Activity Feed
- Posted Re: Timechart: How to show "0"when no results found on Splunk Search. 12-10-2020 03:51 AM
- Posted Timechart: How to show "0"when no results found on Splunk Search. 12-08-2020 08:16 AM
- Posted How to sum two timecharts in another one. on Splunk Search. 11-15-2020 02:16 AM
- Posted Re: Metasearch and Rawdata is required... on Splunk Search. 12-28-2019 09:03 AM
- Posted Metasearch and Rawdata is required... on Splunk Search. 12-25-2019 06:20 AM
- Tagged Metasearch and Rawdata is required... on Splunk Search. 12-25-2019 06:20 AM
- Tagged Metasearch and Rawdata is required... on Splunk Search. 12-25-2019 06:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-10-2020
03:51 AM
First solution work for me fine, thank you both for your help. BR
... View more
12-08-2020
08:16 AM
Hello, I'm try go get "0" in my result when there is no events. I get only "no result found". index=*mysearch | timechart count as count | accum count as count Any idea?
... View more
Labels
- Labels:
-
timechart
11-15-2020
02:16 AM
Hello, I tired to sum two timecharts in another one, using tokens. It's easy to sum counted value using stats, but I have problem with timecharts, is there any way to do this? <form>
<label>Single Value Token</label>
<fieldset submitButton="false">
<input type="time" token="tokTime" searchWhenChanged="true">
<label></label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Panel 1 (Error)</title>
<search>
<query>index=_internal sourcetype=splunkd log_level="Error"
| timechart count as Error</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
<done>
<condition match="$job.resultCount$==0">
<set token="tokError">0</set>
</condition>
<condition>
<set token="tokError">$result.Error$</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
<panel>
<single>
<title>Panel 2 (Warn)</title>
<search>
<done>
<condition match="$job.resultCount$==0">
<set token="tokWarn">0</set>
</condition>
<condition>
<set token="tokWarn">$result.Warn$</set>
</condition>
</done>
<query>index=_internal sourcetype=splunkd log_level="WARN"
| timechart count as Warn</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
<panel>
<single>
<title>Panel 3 (Sum)</title>
<search>
<query>| makeresults
| eval ratio=$tokError$+$tokWarn$
|table ratio
| timechart count as ratio</query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.000</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</form> Code give me value 1.000 in Panel 3 (Sum) Or there is another way to save trends?
... View more
12-28-2019
09:03 AM
Hi,
@kamlesh_vaghela
I tired on this way but its don't work.
When I used "Update" or "Microsoft" I can't find field named "Microsoft Update" im metasearch.
I use "*Update" don't work too.
@gcusello I can't explain, but I can find more than splunk doc say about metasearch.
I compare normal search and metasearch, and I have same results, mean time when something hapen.
But, I can't show on table more than fields like index, host, source, sourcetype like splunk doc say.
BR,
... View more
12-25-2019
06:20 AM
Hi,
I' cant end my search using metasearch when I need to find in index something with space betwen like "Microsoft Update". There is no problem to find there one word aplikaction like below:
|metasearch index=my_index ("onewordaplikaction")
When I try:
|metasearch index=my_index ("twoword aplikaction")
I get error:
Streamed search execute failed because: Error in 'metalitsearch' command: Invalid metasearch. Rawdata is required for this search..
Is there any way to find by metasearch something like "Microsoft Update" or "Update"? Or is just metasearch limit?
BR,
... View more
- Tags:
- metasearch
- rawdata
