Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About feickertmd
feickertmd
Communicator
Member since:
11-08-2013
06-05-2020
Community Statistics
| Posts | 75 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 24 |
| Member Since | 11-08-2013 |
Activity Feed
- Got Karma for Re: Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-08-2023 01:56 PM
- Got Karma for How to change color or style of a single line in line graph. 02-28-2023 09:10 AM
- Got Karma for How to delete a lookup table file and definition?. 02-15-2022 07:46 AM
- Got Karma for Re: Is there a guide or map to understand Splunk's internal indexes and their log content?. 02-23-2021 12:39 PM
- Got Karma for Re: Is there a guide or map to understand Splunk's internal indexes and their log content?. 10-02-2020 12:03 AM
- Got Karma for Why are conditional tokens one change behind for time picker changes?. 06-05-2020 12:48 AM
- Got Karma for Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-05-2020 12:47 AM
- Got Karma for Can you use token values in HTML module for dashboards?. 06-05-2020 12:47 AM
- Got Karma for Re: stats list() command will not display items after fieldformat. How can I resolve it?. 06-05-2020 12:47 AM
- Got Karma for How to delete a lookup table file and definition?. 06-05-2020 12:47 AM
- Got Karma for Get Perfmon drive info for specific disks Splunk 6.1. 06-05-2020 12:47 AM
- Got Karma for Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-05-2020 12:47 AM
- Got Karma for Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-05-2020 12:47 AM
- Got Karma for Re: How to hide an HTML label from a dashboard when the token is not set?. 06-05-2020 12:47 AM
- Got Karma for Re: How to hide an HTML label from a dashboard when the token is not set?. 06-05-2020 12:47 AM
- Got Karma for How to hide an HTML label from a dashboard when the token is not set?. 06-05-2020 12:47 AM
- Got Karma for Re: Convert epoch time from drilldown parameter. 06-05-2020 12:47 AM
- Got Karma for How to drilldown from a timechart to another dashboard by clicking on the legend value?. 06-05-2020 12:47 AM
- Got Karma for How to drilldown from a timechart to another dashboard by clicking on the legend value?. 06-05-2020 12:47 AM
- Got Karma for Is the information in the search job inspector stored in Splunk internally so I can query this data and set up dashboards?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 |
06-01-2017
10:14 AM
Nope, that doesn't do it
... View more
05-30-2017
10:00 AM
I hereby announce my undying love for you and your queries!
Thanks a bunch.
... View more
05-30-2017
09:17 AM
I have a log for a documents database. It gives me a daily report of total documents in each collection (each collection and total is one event in the log).
The powers have asked that I show how many documents were added each day for yesterday's and today's totals. So basically, I need to gather and compute the following:
-2d@d -> collection=master doccount=1000
-1d@d -> collection=master doccount=1200 delta=200
@d -> -> collection=master doccount=1500 delta=300
and I need to do this per collection for about 50 collections.
I'm playing with some pretty complex evals, but I hope there is a simpler way
... View more
05-15-2017
08:15 AM
1 Karma
I am working with setting new tokens whenever my time picker is changed so that I can offer an appropriate set of timespans for a timeline. The code seems sound, but it has a weird nuance: the displayed tokens are for the previous choice made, not the current one.
Example:
Condition A is set so that less than 12 hours sets $tokenA$ while condition B says that between 12 hours and seven days sets $tokenB$.
If I choose condition A -> condition B ->condition A, then my current choice is condition A, but my current token is one behind ($tokenB$)
Closing and refreshing the browser does no good. it's like a token choice is stuck in memory somewhere.
Here is my code:
<panel>
<input type="time" token="api_time" searchWhenChanged="true">
<label>($api_time.latest$) - ($api_time.earliest$)</label>
<default>
<earliest>-7d@d</earliest>
<latest>@d</latest>
</default>
<change>
<!-- if time is less than 12 hours, show Hour, 15 Min, Min -->
<condition match="(relative_time(now(), $api_time.latest$) - relative_time(now(), $api_time.earliest$)) < 43201">
<set token="hour_top">12hour</set>
<unset token="7day_top"></unset>
<unset token="1month_top"></unset>
<unset token="gt_month"></unset>
<unset token="span"></unset>
</condition>
<!-- if time is between 12 hours and 7 days, show Day, Hour, 15 Min -->
<condition match="43200 < (relative_time(now(), $api_time.latest$) - relative_time(now(), $api_time.earliest$)) < 604801">
<set token="7day_top">7day</set>
<unset token="hour_top"></unset>
<unset token="1month_top"></unset>
<unset token="gt_month"></unset>
<unset token="span"></unset>
</condition>
...
</panel></row>
... View more
05-11-2017
07:02 AM
Turns out that the answer was right in the documentation the whole time! (http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/tokens#Define_conditional_matching). There is a sample of how to do condition based on duration.
Here is my new code:
<panel>
<input type="time" token="api_time" searchWhenChanged="true">
<label></label>
<default>
<earliest>-7d@d</earliest>
<latest>@d</latest>
</default>
<change>
<!-- if time is less than 12 hours, show Hour, 15 Min, Min -->
<condition match="relative_time(now(), $api_time.latest$) - relative_time(now(), $api_time.earliest$) < 43201">
<set token="hour_top">hour</set>
<unset token="show"></unset>
<set token="span">15m</set>
</condition>
<!-- if time is between 12 hours and 7 days, show Day, Hour, 15 Min -->
<condition match="43200 < relative_time(now(), $api_time.latest$) - relative_time(now(), $api_time.earliest$) < 604801">
<set token="show">show</set>
<unset token="hour_top"></unset>
<set token="span">1d</set>
</condition>
</change>
</input>
</panel>
... View more
05-10-2017
11:26 AM
Please provide examples. I am a neophyte to the conditionals, and I suspect that i am doing one of the hardest
... View more
05-10-2017
10:50 AM
I have a timechart on my dashboard. I want people to be able to pick any time for the history of data, but I do not want them to pick the wrong timespans (example: don't ask for 1 month of data at 15-min intervals).
How can I set conditional tokens based on the range of time picked? Can I just use
<condition match=latest-earliest < (some number of seconds for epoch time difference?)>
Thanks!
... View more
03-17-2017
11:03 AM
see my answer below
... View more
03-17-2017
11:03 AM
Here's an easy way!!
see for reference: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_properties
You need to set the token in the section and call the result there. Here's a sample:
<panel>
<title>Maximum API calls in one hour over last 7 days</title>
<single>
<title>Max hits for api: $max_api$</title>
<search>
<query>...</query>
...
<done>
<set token="max_api">$result.api$</set>
</done>
</search>
... View more
02-13-2017
08:37 AM
Thanks. I have played with my sample data a bit more, and I see it better. Like I said, not a stats guy, so I wasn't surprised to find I misunderstood.
... View more
02-13-2017
07:42 AM
I don't think I am looking for percentile. I am looking for frequency.
Take, for instance, this list of 30 values:
0 0 1 1 2 2 2 3 3 4 4 4 5 5 5 5 6 6 6 7 7 7 7 8 8 8 9 9 9 9
In this case, the 90th percentile is 9, but 90% of the values are <=7.
Looking for the second figure.
... View more
02-13-2017
07:12 AM
A requirement I have is to show API response times over time, marking min, max, avg and 90% range. In other words, be able to say "90% of response time are X milliseconds or lower.
Not sure how to approach it. Advice appreciated.
... View more
- Tags:
- splunk-enterprise
02-09-2017
07:47 AM
I have a stats table of max hits by API for a given time period.
index="ml_summary" report=api_stats earliest=-1w@w latest=now() | stats count as hit by date_minute, date_hour,date_mday,date_month,date_year, api| stats max(hit) as maxhit by api
This returns multiple lines, showing each api name and the max hits for that api.
How do I now reduce the results to a single line with the max hits from that set AND its associated api label?
... View more
01-20-2017
06:37 AM
The only flaw in your query is the filter of event_id. Just that param will remove every line without "[Event:id=API_Metrics]" from the results.
... View more
01-20-2017
05:51 AM
Yeah, would be nice, but that is not a viable option for me. I'm not allowed to have my finger in all the pots like I would like. May be better for me to just talk to our developers about making these kinds of log entries more compatible with current configurations.
... View more
01-19-2017
01:48 PM
I have data that looks like this:
2017-01-17 22:18:18.330 Info: [Event:id=API_Metrics] [===== STARTING /individual/preferences/v1.5, RAND=9296226956377273381, TS=14847130983159950
2017-01-17 22:18:18.330 Info: [Event:id=API_Metrics] [===== PARAMS FOR /individual/preferences/v1.5, RAND=9296226956377273381, TS=14847130983159950
2017-01-17 22:18:18.330 Info: policyNumber=####
2017-01-17 22:18:18.330 Info: dob=#####
2017-01-17 22:18:18.330 Info: fname=FFFFFFF
2017-01-17 22:18:18.330 Info: subscriberId=######
2017-01-17 22:18:18.330 Info: lname=LLLLL
2017-01-17 22:18:18.330 Info: =====]
****events that contain none of the above keys or information, just other text****
2017-01-17 22:18:23.092 Info: [Event:id=API_Metrics] [===== ENDING /individual/preferences/v1.5, RAND=9296226956377273381, TS=14847130983159950, TIME=PT4.762855S, CODE=200
The beginning and end of the transaction are clearly defined, but the events that come after PARAMS and before ENDING do not contain the values for usable grouping keys, like RAND or TS.
How can I write a search that will return the whole group from start to end? I tried this:
index="marklogic_datafabric" event_id=* | transaction event_id startswith=position=STARTING endswith=position=ENDING
...but it only returns the lines that have a "position" field, but not those that are in between.
2017-01-19 12:14:11.030 Info: [Event:id=API_Metrics] [===== STARTING /individuals/touchpoint/v1.0/search, RAND=2104724838533797466, TS=14848496416750860
2017-01-19 12:14:11.030 Info: [Event:id=API_Metrics] [===== PARAMS FOR /individuals/touchpoint/v1.0/search, RAND=2104724838533797466, TS=14848496416750860
2017-01-19 12:14:11.250 Info: [Event:id=API_Metrics] [===== ENDING /individuals/touchpoint/v1.0/search, RAND=2104724838533797466, TS=14848496416750860, TIME=PT0.220528S, CODE=200
Also, the time stamps are not all the same, so I unfortunately cannot work with that.
Suggestions, please!
... View more
01-04-2017
05:48 AM
I am certain that CSS will work, but was looking for other solutions due to admin limitations. Thanks!
... View more
12-30-2016
07:20 AM
Actually did this well before your comment. Changed axis labels and legend labels, but not values
... View more
12-30-2016
07:19 AM
Actually did this well before your comment. Changed axis labels and legend labels, but not values
... View more
12-29-2016
12:30 PM
This is the text I want to change. The options you mention only change the colors of the bars.
... View more
12-29-2016
10:19 AM
I have a bar chart created in the which I am showing data values above the bars. However, the tallest bar has the text inside of it, and the colors blend too much. In simple XML, can I change the color of the text to darken it?
... View more
Labels
- Labels:
-
chart
