About weidertc

weidertc · ‎10-27-2023

I don't have access to this app. I will ask an admin though.

weidertc · ‎10-25-2023

How can I get the SVC Usage for Saved Searches and Ad-hoc searches? These logs don't have it. index="_internal" data.searchType="scheduled" index="_audit" sourcetype="audittrail" action="search" info="completed"

weidertc · ‎09-30-2022

This appears to be the cleanest way, thanks.

weidertc · ‎04-22-2022

I assume you mean the <change> block on the source input that's directly updated by the user. this is only necessary for the native tokens. the <change> block on the target input takes the native token and its own <change> block takes over, (regardless whether the user updated the source or target input,) not the one from the source input, then when the native tokens get updated from elsewhere dynamically, then only the <change> block on the target input matter. except, as my issue describes, with the time selector input. it behaves differently. its own <change> block only executes when action is taken directly on itself, which is inconsistent with how it behaves on all other inputs. as an example, watch how the custom token on the panel dropdown updates even though the time selector does not update it directly. I'm hoping for a solution that doesn't require multiple sources of truth and replicate the entire <change> block of 30 tokens twice, one for each dropdown.

weidertc · ‎04-21-2022

I have a time selector with custom tokens that control various aspects of the dashboard. Changing the value of the time selector changes the values of the custom tokens. I also have a separate input dropdown with a list of times taken from when our alerts fired. I need to update the time selector when the alert dates/times are chosen so the panels below update with a timeframe showing what happened with alert. When changing the value of the separate input dropdown to a new date, the 'earliest' and 'latest' update on the time selector, but none of its custom tokens do. They only change when I change the time selector. When I update input dropdowns with other input dropdown dynamically, they work, just not when I attempt to update the time selector from another input dropdown. How can I update "all" tokens on the time selector, not just 'earliest' and 'latest' from the other dropdown? <form theme="dark"> <label>Time Issue</label> <description></description> <fieldset submitButton="false" autoRun="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Time Frame</label> <default> <earliest>@d-1d</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest">if(len('earliest')=0 OR 'earliest="" OR isnull('earliest') OR 'earliest'="null" OR 'earliest'="0", "@d-90d", 'earliest')</eval> <eval token="time.latest">if('latest'="now" OR len('latest')=0 OR isnull('latest') OR 'latest'="null","@m",'latest')</eval> <eval token="time.earliest_type">if(match('earliest', ".*[@smhdwy].*"), "rel", "abs")</eval> <eval token="time.latest_type">if(match('latest', ".*[@smhdwy].*"), "rel", "abs")</eval> <eval token="time.earliest_epoch">if($time.earliest_type$="rel", relative_time(now(), 'earliest'), 'earliest')</eval> <eval token="time.latest_epoch">if($time.latest_type$="rel", relative_time(now(), 'latest'), 'latest')</eval> <eval token="time.difference">$time.latest_epoch$-$time.earliest_epoch$</eval> <eval token="form.panel">if($time.difference$<=604801,"compare","single")</eval> <eval token="form.span">if($time.difference$>2592000,"1d",if($time.difference$>604800,"1h",if($time.difference$>172800,"15m",if($time.difference$>86400,"3m","1m"))))</eval> <eval token="time.earliest_day1">if($time.earliest_type$="rel", 'earliest' . "-1d", 'earliest'-86400)</eval> <eval token="time.earliest_day1_epoch">'earliest'-86400</eval> <eval token="time.latest_day1">if($time.latest_type$="rel", 'latest' . "-1d", 'latest'-86400)</eval> <eval token="time.latest_day1_epoch">'latest'-86400</eval> <eval token="time.earliest_week1">if($time.earliest_type$="rel", 'earliest' . "-1w", 'earliest'-604800)</eval> <eval token="time.earliest_week1_epoch">'earliest'-604800</eval> <eval token="time.latest_week1">if($time.latest_type$="rel", 'latest' . "-1w", 'latest'-604800)</eval> <eval token="time.latest_week1_epoch">'latest'-604800</eval> </change> </input> <input type="dropdown" token="span" searchWhenChanged="true"> <label>Span</label> <choice value="1m">1 Minute</choice> <choice value="3m">3 Minute</choice> <choice value="5m">5 Minutes</choice> <choice value="10m">10 Minutes</choice> <choice value="15m">15 Minutes</choice> <choice value="30m">30 Minutes</choice> <choice value="1h">1 Hour</choice> <choice value="3h">3 Hours</choice> <choice value="6h">6 Hours</choice> <choice value="12h">12 Hours</choice> <choice value="1d">1 Day</choice> <change> <eval token="span.seconds">case($span$="1m", 60, $span$="3m", 180, $span$="5m", 300, $span$="10m", 600, $span$="15m", 900, $span$="30m", 1800, $span$="1h", 3600, $span$="3h", 10800, $span$="6h", 21600, $span$="12h", 43200, $span$="1d", 86400)</eval> <eval token="time.earliest_snap">(int($time.earliest_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval> <eval token="time.latest_snap">int($time.latest_epoch$/$span.seconds$)*$span.seconds$</eval> <eval token="time.earliest_week1_snap">(int($time.earliest_week1_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval> <eval token="time.latest_week1_snap">int($time.latest_week1_epoch$/$span.seconds$)*$span.seconds$</eval> <eval token="time.difference_snap">$time.latest_snap$-$time.earliest_snap$</eval> <eval token="span.intervals">ceil($time.difference$/$span.seconds$)</eval> <eval token="span.intervals_snap">$time.difference_snap$/$span.seconds$</eval> </change> <default>5m</default> <initialValue>5m</initialValue> </input> <input type="dropdown" token="panel" searchWhenChanged="true"> <label>Panel</label> <choice value="single">Single</choice> <choice value="compare">Compare</choice> <change> <condition value="compare"> <unset token="showPanelSingle"></unset> <set token="showPanelCompare">true</set> </condition> <condition value="single"> <unset token="showPanelCompare"></unset> <set token="showPanelSingle">true</set> </condition> </change> <default>compare</default> <initialValue>compare</initialValue> </input> <input type="dropdown" token="timeOption" searchWhenChanged="true"> <label>Choose a Time</label> <fieldForLabel>timeLabel</fieldForLabel> <fieldForValue>time</fieldForValue> <search> <done> <condition match="len('timeOption') != "0""> <unset token="form.time.earliest"></unset> <unset token="form.time.latest"></unset> <eval token="form.time.earliest">if($timeOption$ > relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval> <eval token="form.time.latest">if($timeOption$ > relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval> </condition> </done> <query>| makeresults count=5 | eval _time = floor((relative_time(_time, "@d") / 86400) * 86400) | streamstats current=false count as _row | eval time = _time - (_row * 86400) | eval timeLabel = strftime(time, "%Y-%m-%d")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="len('timeOption') != "0""> <unset token="form.time.earliest"></unset> <unset token="form.time.latest"></unset> <eval token="form.time.earliest">if($timeOption$ > relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval> <eval token="form.time.latest">if($timeOption$ > relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval> </condition> </change> </input> </fieldset> <row> <panel> <html> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>timeOption</span></div> <div style="width: 300px; float: left;"><span>$timeOption$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest</span></div> <div style="width: 300px; float: left;"><span>$time.earliest$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest</span></div> <div style="width: 300px; float: left;"><span>$time.latest$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_type</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_type$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_type</span></div> <div style="width: 300px; float: left;"><span>$time.latest_type$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.difference</span></div> <div style="width: 300px; float: left;"><span>$time.difference$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_day1</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_day1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_day1</span></div> <div style="width: 300px; float: left;"><span>$time.latest_day1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_day1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_day1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_day1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_day1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_week1</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_week1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_week1</span></div> <div style="width: 300px; float: left;"><span>$time.latest_week1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_week1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_week1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_week1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_week1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>panel</span></div> <div style="width: 300px; float: left;"><span>$panel$</span></div> </div> </html> </panel> </row> </form>

weidertc · ‎02-24-2022

You can try adding an <html> section right after the table element, and put a <caption> tag in there. I'm not familiar with accessibility rules but this may satisfy the screen reader's requirement if the xml keeps the <caption> tag in the xsl transformation.

weidertc · ‎02-24-2022

You can try using a 3rd host token. the 3rd token uses the value of the url host token if available, otherwise, it uses the host token from the input. use the 3rd host token wherever you need it.

weidertc · ‎02-24-2022

For simple counts, you can get both timelines like this | multisearch [index="asfd" ... earliest=@mon latest=@d | eval Month=0] [index="asfd" ... earliest=@mon-1mon latest=@mon | eval Month=1] ... | timechart count(eval(Month=0)) as "ThisMonth", count(eval(Month=1)) as "LastMonth" As far as percentages, it depends on how you want it, like per interval, up to the latest interval, or as a whole. There are very different solutions for each.

weidertc · ‎02-24-2022

I think what you're looking for is field value colors, not field name colors. https://docs.splunk.com/Documentation/Splunk/8.2.5/Viz/TableFormatsFormatting

weidertc · ‎02-24-2022

You would use the depends attribute equal to to a token that you would never set. <input ... depends="$neverShow$"> If I understand your second request, as far as 2 selections, Splunk is a little flaky and sometimes keeps the old value when its options update. I don't know what to do about this. I think its a timing issue with the token parsing. If I am misunderstanding, please clarify that issue.

weidertc · ‎02-02-2022

If you're not using a dashboard, this solution will work. The map command cannot parse macros passed to it; however, it can use its own macro with a parameter and parse spl passed to it, even if the spl is a macro. This does not work: | makeresults count=1 | eval Search="`searchMacro`" | map search="search $Search$ earliest=@h-1h latest=@m" maxsearches=10 This works: | makeresults count=1 | eval Search="`searchMacro`" | map search="search `Map($Search$)` earliest=@h-1h latest=@m" maxsearches=10 You will have to make the Map(1) macro which will function only as a pass-through. in macro `Map(1)`, set Definition=$map$; Arguments=map. That's it.

weidertc · ‎12-02-2021

One reason to use the si- commands is to aggregate values for storage (base search or summary index). this is the quickest way to run searches. Simply throwing a table or fields command at the end of a base search often reduces performance, even if it may reduce server load. Another reason to use the si- commands is to preserve the integrity of the values in aggregate when in summarized form. if you were to use a stats command to summarize data for summary index or base search, and then another stats command right after it in post-process or to further aggregate from a summary index (because the original intervals need to be further combined), you will end up with incorrect quantitative values due to weighting issues. Take, for example, you have just 2 intervals of response times. the first interval has 2 events with both having 10 second response time each. the 2nd interval has 1 event with 1 second response time. a double-aggregate average will yield 5.5 second average response time ( (10 + 1) / 2 ), but a true and correct average is 7 seconds ( (10 + 10 + 1 ) / 3 ). transforming commands otherwise lose the original values still required, so si- commands store these in special fields. I honestly don't know specifically what most of the other psrsvd fields do, but it is likely for similar reasons and to help users in using the same familiar format for the final and regular stats command without ever knowing that you're actually querying summarized data.

weidertc · ‎10-21-2021

Yea I tried that. it makes no difference. I give up on this. It's taking too much time. thanks for your help.

weidertc · ‎10-08-2021

I have an input text and input dropdown that both need to allow blank value. They cannot be null since the token must be set or the queries that use it won't run. I need a prefix and suffix both wildcards only when there's a value, and to use a single wildcard (*) in its absence. I tried this, but the prefix and suffix keep multiplying and soon i have 10 suffixes and 10 prefixes. here's the input text: <prefix/> <suffix/> <change> <eval token="assetFilter">if(len($assetFilter$)>0, "*" . $assetFilter$ . "*", "*")</eval> </change> after entering, removing, entering, removing values, the suffix and prefix kept multiplying and eventually looked like this ****tag=**** Here's the other one, a dropdown of macros so it needs the ` char with the wildcard, after selecting, unselecting, selecting, and unselecting values in the dropdown. <change> <eval token="asset">if(len($asset$)>0, "*`" . $asset$ . "`*", "*")</eval> </change> *`*`*`*`*`*`*`*`*`*`*`*`*`*`*`ED_ENDI_Asdf`*`*`*`*`*`*`*`*`*`*`*`*`*`*`* How can I use prefix and suffix conditionally a little better or in a way that works? -c

weidertc · ‎11-13-2020

If you prefix the token name with an underscore it will hide it from the table, but the information is still present for you to use. You will still need to put it in the final table. This command will contain the data for all 4 fields, but it will only visibly show you the 3 without leading underscores. | table _TOTAL Col1 Col2 Col3 This token will be available for you to use. $result._TOTAL$

Posts	81
Solutions	3
Karma Given	7
Karma Received	9
Member Since	‎04-24-2015

Online Status	Offline
Date Last Visited	a month ago

How to get SVC Usage for Saved Searches and Ad-hoc...

Modify custom tokens on time selector from another...

XML Conditional suffix prefix

How to insert rows for zero counts and group by mu...

xml: Check if a value is a number

How do I convert a timestamp from one timezone to ...

Conditional standard deviations: How to create an ...

How to Set and Unset a token conditionally when ot...

Stats 2 results together and filling in the blank ...

timechart not using correct _time timeframe

Re: How to get SVC Usage for Saved Searches and Ad...

How to get SVC Usage for Saved Searches and Ad-hoc...

Re: Can I hide/unhide specific text boxes using a ...

Re: Modify custom tokens on time selector from ano...

Modify custom tokens on time selector from another...

Re: How to add <caption> to table visualization

Re: How to overwrite a Token in a dashboard coming...

Re: Trend line to show percentage this month v las...

Re: Barchart not picking colors

Re: How to hide token which is in the row and pane...

Re: Unable to parse macro name from map command

Re: About psrsvd field which is made by sitimechar...

Re: XML Conditional suffix prefix

XML Conditional suffix prefix

Re: Email Alert - Result tokens