
Hi there, I have this query below to search the top policies that has been used. type="request" "request.path"="prod/" | stats count by policies{} | sort -count | head 10 by default all the policies is being generated with "default" which I wanted to get rid of when searching so properly shows the top 10 policies only. The search query above example results are: policies:
default
policies_1
policies_2
policies_3
.... I wanted to get rid of the default showing on my result. Any idea or help is really appricated.
... View more
Labels
- Labels:
-
chart
-
Classic dashboard
06-30-2024
03:45 PM
Thanks @bowesmana for your reply and sharing the below. I have now managed to make it multiseries chart by applying you've shared below. However, it is showing the result of all of the account_namespace, is there a way for me to filter the highest 10 count and only shows that?
... View more
06-25-2024
07:53 PM
Hi, I wanted to have a bar graph that has different colour for better represention of my dashboard. I do have a search like below" type="request" "request.path"="prod" | stats count by account_namespace | sort - count | head 10 I tried adding the "<option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f]</option>" but I still get a single colour in my bar graph. I believe since i only one series for my query hence the single colour output. Is there a way for me to have my bar graph contains multiple colour?
... View more
Labels
- Labels:
-
Classic dashboard
-
Dashboard Studio
09-13-2023
10:09 PM
Your a real legend @bowesmana . I didn't realize that you can put wildcards in the middle. Thank you so much for your help. I am new to Splunk so your help is really helpful.
... View more
09-13-2023
09:11 PM
Hi there, I am trying to make a statistic graph in my dashboard using the search below. | mstats rate(vault.runtime.total_gc_pause_ns.value) as gc_pause WHERE `vault_telemetry` AND cluster=* AND (host=*) BY host span=5m
| timechart max(gc_pause) AS iowait bins=1000 BY host
| eval warning=3.3e7, critical=8.3e7 **Note that the search below comes from the pre-defined dashboard template but it is not working as is in my environment. In my Splunk, when I do a mpreview of my index `vault_telemetry` I am getting a result like the below: metric_name:vault.hostname1.runtime.total_gc_pause_ns metric_name:vault.hostname2.runtime.total_gc_pause_ns metric_name:vault.hostname3.runtime.total_gc_pause_ns metric_name:vault.hostname3.runtime.total_gc_pause_ns metric_name:vault.hostname4.runtime.total_gc_pause_ns If I modify the pre-defined search from the template using the below I can get the result however, I can only do it on one hostname. | mstats rate(vault.hostname1.runtime.total_gc_pause_ns) as gc_pause WHERE `vault_telemetry` span=5m
| timechart max(gc_pause) AS iowait bins=1000
| eval warning=3.3e7, critical=8.3e7 I would like to have all the hostname shows on my single panel. Can someone please able to assist and help me with the correct search index I need to use?
... View more
09-13-2023
04:49 PM
Thanks @bowesmana , you're a legend!
... View more
09-13-2023
02:24 PM
Hello, I have three search query below that I want to combine the three metric name sum into one total count. Can someone able to assist how I can write my query? First Query: | mstats sum(vault.token.creation.nonprod) as count where index=vault_metrics span=1h | timechart sum(count) as count span=1h | fillnull value=0 | eventstats perc90(count) perc50(count) Second Query: | mstats sum(vault.token.creation.dev) as count where index=vault_metrics span=1h | timechart sum(count) as count span=1h | fillnull value=0 | eventstats perc90(count) perc50(count) Third Query: | mstats sum(vault.token.creation.nonprod_preprod) as count where index=vault_metrics span=1h | timechart sum(count) as count span=1h | fillnull value=0 | eventstats perc90(count) perc50(count)
... View more
Labels
- Labels:
-
subsearch
