Hi Team. Could you please look into my post and respond on Automatic event correlation in Splunk ITSI (without creating manual correlation searches) for third party tools/ log4j? Thank you. ... View more

Hi @dtburrows3 , Thank you for your prompt response and it worked. Really appreciate your assistance. ... View more

Hi @danspav , Thank you for your response. I made the changes and when I clicked on the hyperlink, it is not redirecting to the correct dynamically generated external URL 'https://abc12345.apps.dynatrace.com/ui/apps/dynatrace.classic.distributed.traces/ui/services/SERVICE-ABC12345678AB1A1/purepaths?servicefilter=0%1E9%11SERVICE_METHOD-12345ABC1234A123%14abc%100%111340861000%144611686018427387&gtf=c_1716990969058_1716991269058&gf=all'. Here are the screenshots and code below. Please assist on this.     "visualizations": {         "viz_aBCd123": {             "type": "splunk.table",             "options": {                 "count": 5000,                 "dataOverlayMode": "none",                 "drilldown": "none",                 "backgroundColor": "#FAF9F6",                 "tableFormat": {                     "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",                     "headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",                     "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"                 },                 "eventHandlers": [                     {                         "type": "drilldown.customUrl",                         "options": {                             "url": "$row.URL.value|n$",                             "newTab": true                         }                     }                 ], ... View more

Hi @danspav , I replied on Friday that the hyperlink is not working by providing the source code and screenshots. Could you please look into it and assist? Thank you. ... View more

Hi @danspav , I added the event handlers and updated $row.URL.value$ in the link to custom url as per your ask, but still the url is not reflecting as hyperlink. Here is the source code and I shared the screenshot of the table below. Thank you.    "visualizations": {         "viz_qFxEKJ3l": {             "type": "splunk.table",             "options": {                 "count": 5000,                 "dataOverlayMode": "none",                 "drilldown": "none",                 "backgroundColor": "#FAF9F6",                 "tableFormat": {                     "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",                     "headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",                     "rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)",                     "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"                 },                 "eventHandlers": [                     {                         "type": "drilldown.customUrl",                         "options": {                             "url": "$row.URL.value|n$",                             "newTab": true                         }                     }                 ],         ... View more

Hi @yuanliu , Here are my responses below. Please let me know if I missed anything. 1) What is your actual data structure? - It is in JSON format. userActions: [ [-] { [-] apdexCategory: FRUSTRATED application: xxx cdnBusyTime: null cdnResources: 0 cumulativeLayoutShift: 0.0006 customErrorCount: 0 dateProperties: [ [+] ] documentInteractiveTime: 13175 domCompleteTime: 15421 domContentLoadedTime: 14261 domain: xxx doubleProperties: [ [+] ] duration: 15430 endTime: 1714043044710 firstInputDelay: 1 firstPartyBusyTime: null firstPartyResources: 0 frontendTime: 14578 internalApplicationId: APPLICATION-B9BADE8D75A35E32 internalKeyUserActionId: APPLICATION_METHOD-E3EF5284923A6BA3 javascriptErrorCount: 0 keyUserAction: true largestContentfulPaint: 15423 loadEventEnd: 15430 loadEventStart: 15430 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] name: loading of page /home navigationStart: 1714043029280 networkTime: 804 requestErrorCount: 0 requestStart: 630 responseEnd: 852 responseStart: 678 serverTime: 48 speedIndex: 13866 startTime: 1714043029280 stringProperties: [ [+] ] targetUrl: xxx thirdPartyBusyTime: null thirdPartyResources: 0 totalBlockingTime: null type: Load userActionPropertyCount: 0 visuallyCompleteTime: 15416 } ] 2) Is it close to what I speculated? Further, you have never illustrated what is expected output. So, the two screenshots with only timestamps means nothing to volunteers. How can we help further? -Yes correct, it is relevant to the data what you predicted and here is the expected output _time                                      Application      Action                   Target_URL          Duration       User_Action_Type 2024-04-25 07:39:53     xxx                      loading /home    www.abc.com    0.26                Load 2024-04-25 06:25:50     abc                     loading /wcc/ui/ www.xyz.com   3.00                 Load 2024-04-24 19:00:57     xyz                     keypress  policy   www.bdc.com  3.00                 Load 2024-04-24 17:05:11     abc                    loading /home      www.xyz.com   0.53                 Xhr 2024-04-24 10:14:47     bcd                    loading /prod        www.rst.com     0.02                 Load 3) Specifically, WHY should the output NOT have multiple timestamps after deduping application, name and target url? - I could see multiple timesteps after dedup the application, name and target url. Here is the screenshot below and see the yellow highlighted.   4) In your original SPL, the only dedup is on x, which is Application+Action+Target_URL. How is this different?. My bad, here is the below correct SPL query that I tried. index="dynatrace" sourcetype="dynatrace:usersession" source=saas_prod events{}.application="participantmanagement.thehartford.com" userExperienceScore=FRUSTRATED | rename userActions{}.application as Application, userActions{}.name as Action, userActions{}.targetUrl as Target_URL, userActions{}.duration as Duration, userActions{}.type as User_Action_Type, userActions{}.apdexCategory as useractions_experience_score | eval x=mvzip(mvzip(Application,Action),Target_URL), y=mvzip(mvzip(Duration,User_Action_Type),useractions_experience_score) | mvexpand x | mvexpand y | eval x=split(x,","), y=split(y,",") | eval Application=mvindex(x,0), Action=mvindex(x,1), Target_URL=mvindex(x,2), Duration=mvindex(y,0), User_Action_Type=mvindex(y,1), useractions_experience_score=mvindex(y,2) | eval Duration_in_Mins=Duration/60000 | eval Duration_in_Mins=round(Duration_in_Mins,2) | table _time, Application, Action, Target_URL,Duration_in_Mins,User_Action_Type,useractions_experience_score | search useractions_experience_score=FRUSTRATED | sort - _time | dedup _time | search Application="*" | search Action="*" | fields - useractions_experience_score 5) Anything after mvexpand in my search is based on my reading of your intent based only on that complex SPL sample. Instead of making volunteers to read your mind, how about expressing the actual dataset, the result you are trying to get from the data, and the logic to derive the desired result and dataset in plain language (without SPL)? Here is the actual dataset below. 4/25/24 7:39:53.000 AM { [-] applicationType: WEB_APPLICATION bounce: true browserFamily: Microsoft Edge browserMajorVersion: Microsoft Edge 122 browserType: Desktop Browser clientType: Desktop Browser connectionType: UNKNOWN dateProperties: [ [+] ] displayResolution: HD doubleProperties: [ [+] ] duration: 15430 endReason: TIMEOUT endTime: 1714043044710 errors: [ [+] ] events: [ [-] { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /index.html pageGroup: /index.html startTime: 1714043029280 type: PageChange } { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /home pageGroup: /home pageReferrer: /index.html pageReferrerGroup: /index.html startTime: 1714043043405 type: PageChange } { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /employee/details pageGroup: /employee/details pageReferrer: /employee/coverage-list pageReferrerGroup: /employee/coverage-list startTime: 1714043088821 type: PageChange } { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /employee/coverage-list pageGroup: /employee/coverage-list pageReferrer: /employee/details pageReferrerGroup: /employee/details startTime: 1714043403199 type: PageChange } ] hasCrash: false hasError: false hasSessionReplay: false internalUserId: 17140430425327CQRENIQATV2OT5DV5BTJ2UB3MQF2ALH ip: 10.215.67.0 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] matchingConversionGoalsCount: 0 newUser: true numberOfRageClicks: 0 numberOfRageTaps: 0 osFamily: Windows osVersion: Windows 10 partNumber: 0 screenHeight: 720 screenOrientation: LANDSCAPE screenWidth: 1280 startTime: 1714043029280 stringProperties: [ [+] ] syntheticEvents: [ [+] ] tenantId: vhz76055 totalErrorCount: 0 totalLicenseCreditCount: 0 userActionCount: 1 userActions: [ [-] { [-] apdexCategory: FRUSTRATED application: xxx cdnBusyTime: null cdnResources: 0 cumulativeLayoutShift: 0.0006 customErrorCount: 0 dateProperties: [ [+] ] documentInteractiveTime: 13175 domCompleteTime: 15421 domContentLoadedTime: 14261 domain: xxx doubleProperties: [ [+] ] duration: 15430 endTime: 1714043044710 firstInputDelay: 1 firstPartyBusyTime: null firstPartyResources: 0 frontendTime: 14578 internalApplicationId: APPLICATION-B9BADE8D75A35E32 internalKeyUserActionId: APPLICATION_METHOD-E3EF5284923A6BA3 javascriptErrorCount: 0 keyUserAction: true largestContentfulPaint: 15423 loadEventEnd: 15430 loadEventStart: 15430 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] name: loading of page /home navigationStart: 1714043029280 networkTime: 804 requestErrorCount: 0 requestStart: 630 responseEnd: 852 responseStart: 678 serverTime: 48 speedIndex: 13866 startTime: 1714043029280 stringProperties: [ [+] ] targetUrl: xxx thirdPartyBusyTime: null thirdPartyResources: 0 totalBlockingTime: null type: Load userActionPropertyCount: 0 visuallyCompleteTime: 15416 } ] userExperienceScore: FRUSTRATED userSessionId: UEFUBRDAPRDHURTCPUKFKKPJVORTPPJA-0 userType: REAL_USER   ... View more

Hi @yuanliu , Thanks much for your response. I tried the SPL query which you shared. If I dedup only application, name and target url, then I could see duplicates in _time field (Refer screenshot 1) and here is the real data's timestamp in screenshot 2 which inturn gives us the incorrect count between the query output (count 😎 and the real data logs (count 12) Screenshot1    Screenshot2:   ... View more

Hi @PickleRick  Not sure If I explained my requirements in a right way. I would like to expand the multiple values present in the each row to separate rows which is having only the "Frustated" related details like the below expected output   Expected output URL Duration  Type Status www.cde.com 88647 Load Frustated www.fge.com 6265 Load Frustated www.abc.com 500 Load Frustated ... View more

Hi @KendallW @bowesmana , Can I share you the raw data to go with the search? Please let me know. ... View more

Can someone assist on this request please? Thank you. ... View more

Hi @ITWhisperer , Could you please provide an update on this request? Thank you, ... View more

@ITWhisperer  Here is the source code of trellis single value visualization {     "type": "splunk.singlevalue",     "options": {         "numberPrecision": 0,         "sparklineDisplay": "below",         "trendDisplay": "absolute",         "unitPosition": "after",         "shouldUseThousandSeparators": true,         "trellisMinColumnWidth": 120,         "trellisRowHeight": 68,         "majorValue": "> sparklineValues | lastPoint()",         "trendValue": "> sparklineValues | delta(-2)",         "sparklineValues": "> primary | seriesByName('Number of Scenarios')",         "trellisSplitBy": "Page",         "splitByLayout": "trellis",         "trellisPageCount": 1000,         "backgroundColor": "#d41f1f",         "majorColor": "#FAF9F6",         "trellisBackgroundColor": "#FAF9F6"     },     "context": {         "convertedColorRange": [             {                 "from": 100,                 "value": "#dc4e41"             },             {                 "from": 70,                 "to": 100,                 "value": "#f1813f"             },             {                 "from": 30,                 "to": 70,                 "value": "#f8be34"             },             {                 "from": 0,                 "to": 30,                 "value": "#0877a6"             },             {                 "to": 0,                 "value": "#53a051"             }         ]     },     "dataSources": {         "primary": "ds_P7P9WCoL_ds_TheWXmJx_ds_ionW1KZM"     },     "eventHandlers": [         {             "type": "drilldown.linkToDashboard",             "options": {                 "app": "search",                 "dashboard": "reliability_layer_3_insight_application_dashboard__thaa_proper",                 "newTab": true,                 "tokens": []             }         },         {             "type": "drilldown.setToken",             "options": {                 "tokens": [                     {                         "token": "stepTok",                         "key": "trellis.value"                     }                 ]             }         }     ],     "showProgressBar": false,     "showLastUpdated": false,     "hideWhenNoData": false }   Here is the datasource used for the this visualization.   index="xxx" appID="APP-xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=PASSED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | eval Page=upper(Page) | stats count(scenario) as "Number of Scenarios" by Page | sort - "Number of Scenarios" ... View more

Hi @ITWhisperer , Source code has huge lines so I am unable to paste it or attach as a file. Kindly advise. ... View more

Here is the source code for destination dashboard { "dataSources": { "ds_PxUp5pVa": { "type": "ds.search", "options": { "query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"$scenariosTok$\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| rex field=stepName \"\\:(?P<action>.*)\"\r\n| search Page=\"$stepTok$\"\r\n| eval Page=upper(Page)\r\n| stats list(action) as Actions by Page,scenario,error_log\r\n| rename Page as \"Page(Step)\",scenario as Scenarios,error_log as \"Exceptions\"\r\n| table Page(Step),Scenarios,Actions,Exceptions", "queryParameters": {} }, "name": "APP-xxx_THAAProperxxx_regressionactions" }, "ds_GTBvsceW": { "type": "ds.search", "options": { "query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search scenario=\"$scenariosTok$\" \r\n| stats count by Page" }, "name": "steps" }, "ds_0peRb3iY": { "type": "ds.search", "options": { "query": "index=\"xxx\" appID=\"APP-xxx\" environment=xxx tags=\"*Parm*\" OR \"*Batch*\" stepName=\"*\" scenario=\"*\" status=FAILED\r\n| rex field=stepName \"^(?<Page>[^\\:]+)\"\r\n| rex field=stepName \"^\\'(?<Page>[^\\'\\:]+)\"\r\n| search Page=\"$stepTok$\"\r\n| stats count by scenario", "queryParameters": {} }, "name": "Scenarios" } }, "visualizations": { "viz_Qido8tOl": { "type": "splunk.table", "options": { "count": 100, "dataOverlayMode": "none", "drilldown": "none", "showInternalFields": false, "backgroundColor": "#FAF9F6", "tableFormat": { "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)", "headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)", "rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)", "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)" } }, "dataSources": { "primary": "ds_PxUp5pVa" }, "title": "Regression Results with Actions & Error Details" }, "viz_wtfZ8Urm": { "type": "splunk.markdown", "options": { "markdown": "***xxx***", "fontColor": "#FAF9F6", "fontSize": "custom", "customFontSize": 34, "fontFamily": "Arial" } }, "viz_wkircOE3": { "type": "splunk.rectangle", "options": { "fillColor": "#FAF9F6", "strokeColor": "#000000" } }, "viz_KR6lYV6G": { "type": "splunk.rectangle", "options": { "fillColor": "#FAF9F6" } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-7d@h,now" }, "title": "Global Time Range" }, "input_7pdCBCBD": { "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "defaultValue": "*", "token": "scenariosTok" }, "title": "Scenarios", "type": "input.dropdown", "dataSources": { "primary": "ds_0peRb3iY" }, "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"scenario\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"scenario\") | renameSeries(\"value\") | formatByType(formattedConfig)" } }, "input_mv3itLP9": { "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "defaultValue": "*", "token": "stepTok" }, "title": "Page(Steps)", "type": "input.dropdown", "dataSources": { "primary": "ds_GTBvsceW" }, "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"Page\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"Page\") | renameSeries(\"value\") | formatByType(formattedConfig)" } } }, "layout": { "type": "absolute", "options": { "width": 2000, "height": 2500, "display": "auto", "backgroundColor": "#294e70" }, "structure": [ { "item": "viz_wkircOE3", "type": "block", "position": { "x": 10, "y": 50, "w": 1980, "h": 1810 } }, { "item": "viz_wtfZ8Urm", "type": "block", "position": { "x": 10, "y": 10, "w": 1580, "h": 50 } }, { "item": "viz_KR6lYV6G", "type": "block", "position": { "x": 20, "y": 60, "w": 1950, "h": 510 } }, { "item": "viz_Qido8tOl", "type": "block", "position": { "x": 30, "y": 70, "w": 1930, "h": 490 } } ], "globalInputs": [ "input_global_trp", "input_7pdCBCBD", "input_mv3itLP9" ] }, "title": "xxx", "description": "", "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" }, "refreshType": "delay", "refresh": "5m" } } } } } ... View more

@ITWhisperer , Here is the Data source for the source dashboard. index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | eval Page=upper(Page) | stats count(scenario) as "Number of Scenarios" by Page | sort - "Number of Scenarios"   Here is the Data source for the destination dashboard. index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="$scenariosTok$" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | rex field=stepName "\:(?P<action>.*)" | search Page="$stepTok$" | eval Page=upper(Page) | stats list(action) as Actions by Page,scenario,error_log | rename Page as "Page(Step)",scenario as Scenarios,error_log as "Exceptions" | table Page(Step),Scenarios,Actions,Exceptions   Finally, Here are the data sources for the two drop downs added in the destination dashboard. Scenarios dropdown index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" scenario="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | search Page="$stepTok$" | stats count by scenario   Page dropdown index="xxx" appID="xxx" environment=xxx tags="*Parm*" OR "*Batch*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | search scenario="$scenariosTok$" | stats count by Page     ... View more

Hi @ITWhisperer , I tried the token, but it is not working as expected. Could you please assist on this?   Here is the redirection destination dashboard below.     ... View more

Hi, Thank you for the prompt response. Trellis layout can be one of the options. However, for example, If I click on DB, then it should redirect to the separate visualization where we need to view the in-depth details only for DB and not for MEMBERDASHBOARD or TASKEDIT. Is it possible, please let me know.    ... View more

Hi, Here is the query and the results. Visualization panels should get created/deleted automatically depends on the rows under the Page column.   index="*" appID="*" environment=* tags="*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | rex field=stepName "\:(?P<action>.*)" | eval Page=lower(Page) | stats count(scenario) as "Number of Scenarios" by Page | table Page, "Number of Scenarios"   I created the created single value visualization panel manually based on the rows, but if the rows are decreased dynamically, I could see N/A in most of the visualization panels. So, auto-scaling of visualization panel is needed in this scenario.     ... View more