About anooshac

anooshac · ‎09-22-2025

Hi All, i have some table which have 2 columns, in that one column consists of date. I want to color the date column such that if the date is today or yesterday the color should be green, and if the date is older that yesterday it should be red. Anyone has idea how to achieve this? This is the query im using. index="abc" sourcetype="xyz"| stats latest(_time) as last_ingestion_time by group | eval last_ingestion_time=strftime(last_ingestion_time, "%Y-%m-%d %H:%M:%S") | sort - last_ingestion_time| head 10

anooshac · ‎02-20-2025

hi @livehybrid , Thanks for the reply, Is there any way that i can schedule this export? Since ii have a tool which is scheduled to run every 1 hour.

anooshac · ‎02-20-2025

hi @kiran_panchavat , thanks for the reply. Is it possible to automate this process? as i have a tool which is scheduled to run every 1 hour. So for every 1 hour the data needs to be imported.

anooshac · ‎02-19-2025

Hi All, I want to download a search result as csv file into my local folder. Can anyone suggest me some good methods to do it and how can i do it? I saw some examples using curl command and rest api, but couldn't able to understand that fully. can anyone help me in this?

anooshac · ‎12-19-2024

I am using same index for both stats disctinctcount and timechart distinctcount. But the results from timechart is always high. Anyone knows the reason behind it and how to resolve this? Also i have tried with bucket span and plotted the time chart. But the results were not matching with stats distinctcount. Please help.

anooshac · ‎12-11-2024

@bowesmana, thanks for the reply. It is working perfectly fine. I missed the html part for hiding the multivalue. Thank you so much !

anooshac · ‎12-11-2024

Hi All, I have few columns with is in the format "21 (31%)" , these are the value and percentage of the value. I want to use MinMidMax for the coloring based on the percentage. But i am not able to use it directly since it is a customized value. Any one knows any solution for coloring such columns?

anooshac · ‎12-02-2024

Hi all, I have 2 events present in a source type, with different data. There is one field which has same data in both the events but the field names are different. Can anyone suggest a method other than JOIN to combine 2 events? I tried combining the fields by coalesce command, once i combine them i was not able to see the combined fields. I want to combine the events and do some calculations.

anooshac · ‎11-22-2024

Hi, @ITWhisperer , actually it is not subset. its just that im passing different token for taskand getting the 2nd table. In this case will coalesce will work? index=abc task="$task1$"|dedup component1 |table component1 |append [index=abc task="$task2$" |dedup component2 |table component2] |table component1 component2

anooshac · ‎11-22-2024

Hi All, How can i find the difference between 2 tables?. index=abc task="task1"|dedup component1 |table component1 |append [index=abc task="task2" |dedup component2 |table component2] |table component1 component2 these are the 2 tables. I want to show the extra data which are in component2 and not in component1. How can i do it?

anooshac · ‎10-15-2024

Hi, @ITWhisperer The events are like below. { "MetaData": { "JENKINS_URL": "https://abc.com", "stagename": "ABC_CT", "variantname": "NEW_ABC", "jobname": "abc", "buildnumber": 29, "filename": "1729005933566.json" }, "suite": { "hostname": "localhost", "failures": 0, "package": "ABC", "tests": 0, "name": "ABC_test", "id": 0, "time": 0, "errors": 0, "case": [ { "classname": "xyz", "name": "foo1", "time": 0, "status": "Passed" }, { "classname": "pqr", "name": "foo2", "time": 0, "status": "Passed" }, ........ ] } } there will be so many events like this for a single project and the values will be repeated in those events. Like suite, case will be repeated. index=... sourcetype=... |spath ... | stats count(eval(Status="Execution Failed" OR Status="case_Failed")) AS Failed_cases, count(eval(Status="Passed")) AS Passed_cases, count(eval(Status="Failed" OR Status="case_Error")) AS Execution_Failed_cases, dc(case) as Total_cases dc(suite) as "Total suite" by Job_Name Build_Variant Jenkins_Server I use spath to get every parameter, then i use them in the query.

anooshac · ‎10-15-2024

I have JSON data which are multivalued. I want to create a overview table of the counts. { "suite": [ { "hostname": "localhost", "failures": 0, "package": "ABC", "tests": 0, "name": "ABC_test", "id": 0, "time": 0, "errors": 0, "testcase": [ { "classname": "xyz", "name": "foo1", "time": 0, "status": "Passed" }, { "classname": "pqr", "name": "foo2", "time": 0, "status": "Passed" }, . . . ] } ] } This is the data. For a given project there'll be many JSON files like above. So i want to get the unique data while taking the counts. Tried with mvdedup, it did not work. |spath output=jenkins_url path=JenkinsMetaData.JENKINS_URL | spath output=suite path=suite{}.name | spath output=case path=suite{}.case{}.name | spath output=Build_Num path=JenkinsMetaData.buildnumber | spath output=Status path=suite{}.case{}.status | fields - _raw | eventstats max(Build_Num) as Latest_Build by Job_Name | where Latest_Build=Build_Num | stats values(Build_Num) as Build_Num count(eval(Status="Execution Failed" OR Status="Testcase_Failed")) AS Failed_cases, count(eval(Status="Passed")) AS Passed_cases, count(eval(Status="Failed" OR Status="Testcase_Error")) AS Execution_Failed_cases, dc(case) as Total_cases dc(suite) as "Total suite" by Job_Name Build_Variant Jenkins_Server When i do this Total_cases and Total suite are are correct, but other values are not correct. But when i use |Status="Passed"| stats dc(case) as Passed_cases for one project, im getting correct value. But my requirement is to create a table for all the projects. Anyone know how to handle this?

anooshac · ‎10-07-2024

Hi, @PickleRick , | spath output=suite path=suite{}.name | spath output=Testcase path=suite{}.testcase{}.name | spath output=Status path=suite{}.testcase{}.status|table suite Testcase Status I wrote a query like this. but the problem here is in a single row multiple values will come. I want to break these value and print them in different row. Any optionnother than mvexpand?

anooshac · ‎10-07-2024

Hi, @ITWhisperer if mvexoand is used the results are truncated and i get a warning message. Any other alternative to mvexpand command is available?

anooshac · ‎10-07-2024

{ "suite": [ { "hostname": "localhost", "failures": 0, "package": "ABC", "tests": 0, "name": "ABC_test", "id": 0, "time": 0, "errors": 0, "testcase": [ { "classname": "xyz", "name": "foo1", "time": 0, "status": "Passed" }, { "classname": "pqr", "name": "foo2", "time": 0, "status": "Passed" }, . . . ] } ] } Hi, @ITWhisperer ,Sorry for that, here is the correct formatted JSON data.

anooshac · ‎10-07-2024

I have a JSON data like this. "suite":[{"hostname":"localhost","failures":0,"package":"ABC","tests":0,"name":"ABC_test","id":0,"time":0,"errors":0,"testcase":[{"classname":"xyz","name":"foo1","time":0,"status":"Passed"},{"classname":"pqr","name":"foo2)","time":0,"status":"Passed"},.... I want to create a table with Suite testcase_name and Testcase_status as columns. I have a solution using mvexpand command. But when there is large data output gets truncated using mvexpand command. ....| spath output=suite path=suite{}.name | spath output=Testcase path=suite{}.testcase{}.name| spath output=Error path=suite{}.testcase{}.error | spath output=Status path=suite{}.testcase{}.status|search (suite="*") | eval x=mvzip(Testcase,Status) | mvexpand x|eval y=split(x,",")|eval Testcase=mvindex(y,0) | search Testcase IN ("***") | eval suite=mvdedup(suite) |eval Status=mvindex(y,1) |table "Suite" "TestCase" Status This is the query im using. But the results gets truncated. Is there any alternative for mvexpand so that i can edit the above query ?

anooshac · ‎09-19-2024

After debugging in so many ways found out that a field im using in the query does not include empty values of the field while "All" is selected. Do you know how can i include empty values also when "All" is selected in multiselect dropdown?

anooshac · ‎09-18-2024

Hi, @yuanliu , the macro is shared in app, and i don't use any lookup files in the macro. I use join in the macro to get the data from 3 different source types. Is the join causing the issue?

anooshac · ‎09-18-2024

Hi All, I have written a macro to get a field. It has 3 joins. When i used the macro in dashboard , in a base search, it is not working properly and gives very less results. But when i use the macro in search bar it gives correct results. Does anyone know how can i solve this?

anooshac · ‎09-17-2024

This solution is working and im not seeing any warning message now. How is this different from mvzip? May i know why mvzip gives warning if the data is empty?

anooshac · ‎09-17-2024

ResourceInfo: { ID: "58", User: "abc", NVM: { a: "522523632", b: "80000000", c: "442523632", d: "14", . . }, RAM: { [+] }, ROM: { [+] } } and for RAM ROM and NVM i want to get the specific data inside them. component Value a 522523632 b 80000000 c 442523632 d 14 . . . I want to form a table like this for RAM ROM and NVM. And i do it like this. But sometimes i get a error message like field tmp does not exist, even there is data. So i want to avoid mvzip and get this data in some other way. is there way present to deal with JSON data? | spath output=RAM ResourceInfo.RAM | rex field=RAM max_match=0 "\"(?<component>[^\"]+)\":(?<Value>[\d\.]+)" | eval tmp = mvzip(component,Value) | mvexpand tmp | eval component=mvindex(split(tmp,","),0) | eval Value=mvindex(split(tmp,","),1) |table component Value

anooshac · ‎09-16-2024

Hi All, i am using mvzip while working with JSON file. Now in the new Splunk dashboards seems like mvzip command is depricated. Is there any way to extract values from nested JSON apart from mvzip?

anooshac · ‎06-03-2024

Hi @kamlesh_vaghela , tried this but the dashboard width isn't changing.

anooshac · ‎06-02-2024

@ITWhisperer,so there is no solution for changing width?

anooshac · ‎05-30-2024

Hi All, i am trying reduce the width of 2nd and 3rd column of a table since some of the cell has big sentence and it occupies too much space. i tried referring an example like below. <row> <panel> <html depends="$alwaysHideCSSPanel$"> <style> #tableColumWidth table thead tr th:nth-child(2), #tableColumWidth table thead tr th:nth-child(3){ width: 10% !important; overflow-wrap: anywhere !important; } </style> </html> <table id="tableColumWidth"> But i am not able to change the width using this. Any corrections needed in above html?

Posts	308
Solutions	2
Karma Given	10
Karma Received	1
Member Since	‎11-26-2019

Online Status	Offline
Date Last Visited	‎09-22-2025 12:48 AM

How to color a date column based on some condition...

How to download the result of a search in csv usin...

timechart count and stats count are not matching

how to color a column with custome value?

Combine 2 events by a matching field without using...

Find the difference between 2 tables.

How to calculate the count of a field for multival...

Create a table with Json data

Macro not working while used in dashboard, while i...

what is the alternative command to use for mvzip?

How to color a date column based on some condition...

Re: How to download the result of a search in csv ...

Re: How to download the result of a search in csv ...

How to download the result of a search in csv usin...

timechart count and stats count are not matching

Re: how to color a column with custome value?

how to color a column with custome value?

Combine 2 events by a matching field without using...

Re: Find the difference between 2 tables.

Find the difference between 2 tables.

Re: How to calculate the count of a field for mult...

How to calculate the count of a field for multival...

Re: Create a table with Json data

Re: Create a table with Json data

Re: Create a table with Json data

Create a table with Json data

Re: Macro not working while used in dashboard, whi...

Re: Macro not working while used in dashboard, whi...

Macro not working while used in dashboard, while i...

Re: what is the alternative command to use for mvz...

Re: what is the alternative command to use for mvz...

what is the alternative command to use for mvzip?

Re: how to change the width of a column in a table...

Re: how to change the width of a column in a table...

how to change the width of a column in a table?

Join the Conversation