Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About weidertc
weidertc
Communicator
Member since:
04-24-2015
33 seconds ago
Community Statistics
| Posts | 79 |
| Solutions | 3 |
| Karma Given | 7 |
| Karma Received | 9 |
| Member Since | 04-24-2015 |
Activity Feed
- Posted Re: Can I hide/unhide specific text boxes using a single checkbox? on Dashboards & Visualizations. Friday
- Karma Re: Can I hide/unhide specific text boxes using a single checkbox? for scombs. Friday
- Posted Re: Modify custom tokens on time selector from another input (with run anywhere xml dashboard) on Dashboards & Visualizations. 04-22-2022 07:41 AM
- Posted Modify custom tokens on time selector from another input (with run anywhere xml dashboard) on Dashboards & Visualizations. 04-21-2022 08:17 AM
- Karma Re: selectFirstChoice not working in dynamic dropdowns after update of generating search for asherman. 04-21-2022 05:39 AM
- Got Karma for Re: How to overwrite a Token in a dashboard coming from a URL token. 02-25-2022 01:41 AM
- Posted Re: How to add <caption> to table visualization on Dashboards & Visualizations. 02-24-2022 05:57 PM
- Posted Re: How to overwrite a Token in a dashboard coming from a URL token on Dashboards & Visualizations. 02-24-2022 05:51 PM
- Posted Re: Trend line to show percentage this month v last month on Dashboards & Visualizations. 02-24-2022 05:44 PM
- Posted Re: Barchart not picking colors on Dashboards & Visualizations. 02-24-2022 05:31 PM
- Posted Re: How to hide token which is in the row and panel and not in fieldset? on Dashboards & Visualizations. 02-24-2022 05:09 PM
- Got Karma for Re: Email Alert - Result tokens. 02-23-2022 10:53 AM
- Posted Re: Unable to parse macro name from map command on Splunk Search. 02-02-2022 09:00 AM
- Posted Re: About psrsvd field which is made by sitimechart command on Knowledge Management. 12-02-2021 12:07 PM
- Posted Re: XML Conditional suffix prefix on Splunk Search. 10-21-2021 12:19 PM
- Posted XML Conditional suffix prefix on Splunk Search. 10-08-2021 09:04 AM
- Got Karma for xml: Check if a value is a number. 06-03-2021 04:18 AM
- Posted Re: Email Alert - Result tokens on Dashboards & Visualizations. 11-13-2020 12:05 PM
- Posted Re: How to insert rows for zero counts and group by multiple fields of yet unknown values on Splunk Search. 11-03-2020 01:39 PM
- Posted How to insert rows for zero counts and group by multiple fields of yet unknown values on Splunk Search. 10-29-2020 10:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-22-2022
07:41 AM
I assume you mean the <change> block on the source input that's directly updated by the user. this is only necessary for the native tokens. the <change> block on the target input takes the native token and its own <change> block takes over, (regardless whether the user updated the source or target input,) not the one from the source input, then when the native tokens get updated from elsewhere dynamically, then only the <change> block on the target input matter. except, as my issue describes, with the time selector input. it behaves differently. its own <change> block only executes when action is taken directly on itself, which is inconsistent with how it behaves on all other inputs. as an example, watch how the custom token on the panel dropdown updates even though the time selector does not update it directly. I'm hoping for a solution that doesn't require multiple sources of truth and replicate the entire <change> block of 30 tokens twice, one for each dropdown.
... View more
04-21-2022
08:17 AM
I have a time selector with custom tokens that control various aspects of the dashboard. Changing the value of the time selector changes the values of the custom tokens. I also have a separate input dropdown with a list of times taken from when our alerts fired. I need to update the time selector when the alert dates/times are chosen so the panels below update with a timeframe showing what happened with alert. When changing the value of the separate input dropdown to a new date, the 'earliest' and 'latest' update on the time selector, but none of its custom tokens do. They only change when I change the time selector. When I update input dropdowns with other input dropdown dynamically, they work, just not when I attempt to update the time selector from another input dropdown. How can I update "all" tokens on the time selector, not just 'earliest' and 'latest' from the other dropdown? <form theme="dark">
<label>Time Issue</label>
<description></description>
<fieldset submitButton="false" autoRun="false">
<input type="time" token="time" searchWhenChanged="true">
<label>Time Frame</label>
<default>
<earliest>@d-1d</earliest>
<latest>now</latest>
</default>
<change>
<eval token="time.earliest">if(len('earliest')=0 OR 'earliest="" OR isnull('earliest') OR 'earliest'="null" OR 'earliest'="0", "@d-90d", 'earliest')</eval>
<eval token="time.latest">if('latest'="now" OR len('latest')=0 OR isnull('latest') OR 'latest'="null","@m",'latest')</eval>
<eval token="time.earliest_type">if(match('earliest', ".*[@smhdwy].*"), "rel", "abs")</eval>
<eval token="time.latest_type">if(match('latest', ".*[@smhdwy].*"), "rel", "abs")</eval>
<eval token="time.earliest_epoch">if($time.earliest_type$="rel", relative_time(now(), 'earliest'), 'earliest')</eval>
<eval token="time.latest_epoch">if($time.latest_type$="rel", relative_time(now(), 'latest'), 'latest')</eval>
<eval token="time.difference">$time.latest_epoch$-$time.earliest_epoch$</eval>
<eval token="form.panel">if($time.difference$<=604801,"compare","single")</eval>
<eval token="form.span">if($time.difference$>2592000,"1d",if($time.difference$>604800,"1h",if($time.difference$>172800,"15m",if($time.difference$>86400,"3m","1m"))))</eval>
<eval token="time.earliest_day1">if($time.earliest_type$="rel", 'earliest' . "-1d", 'earliest'-86400)</eval>
<eval token="time.earliest_day1_epoch">'earliest'-86400</eval>
<eval token="time.latest_day1">if($time.latest_type$="rel", 'latest' . "-1d", 'latest'-86400)</eval>
<eval token="time.latest_day1_epoch">'latest'-86400</eval>
<eval token="time.earliest_week1">if($time.earliest_type$="rel", 'earliest' . "-1w", 'earliest'-604800)</eval>
<eval token="time.earliest_week1_epoch">'earliest'-604800</eval>
<eval token="time.latest_week1">if($time.latest_type$="rel", 'latest' . "-1w", 'latest'-604800)</eval>
<eval token="time.latest_week1_epoch">'latest'-604800</eval>
</change>
</input>
<input type="dropdown" token="span" searchWhenChanged="true">
<label>Span</label>
<choice value="1m">1 Minute</choice>
<choice value="3m">3 Minute</choice>
<choice value="5m">5 Minutes</choice>
<choice value="10m">10 Minutes</choice>
<choice value="15m">15 Minutes</choice>
<choice value="30m">30 Minutes</choice>
<choice value="1h">1 Hour</choice>
<choice value="3h">3 Hours</choice>
<choice value="6h">6 Hours</choice>
<choice value="12h">12 Hours</choice>
<choice value="1d">1 Day</choice>
<change>
<eval token="span.seconds">case($span$="1m", 60, $span$="3m", 180, $span$="5m", 300, $span$="10m", 600, $span$="15m", 900, $span$="30m", 1800, $span$="1h", 3600, $span$="3h", 10800, $span$="6h", 21600, $span$="12h", 43200, $span$="1d", 86400)</eval>
<eval token="time.earliest_snap">(int($time.earliest_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval>
<eval token="time.latest_snap">int($time.latest_epoch$/$span.seconds$)*$span.seconds$</eval>
<eval token="time.earliest_week1_snap">(int($time.earliest_week1_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval>
<eval token="time.latest_week1_snap">int($time.latest_week1_epoch$/$span.seconds$)*$span.seconds$</eval>
<eval token="time.difference_snap">$time.latest_snap$-$time.earliest_snap$</eval>
<eval token="span.intervals">ceil($time.difference$/$span.seconds$)</eval>
<eval token="span.intervals_snap">$time.difference_snap$/$span.seconds$</eval>
</change>
<default>5m</default>
<initialValue>5m</initialValue>
</input>
<input type="dropdown" token="panel" searchWhenChanged="true">
<label>Panel</label>
<choice value="single">Single</choice>
<choice value="compare">Compare</choice>
<change>
<condition value="compare">
<unset token="showPanelSingle"></unset>
<set token="showPanelCompare">true</set>
</condition>
<condition value="single">
<unset token="showPanelCompare"></unset>
<set token="showPanelSingle">true</set>
</condition>
</change>
<default>compare</default>
<initialValue>compare</initialValue>
</input>
<input type="dropdown" token="timeOption" searchWhenChanged="true">
<label>Choose a Time</label>
<fieldForLabel>timeLabel</fieldForLabel>
<fieldForValue>time</fieldForValue>
<search>
<done>
<condition match="len('timeOption') != "0"">
<unset token="form.time.earliest"></unset>
<unset token="form.time.latest"></unset>
<eval token="form.time.earliest">if($timeOption$ > relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval>
<eval token="form.time.latest">if($timeOption$ > relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval>
</condition>
</done>
<query>| makeresults count=5
| eval _time = floor((relative_time(_time, "@d") / 86400) * 86400)
| streamstats current=false count as _row
| eval time = _time - (_row * 86400)
| eval timeLabel = strftime(time, "%Y-%m-%d")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<change>
<condition match="len('timeOption') != "0"">
<unset token="form.time.earliest"></unset>
<unset token="form.time.latest"></unset>
<eval token="form.time.earliest">if($timeOption$ > relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval>
<eval token="form.time.latest">if($timeOption$ > relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>timeOption</span></div>
<div style="width: 300px; float: left;"><span>$timeOption$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest</span></div>
<div style="width: 300px; float: left;"><span>$time.latest$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest_epoch</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest_epoch$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest_epoch</span></div>
<div style="width: 300px; float: left;"><span>$time.latest_epoch$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest_type</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest_type$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest_type</span></div>
<div style="width: 300px; float: left;"><span>$time.latest_type$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.difference</span></div>
<div style="width: 300px; float: left;"><span>$time.difference$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest_day1</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest_day1$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest_day1</span></div>
<div style="width: 300px; float: left;"><span>$time.latest_day1$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest_day1_epoch</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest_day1_epoch$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest_day1_epoch</span></div>
<div style="width: 300px; float: left;"><span>$time.latest_day1_epoch$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest_week1</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest_week1$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest_week1</span></div>
<div style="width: 300px; float: left;"><span>$time.latest_week1$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.earliest_week1_epoch</span></div>
<div style="width: 300px; float: left;"><span>$time.earliest_week1_epoch$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>time.latest_week1_epoch</span></div>
<div style="width: 300px; float: left;"><span>$time.latest_week1_epoch$</span></div>
</div>
<div style="width: 100%; clear: both;">
<div style="width: 300px; float: left;"><span>panel</span></div>
<div style="width: 300px; float: left;"><span>$panel$</span></div>
</div>
</html>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
simple XML
-
token
02-24-2022
05:57 PM
You can try adding an <html> section right after the table element, and put a <caption> tag in there. I'm not familiar with accessibility rules but this may satisfy the screen reader's requirement if the xml keeps the <caption> tag in the xsl transformation.
... View more
02-24-2022
05:51 PM
1 Karma
You can try using a 3rd host token. the 3rd token uses the value of the url host token if available, otherwise, it uses the host token from the input. use the 3rd host token wherever you need it.
... View more
02-24-2022
05:44 PM
For simple counts, you can get both timelines like this | multisearch
[index="asfd" ... earliest=@mon latest=@d
| eval Month=0]
[index="asfd" ... earliest=@mon-1mon latest=@mon
| eval Month=1]
...
| timechart count(eval(Month=0)) as "ThisMonth", count(eval(Month=1)) as "LastMonth" As far as percentages, it depends on how you want it, like per interval, up to the latest interval, or as a whole. There are very different solutions for each.
... View more
02-24-2022
05:31 PM
I think what you're looking for is field value colors, not field name colors. https://docs.splunk.com/Documentation/Splunk/8.2.5/Viz/TableFormatsFormatting
... View more
02-24-2022
05:09 PM
You would use the depends attribute equal to to a token that you would never set. <input ... depends="$neverShow$"> If I understand your second request, as far as 2 selections, Splunk is a little flaky and sometimes keeps the old value when its options update. I don't know what to do about this. I think its a timing issue with the token parsing. If I am misunderstanding, please clarify that issue.
... View more
02-02-2022
09:00 AM
If you're not using a dashboard, this solution will work. The map command cannot parse macros passed to it; however, it can use its own macro with a parameter and parse spl passed to it, even if the spl is a macro. This does not work: | makeresults count=1
| eval Search="`searchMacro`"
| map search="search $Search$ earliest=@h-1h latest=@m" maxsearches=10 This works: | makeresults count=1
| eval Search="`searchMacro`"
| map search="search `Map($Search$)` earliest=@h-1h latest=@m" maxsearches=10 You will have to make the Map(1) macro which will function only as a pass-through. in macro `Map(1)`, set Definition=$map$; Arguments=map. That's it.
... View more
12-02-2021
12:07 PM
One reason to use the si- commands is to aggregate values for storage (base search or summary index). this is the quickest way to run searches. Simply throwing a table or fields command at the end of a base search often reduces performance, even if it may reduce server load. Another reason to use the si- commands is to preserve the integrity of the values in aggregate when in summarized form. if you were to use a stats command to summarize data for summary index or base search, and then another stats command right after it in post-process or to further aggregate from a summary index (because the original intervals need to be further combined), you will end up with incorrect quantitative values due to weighting issues. Take, for example, you have just 2 intervals of response times. the first interval has 2 events with both having 10 second response time each. the 2nd interval has 1 event with 1 second response time. a double-aggregate average will yield 5.5 second average response time ( (10 + 1) / 2 ), but a true and correct average is 7 seconds ( (10 + 10 + 1 ) / 3 ). transforming commands otherwise lose the original values still required, so si- commands store these in special fields. I honestly don't know specifically what most of the other psrsvd fields do, but it is likely for similar reasons and to help users in using the same familiar format for the final and regular stats command without ever knowing that you're actually querying summarized data.
... View more
10-21-2021
12:19 PM
Yea I tried that. it makes no difference. I give up on this. It's taking too much time. thanks for your help.
... View more
10-08-2021
09:04 AM
I have an input text and input dropdown that both need to allow blank value. They cannot be null since the token must be set or the queries that use it won't run. I need a prefix and suffix both wildcards only when there's a value, and to use a single wildcard (*) in its absence. I tried this, but the prefix and suffix keep multiplying and soon i have 10 suffixes and 10 prefixes. here's the input text: <prefix/>
<suffix/>
<change>
<eval token="assetFilter">if(len($assetFilter$)>0, "*" . $assetFilter$ . "*", "*")</eval>
</change> after entering, removing, entering, removing values, the suffix and prefix kept multiplying and eventually looked like this ****tag=**** Here's the other one, a dropdown of macros so it needs the ` char with the wildcard, after selecting, unselecting, selecting, and unselecting values in the dropdown. <change>
<eval token="asset">if(len($asset$)>0, "*`" . $asset$ . "`*", "*")</eval>
</change> *`*`*`*`*`*`*`*`*`*`*`*`*`*`*`ED_ENDI_Asdf`*`*`*`*`*`*`*`*`*`*`*`*`*`*`* How can I use prefix and suffix conditionally a little better or in a way that works? -c
... View more
Labels
- Labels:
-
other
11-13-2020
12:05 PM
1 Karma
If you prefix the token name with an underscore it will hide it from the table, but the information is still present for you to use. You will still need to put it in the final table. This command will contain the data for all 4 fields, but it will only visibly show you the 3 without leading underscores. | table _TOTAL Col1 Col2 Col3 This token will be available for you to use. $result._TOTAL$
... View more
11-03-2020
01:39 PM
Hi Rich, thanks for the help. Unfortunately this doesn't preserve the api and errormsg as those fields are now gone. I did, however, discover a quick solution. i can add an eventstats at the end after the stats command. | eventstats values(Traffic) as Traffic by api, Minute This doesn't fill in any data where that api + minute combo doesn't yet exist though, so it isn't complete. I think I need to redesign the whole query as this is getting a little complex. All i'm trying to do is track the rates of failures for each type of failure for each api over 15 minute spans of time over the past hour so i can see if they are rising or falling. The math does work though since if there's no data for that row that means there's no errors so the failure rate will be zero regardless of amount of traffic that's missing. If there's a better way to track rates of failure over the past hour to see if they are rising, i'm all ears, but this may do for the time being.
... View more
10-29-2020
10:49 AM
I am writing a query to look for rises in error messages over the past hour. It looks in 15 minute chunks from 0 to 60 minutes ago. Rows where there are 0 error messages are missing from the table, but i need to keep them there so when i run a median over the last 3 time bins, it includes the 0s. Each API has their own error messages when it fails, and not every failure occurs in every 15 minute block of time for their API. So far I have this, in run-anywhere spl, but it's not correct | makeresults 1 | eval api="api1", errorMsg="msg1", Minute=0, Traffic="1234", Failures="5"
| append [| makeresults 1 | eval api="api1", errorMsg="msg2", Minute=15, Traffic="1786", Failures="2"]
| append [| makeresults 1 | eval api="api1", errorMsg="msg2", Minute=30, Traffic="1842", Failures="1"]
| append [| makeresults 1 | eval api="api1", errorMsg="msg2", Minute=45, Traffic="1619", Failures="7"]
| append [| makeresults 1 | eval api="api1", errorMsg="msg3", Minute=0, Traffic="1234", Failures="15"]
| append [| makeresults 1 | eval api="api1", errorMsg="msg3", Minute=45, Traffic="1619", Failures="12"]
| append [| makeresults 1 | eval api="api2", errorMsg="msg10", Minute=15, Traffic="7856", Failures="110"]
| fields api, errorMsg, Minute, Traffic, Failures
| appendpipe
[| stats count by api, errorMsg
| eval Minute=split("0,15,30,45", ",")
| mvexpand apiErrorMsg
| mvexpand Minute]
| stats sum(Traffic) as Traffic, sum(Failures) as Failures by api, errorMsg, Minute
| fillnull value=0 Failures Table is too large to show, but it doesn't carry with it the total traffic values for each 15 minute bin. I looked at the following solutions, but they are each different enough that their solutions only partially worked as I have 2 group by fields and the APIs and Error Messages are not yet known until the query runs. https://community.splunk.com/t5/Dashboards-Visualizations/how-to-insert-row-on-zero-count-and-still-use-group-by-multiple/m-p/144172#M8722 https://community.splunk.com/t5/Splunk-Search/Any-way-to-return-zero-result-count-stats-of-a-field-such-as-the/td-p/92149 https://community.splunk.com/t5/Security/Search-events-against-a-lookup-table-and-show-matching-count/td-p/47408 https://community.splunk.com/t5/Dashboards-Visualizations/Conditionally-Append-Rows-to-Stats-Table/m-p/121235#M7040 The only problems is the Total Traffic field (total of all calls regardless whether it erred) is missing from many rows. What can I do after the makeresults that will fill this table out correctly?
... View more
- Tags:
- spl
Labels
- Labels:
-
stats
07-28-2020
01:52 PM
I tested this out in multiple timezones and it produces the correct and same answer. it's odd how it takes all this, but it works. Thank you!
... View more
07-27-2020
02:47 PM
1 Karma
I need to check of the time tokens are numeric. I used to use this and it worked, but suddenly my dashboard broke. I initially had this inside my time selector filter, and it worked, until today. <eval token="anumber">if(isnum('earliest'),"true","false")</eval> I also tried this, but it didn't work. <eval token="number">if(match('earliest',"^\d+"),"true","false")</eval> It keeps evaluating to false. I get how a string to contain only numbers and it'd be a string, but this actually worked earlier. How can I check whether a number or a string containing only numbers (and a decimal) to actually return true?
... View more
Labels
- Labels:
-
development
07-27-2020
02:36 PM
Is this a claim that isnum() and isstr() are deprecated? This was working up until recently. I've been scratching my head for hours trying to fix my dashboard. If this is the case then there needs to be a way to find out if a string containing only numbers is indeed only numbers.
... View more
07-24-2020
08:59 AM
What I'm saying is the offset is doubled with your SPL. I don't think Splunk will let you use strptime or strftime in a solution because it uses your local time which can't be a factor. I am only trying to work with vendor time and splunk server local time.
... View more
07-23-2020
01:16 PM
This is an improvement. For some reason though it doubles the offset. i am at -4h, but 2020-07-22T12:59:12.301063Z is reduced by 8 to become 07/22/2020 04:59:12.301063. I think Splunk strptime() is converting the timezone. It uses the timezone of the logged in user instead of the server local time. It'll only work if i am in the same timezone as the server, which is fine for me but not usually the case with others, and then the rest of the lines re-apply the timezone to double it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
34 seconds ago
|
Karma from
