About MrJohn230

MrJohn230

@bowesmana Great, that works. This is what I have done. Parameters for dashboard A earliest = $form.t_time.earliest$ latest = $form.t_time.latest$ Then on dashboard B my timepicker should refer to dashboard A tokens, see below. (leaving out the token name). Now you can adjust your default accordingly, if you want the default to be your token then use $earliest$ $latest$ . But by setting your default to 15 minutes when you directly go to dashboard B you will not receive an error of missing earliest. <input type="time"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input>

MrJohn230

@bowesmana When I click on the URL these parameters are being passed: ?earliest=1701381000&latest=1701384619 But when I add a new timepicker in the drill-down and set a default the URL becomes: ?earliest=1701381000&latest=1701384619&form.t_time.earliest=-15m&form.t_time.latest=now Drill-down timepicker token _time default "last 15 minutes" This is appended to the bottom of my spl (outside of the query tags) <earliest>$t_time.earliest$</earliest> <latest>$t_time.latest$</latest> My timepicker XML looks like this: <input type="time" token="t_time"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input>

MrJohn230

@bowesmana Appreciated the response. I'm "linking to dashboard" when I create the parameter I'm using earliest = $earliest$ and latest = $latest$ and seems to be passing to the url fine via the drill-down dashboard. What is annoying it when I go directly into the drill-down dashboard, the timepicker defaults to "All Time". My question is how can this be avoided? When I create the timepicker in the drilldown and set a default the "link to dashboard" parameters no longer work.

MrJohn230

I have a drilldown into another dashboard with parameters earliest=$earliest$ and latest=$latest$, this works. When I go into the drilldown dashboard directly it sets the data to come back as "all time". Is there a way that I can have multiple defaults or some other constrain that doesn't cause this? Here's what I've been working on but it's not working. Any feedback would be helpful... <input type="time" token="t_time"> <default> <earliest>if(isnull($url.earliest$), "-15m@m", $url.earliest$)</earliest> <latest>if(isnull($url.latest$), "now", $url.latest$)</latest> </default> </input>

MrJohn230

Hello, can someone provide feedback on how I can change the color of my panel to transparent? Below is my code snippet. I'm not great with CSS or XML. I was using dashboard studio which was straight forward on how to change but I'm back with classic for now. <panel> <single> <title>Total First Time</title> <search base="base_search"> <query>|search Cur= $t_cur$ | bin _time span=$t_bin$ | stats sum(FirstTime) as sumFirstTime by Category</query> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> </single> </panel>

MrJohn230

This is what worked for me. I added a TimeBucket dropdown box and created a token. | search cat IN ($t_endpoint$) AND Car IN ($t_car$) |bin _time span=$t_bin$ | stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by _time, Car, cat | eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p") |fields - _time |fields Time, Numbercat

MrJohn230

I have created a dashboard in dashboard studio. I have a table visualization, see my code below. So, the "Time" column auto sets my | bin to one minute. When I update my timepicker to say the last 7 days it still shows the time |bin as one minute. How can I dynamically change the |bin to best fit my timepicker selection? | search cat IN ($t_endpoint$) AND Car IN ($t_car$) | eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p") | stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by Time, Car, cat

MrJohn230

I have the below search and I'm trying to search for different time periods within each search. So for example msg="*Completed *" is using the timepicker input. I would like to search for data one hour before the timepicker search (so this should be dynamic) for msg="*First *" I'm not sure if this is possible. I'm comparing these two searches and the initial log msg="*First*" can occur several minutes before the msg=*Completed*" log. So when I compare some of these log messages get cut off depending on when I select my timepicker. I would like to search for these message 1 hour before my timepicker selection. Long term this search will go into a splunk dashboard. (index=color name IN ("green","blue") msg="*First *" ```earliest="11/09/2023:09:00:00" latest="11/09/2023:12:59:59"```) OR (index=color name IN ("blue2","green2") msg="*Completed *")

MrJohn230

Hello @gcusello I managed to not use the join command, the above feedback helped. I decided to go with Union this seems to be working, what do you think? index=customer ((name IN (gate-green, gate-blue) msg="*First time: *") | rex field=msg "First time: (?<UserId>\d+)" | eval FirtRequest = 1 |union [ search index name IN (cust-blue, cust-green) msg="*COMPLETED *") | rex field=msg "Message\|[^\t\{]*(?<json>{[^\t]+})" | spath input=json path=infoId output=UserId | eval Completed = 1] | stats max(FirstRequest) AS FirstRequest max(Completed) BY UserId

MrJohn230

I have the below code. I know that values exist under the subsearch which are not returning when I run the below query. However, when I uncomment the "where clause" in the sub search the values appear. I don't know what I have done incorrectly for my results to not show. I've also commented out the |search and it still doesn't show that these values exist in the subsearch. Any help would be appreciated. index=customer name IN (gate-green, gate-blue) msg="*First time: *" | rex field=msg "First time: (?<UserId>\d+)" | eval FirstRequest = 1 | join type=left UserId [search index=customer name IN (cust-blue, cust-green) msg="*COMPLETED *" | rex field=msg "Message\|[^\t\{]*(?<json>{[^\t]+})" | spath input=json path=infoId output=UserId | eval Completed = 1 ```| where UserId IN (125,999,418,208)```] | table UserId, Completed | search UserId IN (125,999,418,208)

MrJohn230

It's derived through the | eval | eval CareCnts=spath(json, "Info.Care.Redcount") | eval CoverCnts=spath(json, "Info.Cover.Redcount") | eval NonCoverCnts=spath(json, "Info.NonCover.Redcount")

MrJohn230

Hello, I have the below code. I'm trying to create a new column that extracts and pivots CareCnts, CoverCnts, NonCoverCnts, etc... (There are more but I have simplified). These |eval are related to their corresponding `| evals`. New Columns = ResourceCounts How would one accomplish this? index=red msg="*COMPLETED Red*" | spath output=logMessage path=msg | eval Care=spath(json, "Info.Care.elapsedTime") | eval CareCnts=spath(json, "Info.Care.Redcount") | eval Cover=spath(json, "Info.Cover.elapsedTime") | eval CoverCnts=spath(json, "Info.Cover.Redcount") | eval NonCover=spath(json, "Info.NonCover.elapsedTime") | eval NonCoverCnts=spath(json, "Info.NonCover.Redcount") | eval Category = "Red" | table _time, Care, Cover, NonCover, Category | eval SysTime = Category + ":" + _time | fields - Category | untable SysTime Resource CurValue | eval Category = mvindex(split(SysTime, ":"), 0) | eval _time = mvindex(split(SysTime, ":"), 1) | fields - SysTime | table _time, Resource, CurValue, Category Example output: _time Resource CurValue Category *NewColumn 2023-11-06 Care 14.20 Red 10 2023-11-06 Cover 3.4 Red 3 2023-11-06 NonCover 5.5 Red 8

MrJohn230 · ‎10-25-2023

I have my base search and Pat, Con and Cov are individual columns. I want those to be the values for my multi-value select. So in my mulit-value select I un-table those columns into rows with the column being Reason. | table _time, Pat, Con, Cov, Category

MrJohn230 · ‎10-24-2023

I have a multiselect that does not interact with my Trellis chart. I would say; it's not defined in my base search but not sure how to identify the issue and how to fix? BASE Search: | eval Pat=spath(json, "Info.Pat.Time") | eval Con=spath(json, "Info.Con.Time") | eval Cov=spath(json, "Info.Cov.Time") | eval Category = RED | table _time, Pat, Con, Cov, Category Mulit-Select: | eval SysTime = Category + ":" + _time | fields - Category | untable SysTime Reason CurationValue | eval Category = mvindex(split(SysTime, ":"), 0) | eval _time = mvindex(split(SysTime, ":"), 1) | fields - SysTime | table Reason | dedup Reason Chart: | search Category $t_category$ Reason $t_reason$ | timechart span=1h avg(Pat) as Pat, avg(Con) as Con, avg(Cov) as Cov

MrJohn230 · ‎10-24-2023

I have the below Trellis, is there a way to change the color for each Trellis? My code from Classic Dashboard. search Cu $t_c$ En $t_e$ | timechart span=1h avg(Value) as AvgValue_Secs by Category I want something like this:

Posts	16
Solutions	1
Karma Given	9
Karma Received	0
Member Since	‎10-19-2023

Online Status	Offline
Date Last Visited	Friday

Drilldown with timepicker

Classic Dashboard Single Value visual change backg...

Stats Auto Bin Time

Multiple time searches

Splunk left join not returning as expected

Query Pivot multiple columns

Multiselect token not interacting with Chart

Trellis Colors

Pivot/UnPivot Data from json msg

Re: Drilldown with timepicker

Re: Drilldown with timepicker

Re: Drilldown with timepicker

Drilldown with timepicker

Classic Dashboard Single Value visual change backg...

Re: Stats Auto Bin Time

Stats Auto Bin Time

Multiple time searches

Re: Splunk left join not returning as expected

Splunk left join not returning as expected

Re: Query Pivot multiple columns

Query Pivot multiple columns

Re: Multiselect token not interacting with Chart

Multiselect token not interacting with Chart

Trellis Colors