Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kwestlake
kwestlake
Engager
Member since:
04-07-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 04-07-2020 |
Activity Feed
- Posted Status Indicator - Is there anyway to output trellis vertically? on All Apps and Add-ons. 01-25-2021 03:26 AM
- Karma Re: Help optimising a query for to4kawa. 06-05-2020 12:51 AM
- Posted Re: Getting Time token value in JS to use in Drill-Down with Status Indicator Viz... on Dashboards & Visualizations. 04-14-2020 11:21 AM
- Posted Getting Time token value in JS to use in Drill-Down with Status Indicator Viz... on Dashboards & Visualizations. 04-14-2020 10:54 AM
- Tagged Getting Time token value in JS to use in Drill-Down with Status Indicator Viz... on Dashboards & Visualizations. 04-14-2020 10:54 AM
- Tagged Getting Time token value in JS to use in Drill-Down with Status Indicator Viz... on Dashboards & Visualizations. 04-14-2020 10:54 AM
- Tagged Getting Time token value in JS to use in Drill-Down with Status Indicator Viz... on Dashboards & Visualizations. 04-14-2020 10:54 AM
- Posted Re: Help optimising a query on Splunk Search. 04-14-2020 06:09 AM
- Posted Help optimising a query on Splunk Search. 04-07-2020 06:25 PM
- Tagged Help optimising a query on Splunk Search. 04-07-2020 06:25 PM
- Tagged Help optimising a query on Splunk Search. 04-07-2020 06:25 PM
- Tagged Help optimising a query on Splunk Search. 04-07-2020 06:25 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
01-25-2021
03:26 AM
Hi All I've been putting together a demo-dashboard as part of a blog-post I'm writing, showing how to use Elastic Beat (Heatbeat and Metricbeat) agents with Splunk. Currently this shows how many apps are up/down, how many VMs are up/down etc, this main relies upon the Status Indicator viz. But I'm wondering, if anybody could assist with some styling. By default Status Indicator outputs as follows: Default style I'm looking to present it stacked, like this: Is this possible? This is was butchered together using paint, but hopefully it gives the idea. I'd have several of these in a row (Apps, VM's, Network Interfaces, APs etc). The dashboard viz code is as follows: <viz id="app_panel" type="status_indicator_app.status_indicator">
<title>APPLICATIONS:</title>
<search>
<query>`beats_http_icmp_macro`
| where monitor_tags in ("app", "media")
| stats latest(monitor_name) as name
latest(monitor_status) as status
BY monitor_name, monitor_type
| stats count(name) as " UP"
sum(eval(if(status=="down",1,0))) as " DOWN"
| eval fn = "value"
| transpose column_name="category" header_field=fn
| eval color = if(category==" UP", "#006d9c", "#dc4e41")
| eval icon = if(category==" UP", "cloud", "times-circle")
| sort category
| stats last(value) as value last(icon) as icon last(color) as color by category</query>
<earliest>$time_field.earliest$</earliest>
<latest>$time_field.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">144</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
<option name="status_indicator_app.status_indicator.fixIcon">cloud</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">small</option>
<option name="trellis.splitBy">category</option>
</viz> Many Thanks
... View more
Labels
- Labels:
-
other
04-14-2020
11:21 AM
Thank you.. Also, I discovered I was addressing the tokens wrong. I dumped the objects out to the browser console, and found the correct paths. Using the following its now working:
var defaultTokenModel = splunkjs.mvc.Components.getInstance("submitted");
// Get some token from there
var time_token = defaultTokenModel.get("form.time_field.earliest");
Also I believe time_field.earliest would also do - Basically I was mis-understanding the value returned by Get(), I thought it was an object, in fact, the tokens seem to be stored in a named list.
... View more
04-14-2020
10:54 AM
Hi All
I was wondering if any kind soul could point me in the right direction with this.
I recently put together a jazzy looking dashboard using the Status Indicator Visualization, unfortunately though, it has no built-in drill down capabilities. So the hack others on this forum use is open a pop-up when the panel is clicked using JS. I've got this bit working, for the life of me, I can't figure out how to get the filter values/tokens from the current dashboard to pass onto the pop-up URL.
I've hacked together the following script using examples on the forum and the Splunk dev docs:
// Components to require
var components = [
"splunkjs/ready!",
"splunkjs/mvc/simplexml/ready!",
"jquery"
];
// Require the components
require(components, function(
mvc,
ignored,
$
) {
$('#something').click(function() {
// Get the default model
var defaultTokenModel = splunkjs.mvc.Components.getInstance("default");
// Get some token from there
var time_token = defaultTokenModel.get("time_field");
// Other method from doc
//var tokens = mvc.Components.get("default");
//var time_token = tokens.get("time_field");
window.open(
'drilldown_report?earliest=' + time_token.earliest,
'_blank' // <- This is what makes it open in a new window.
);
});
});
I tried 2 methods of getting the Time token, using "Components.getInstance()" and "Components.get()", in addition tried looking for the token name of "time_field" and "form.time_field", the actual parent-dashboard URL is:
https://splunk.myhome.uk:8000/en-GB/app/search/my-core/edit?form.time_field.earliest=-24h%40h&form.time_field.latest=now
but all I ever get back is
VM3277:30 Uncaught TypeError: Cannot read property '**earliest**' of undefined
at HTMLDivElement.eval (eval at globalEval (common.js:1003), <anonymous>:30:61)
at HTMLDivElement.dispatch (common.js:1014)
at HTMLDivElement.elemData.handle (common.js:1014)
eval @ VM3277:30
dispatch @ common.js:1014
elemData.handle @ common.js:1014
... View more
04-07-2020
06:25 PM
Hi All
I'm fairly new to Splunk, and still very much learning (its a small hobby), and I recently found Elastic Beats works great for monitoring my home servers and network, then to add a cherry, the output is easily imported into Splunk. I've got it running some ICMP PINGs against my network interfaces, and in its simplest form, generates data such as:
NAME STATUS PING
site1 up 10
site2 up 10
site2 down 0
site3 up 10
site1 down 10
I'm using the Status Indicator visualisation to show a Trellis view of Total Devices, Total Up, Total Down. I've hacked together the following query, which works, but there has got to be a more optimised way of doing this:
index="beats" "monitor.type"=icmp "tags{}"=external
| stats latest(monitor.name) as name
latest(monitor.status) as status
BY monitor.name
| stats count(name) as " TOTAL"
sum(eval(if(status=="up",1,0))) as " UP"
sum(eval(if(status=="down",1,0))) as " DOWN"
| eval fn = "value"
| transpose column_name="category" header_field=fn
| eval color = if(category==" TOTAL", "#006d9c", if(category==" UP", "#00AA00", "#dc4e41"))
| eval icon = if(category==" TOTAL", "server", if(category==" UP", "check", "times-circle"))
| sort category
| stats last(value) as value last(icon) as icon last(color) as color by category
Which effective does the following:
Pull back the latest record for each unique "monitor.name"
Then counts the Total, Total Up, Total Down (Note spaces in the as-names, a hack so I can sort them into a desired order (Total -> UP -> Down)
The above totals are columns, so I transpose to a list with "category" (aka name) and "value"
Use EVAL to set the colour and icons for the visualisation
Sort into the order I want (Total -> UP -> Down)
Then re-apply stats - I honestly don't know why this is needed, but without it, the Status Indicator visualisation doesn't work, though looking at the statistics tab, the results are exactly the same without it
I'd really appreciate any advise on how I could re-work this, improve it, also any insight into why step 6 appears to be needed.
Many Thanks
K
... View more
