About wessam

wessam · ‎06-28-2017

Is there any workaround for this bug instead of using fields - ? index=xx |eval records='y'|stats values(records) as records list(y) as records2 by date_month|dedup records |eval records_after_dedup=mvcount(records), records_all=mvcount(records2)|fields - records2 records as i would like to display graph which represents number of records after dedup and all records before dedup.

wessam · ‎06-28-2017

Is there any workaround for this bug instead of using fields - ? index=xx |eval records='y'|stats values(records) as records list(y) as records2 by date_month|dedup records |eval records_after_dedup=mvcount(records), records_all=mvcount(records2)|fields - records2 records as i would like to display graph which represents number of records after dedup and all records before dedup.

wessam · ‎06-28-2017

the same issue happened Is there any workaround for this bug instead of using fields - ? index=xx |eval records='y'|stats values(records) as records list(y) as records2 by date_month|dedup records |eval records_after_dedup=mvcount(records), records_all=mvcount(records2)|fields - records2 records as i would like to display graph which represents number of records after dedup and all records before dedup.

wessam · ‎06-14-2017

<search> <query>..... |fields - records2,records</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">Number of Tickets</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option>

wessam · ‎06-14-2017

Splunk Version 6.5.1 and i am using IE11

wessam · ‎06-14-2017

i mean that after the query in generated , i am just saving it into a dashboard and after opening this dashboard several times . whitespace in query is removed so that's weird as i have only saved the query

wessam · ‎06-14-2017

I am facing an issue with fields command as i am generating splunk queries below .....)|fields - records2,records and it working fine , however after automating this query on dashboard and running it several times , query is changed and became .....)|fields-records2,records Which gives an error because there is no spaces between characters !! So did anyone face the same issue and could you please help me with a workarround or solution

wessam · ‎06-13-2017

Hello all , I need your help as i have list of tickets called "Tickets" and i would like to generate a graph where the x -axis represent number of times the ticket was assigned and Y-axis represent number of tickets for Ex : Tickets AB111 AB111 AB122 AB910 AB122 so i would like to get the below results Number of times Tickets_numbers 1 1 2 2 3 0 which illustrate that only one ticket was assigned one time however we had 2 tickets that was assigned two times and no tickets was assigned three times Thanks

wessam · ‎06-09-2017

Dears, I have two columns , first one is called ticket and second columns is date as below Ticket date AS123 6/6/2017 12:12:12 AS345 1/6/29017 11:10:12 AS564 2/6/2017 9:0:10 I would like to draw a graph where the x-axis display number of days from 1 to 31 and Y-axis represent number of tickets per each day i have generate the below query : index=xxx source=yyy |table "ticket","date" | eval fields=split('date',"/") |eval num=mvindex(fields,0)| table "ticket","num" |chart count by num but the problem is in the x-axis as it displayed only days where there is a ticket only , it doesn't mention for example that at 3rd of June there wasn't any tickets as below num count 1 1 2 1 6 1 What i would like to get 1 1 2 1 3 0 6 0 5 0 6 1

wessam · ‎06-08-2017

it works 🙂 Thanks for your help

wessam · ‎06-08-2017

it works ,much appreciated Thanks but it displayed also records_dedup and records in chart

wessam · ‎06-08-2017

i would like to display a graph that represent number of records_dedup and number of records over month

wessam · ‎06-08-2017

Thanks it works 🙂 eval records_dedup='records'|stats values(records) as records list(records_dedup) as records_dedup| dedup records_dedup | table records_dedup,records Now it displayed two columns first one records_Dedup where records exist after removing duplicates and second column "records" where all records exist i am trying now to display both of them using chart for specific month | chart count over "date_month" by "records,records_dedup" but now data is found 😞

wessam · ‎06-08-2017

when i write |eval records_after_dedup=records it won't copy all records , it will only add new column called "records_after_dedup" where the name records is written as below records_after_dedup records records records records ...

wessam · ‎06-07-2017

unfortunately it didn't work properly index=xxx source="yyy.csv" |table records | appendcols [ index=xxx source="yyy.csv" | dedup records|rename records as records_after_dedup ] it displayed all the records !

wessam · ‎06-07-2017

Sorry i think there is misunderstanding , i am not asking to remove duplicates for lower and upper case or to ignore them , I am only asking to remove duplicates : for Ex : 100 50 20 50 100 the above column contains all the record , i would like to have two columns first one "Records" for all the records and the second one "Records after dedup" for records after removing duplicate to be as below Records : 100 50 20 50 100 Records after dedup 100 50 20 Hope you get my point 🙂

wessam · ‎06-07-2017

yes, i just need to have two columns the first one includes all the records and second one include the records after removing duplicates

wessam · ‎06-07-2017

Hello All, I have a column list of records as below recordA recordB recordA RecordB RecordC RecordD and I would like to remove duplicate and copy them in another column to have finally a column for all records (records) and second record for records after dedup (record_after_dedup) I tried to use eval with dedup but it doesn't work eval record_after_dedup=dedup(records)

Posts	18
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎06-07-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk Bug "fields command"

generate a graph where the x -axis represent numbe...

how to correct/modify x-axis

Copy Field and remove duplicate

Re: Splunk Bug "fields command"

Re: Splunk Bug "fields command"

Re: Splunk Bug "fields command"

Re: Splunk Bug "fields command"

Re: Splunk Bug "fields command"

Re: Splunk Bug "fields command"

Splunk Bug "fields command"

generate a graph where the x -axis represent numbe...

how to correct/modify x-axis

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Re: Copy Field and remove duplicate

Copy Field and remove duplicate