About darkins

darkins · ‎12-13-2024

well it seems map command does work in my environment there is no relation between the two queries, to be more specific i have a full query that returns everything i need in named columns. i then want to use one of the fields from this query in the search paramaters for a second query and return the result as an additional column: Query 1 index=indexA source=/dir1/dir2/*/*/file.txt |rex field=source "\/dir1\/dir2\/(?<variableA>.+?(?=\/))\/(?<variableB>.+?(?=\/)).*" |table variableA, variableB this will give me 1000 events Query 2 index=indexA source=/dir1/dir2/$variableA$/$variableB$/file2.txt |rex field=_raw "(?<variableC>.+?(?=\/))*" this will give me one event i then want my table to be variableA, variableB, variableC where variableC is the same for each of the 1000 events returned from Query 1

darkins · ‎12-12-2024

so i have search a which creates a variable from the search results (variableA) i need to search another index using variableA in the source and want to append one column from the second search into a table with results from the first like this: index=blah source=blah | rex variableA=blah, field1=blah,field2=blah,field3=blah, index=blah source=$variableA$ | rex field4=blah table field1, field2, field3,field4 not sure how this gets done?

darkins · ‎11-27-2024

this is awesome, but is there a way to make the results columns (additional fields on my results)

darkins · ‎11-27-2024

fieldA:1:10 fieldB:1:3 fieldC:1:2 fieldA:1:10 fieldC:1:2 fieldA:1:10 fieldC:1:2 fieldC:1:1 I want to end up with a field called fieldA, fieldb, and fieldC where the field name is the actual text found in the string as i cant predict which event will contain which combination

darkins · ‎11-24-2024

i guess the key is i think i need to say that field2 equals everything up to an m PRECEDED by a space?

darkins · ‎11-24-2024

not sure what else to put, this is what my data looks like thisisfield1 thisisfield2 mynextfield3 thisisfield1 mynextfield3 i want these two lines to display as field1 field2 field3 thisisfield1 thisisfield2 mynextfield3 thisisfield1 mynextfield3

darkins · ‎11-23-2024

probably an easy one, i have two events as follows thisisfield1 thisisfield2 mynextfield3 thisisfield1 mynextfield3 meaning in some events field2 exists, in some it doesnt, when it does i want the value and when it doesnt i want it to be blank and all records have mynextfield3 and i always want that as field3 i want rex these lines and end up with field1 field2 field3 thisisfield1 thisisfield2 mynextfield3 thisisfield1 mynextfield3

darkins · ‎11-15-2024

what i want to say is: if _raw contains the word "Dog" then rex "(?<field1>([^\s]+))\s(?<field2>([^\s]+))\s(?<field3>([^\s]+))\s" if _raw contains the word "Cat" then rex "(?<field1>([^\|]+))\|(?<field2>([^\|]+))\|(?<field3>([^\|]+))\|" because if the line contians Dog, fields are delimited by spaces but if it contains Cat, fields are delimited by pipe symbol. I want the same field names just need to use a different rex based on delimiters. I cant formulate one rex that contains both delimiters

darkins · ‎11-15-2024

yeah i am getting syntax error Invalid Argument on rex

darkins · ‎10-21-2024

ok i get this, but little experience with rex and especially anchors is the anchor the word i am looking to match?

darkins · ‎10-18-2024

like in the subject, i am looking at events with different fields and delimeters i want to say if the event contains thisword then rex blah blah blah elseif the event contains thisotherword then rex blah blah blah i suspect this is simple but thought to ask

darkins · ‎10-08-2024

ok i think i have the formula worked out and now i can get my average and totals on one chart. i suspect, however, that you cant overlay a line chart on a stacked column chart as now that i am able to add my average to my stacked column, it appears, but appears as one of the stacked items in each column and not as a line as a line overlay (the large orange stacked counts are the average)

darkins · ‎10-08-2024

HaltedCyclesPerDayMA is computed in the eval line above as shown the query gives me a stacked column chart (stacked by cycle), i want the HaltedCyclesPerDayMA as a line overlay (showing the moving average on top of the raw data

darkins · ‎10-08-2024

i have this on other panels but cant get it on a stacked column chart | streamstats current=f last(Timestamp) as HaltedCycleLastTime by Cycle | eval HaltedCycleSecondsHalted=round(HaltedCycleLastTime - Timestamp,0) | eval HaltedCycleSecondsHalted=if(HaltedCycleSecondsHalted < 20,HaltedCycleSecondsHalted,0) | streamstats time_window=30d sum(HaltedCycleSecondsHalted) as HaltedCycleSecondsPerDayMA | eval HaltedCycleSecondsPerDayMA=round(HaltedCycleSecondsPerDayMA,0) | chart sum(HaltedCycleSecondsHalted) as HaltedSecondsPerDayPerCycle by CycleDate Cycle limit=0 this produces a stacked column based on the chart command , but in dashboard studio i expect to see HaltedCycleSecondsPerDayMA as a pickable field and i dont. I added to code as overlayfields but still not showing.

darkins · ‎10-08-2024

i have created a stacked bar based on a data source (query) and everything works with the exception of: i have to select each data value to display when the query runs through Data Configuration - Y meaning all of my desired values show up there but they are not "selected" by default so the chart is blank until i select them?

darkins · ‎10-07-2024

ok this should work but one wrinkle, i want to do this on two fields meaning: these are my records Job1 10/4/2024 20241004 10/4/2024 0:38:27 Job1 10/4/2024 20241004 10/4/2024 0:38:41 Job 2 10/4/2024 20241004 10/4/2024 17:39:12 Job 2 10/4/2024 20241004 10/4/2024 17:39:24 Job 2 10/4/2024 20241004 10/4/2024 17:39:34 Job1 10/5/2024 20241004 10/4/2024 0:38:27 Job1 10/5/2024 20241004 10/4/2024 0:38:35 from this i want to be able to say: job1 took 14 seconds on 10/4/2024 and job 2 took 22 seconds on 10/4 job 1 took 8 seconds on 10/5

darkins · ‎10-05-2024

My query returns these events, i need to compute the total time A was in this state and total time B was in this state. My thought is to subtract the TImestamp of the first A from the most recent A and so on for B but cant figure out the right way to do this? Timestamp Job Date LoggedTime Ready 1728092168.000000 A 10/4/2024 21:36:03 1 1728092163.000000 A 10/4/2024 21:35:50 1 1728092150.000000 A 10/4/2024 21:35:27 1 1728092127.000000 A 10/4/2024 21:35:16 1 1728090335.000000 B 10/4/2024 21:05:15 2 1728090315.000000 B 10/4/2024 21:05:03 2 1728090303.000000 B 10/4/2024 21:04:53 2 1728090293.000000 B 10/4/2024 21:04:31 2

darkins · ‎10-04-2024

WINNER WINNER! Thank you very much!

darkins · ‎10-03-2024

not sure i can do that using a base query and then a chained query panel a gives me MA line | timechart count span=1d | streamstats time_window=30d avg(count) as A | eval A=round(A,0) Panel B gives me count by day bar | timechart span=1d count(B) by B

darkins · ‎10-03-2024

Using dashboard studio i have my data source for one panel then a chained datasource for another panel. The first panel is a barchart of counts by day, the second is a moving average. Trying to overlay the moving average on top of the barchart. Have done this in classic using overlays, but in studio dont know how to reference the chained datasource results in the first panel. For example my bar chart visualization code looks like this. In overlay fields i tried to explicitly reference the data source name but doesnt seem to work. i know both queries/data sources are working as my base search works and my chained search works when show in separate panels. { "type": "splunk.column", "dataSources": { "primary": "ds_C2wKdHsA" }, "title": "Per Day Count", "options": { "y": "> primary | frameBySeriesNames('NULL','_span','_spandays')", "legendTruncation": "ellipsisOff", "legendDisplay": "off", "xAxisTitleVisibility": "hide", "xAxisLabelRotation": -45, "yAxisTitleVisibility": "hide", "overlayFields": "$chaineddatasource_ByDayMA:result.gpsreHaltedJobsMA$", "axisY2.enabled": true, "dataValuesDisplay": "all" }, "showProgressBar": false, "showLastUpdated": false, "context": {} }

darkins · ‎10-01-2024

probably a basic question i have the following data 600 reason and this rex (?<MetricValue>([^\s))]+))(?<Reason>([^:|^R]+)) what i am getting is 60 in Metric Value and 0 in Reason i presume that is due to the match being up to the next NOT space, thus metric value is 60 and 0 remains in the data for Reason what is the right way to do this such that i get value = 600 and reason = reason

Posts	21
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-01-2024

Online Status	Offline
Date Last Visited	‎12-16-2024 01:48 PM

using search results as variable in another search

Split string into fields

rex help

if _raw contains X rex this elseif _raw contains y...

Moving Average Overlay on stacked column

Stacked Bar in Dashboard Studio

TIme difference between first and last

Multiple Data Sources for one panel in Dashboard S...

Regex Help

Re: using search results as variable in another se...

using search results as variable in another search

Re: Split string into fields

Split string into fields

Re: rex help

Re: rex help

rex help

Re: if _raw contains X rex this elseif _raw contai...

Re: if _raw contains X rex this elseif _raw contai...

Re: if _raw contains X rex this elseif _raw contai...

if _raw contains X rex this elseif _raw contains y...

Re: Stacked Bar in Dashboard Studio

Re: Moving Average Overlay on stacked column

Moving Average Overlay on stacked column

Stacked Bar in Dashboard Studio

Re: TIme difference between first and last

TIme difference between first and last

Re: Multiple Data Sources for one panel in Dashboa...

Re: Multiple Data Sources for one panel in Dashboa...

Multiple Data Sources for one panel in Dashboard S...

Regex Help

Join the Conversation