About dustintroop

dustintroop · ‎11-04-2020

Thanks Gcusello for you response, Unfortunately that didn't fixed my issue as well. The issue got resolved after changing the string "fields" to "table" in the base search

dustintroop · ‎11-03-2020

Complete Search from one of the panel out of 20 different panels ############################################## index=Temp_Index="http:hec_splunk" sourcetype="json:script_output" "Source Team"="UNIX_SA" | where like('Region', "%APAC%") | stats sum(TotalSpace) AS Total sum(UsedSpace) AS Used sum(AvailableSpace) AS Available | eval Total=round(Total/1024,0) | eval Used=round(Used/1024,0) | eval Available=round(Available/1024,0) | table Used,Available | transpose | eval Used=Used."(".Used."%)" On my dashboard, I have close to "20" different panels, As of now all the "20" panels have their own query. So to avoid the individual queries, I'm trying to use the base search feature for efficiency purpose. On all the queries from 20 different panels, the common string is "index=Temp_Index="http:hec_splunk" sourcetype="json:script_output" "Source Team"="UNIX_SA" |". So i'm trying to put this in the basesearch and keeping the remaining part of the query in each panel. But when i do this, I don't see any result in the panel, but when i do the same search manually, the query is returning results. So looking to see if anyone can suggest anything to make this work. Thanks for your Time and Support. Appreciate your help.

dustintroop · ‎11-03-2020

Thanks for the Response @ITWhisperer . I'm not getting any specific error. The Pie chart is showing "No result Found", but when i runt he actual search using "Edit Search" option, i see the expected results

dustintroop · ‎11-03-2020

Having issues with splitting the complete search between "basesearch" and "remaining search in other panels". Complete Search ############# index=Temp_Index="http:hec_splunk" sourcetype="json:script_output" "Source Team"="UNIX_SA" | where like('Region', "%APAC%") | stats sum(TotalSpace) AS Total sum(UsedSpace) AS Used sum(AvailableSpace) AS Available | eval Total=round(Total/1024,0) | eval Used=round(Used/1024,0) | eval Available=round(Available/1024,0) | table Used,Available | transpose | eval Used=Used."(".Used."%)" Below split is the only working search. but this won't work for me. Working XML Code ############## <row> <panel depends="$nevershowup$"> <event> <title>BASE SEARCH PANEL</title> <search id="baseSearch"> <query>index=Temp_Index="http:hec_splunk" sourcetype="json:script_output" "Source Team"="UNIX_SA" | where like('Region', "%APAC%") | stats sum(TotalSpace) AS Total sum(UsedSpace) AS Used sum(AvailableSpace) AS Available | eval Total=round(Total/1024,0) | eval Used=round(Used/1024,0) | eval Available=round(Available/1024,0) | table Used,Available | transpose | </query> <earliest>$timepicker.earliest$</earliest> <latest>$timepicker.latest$</latest> </search> <option name="list.drilldown">none</option> </event> </panel> </row> <row> <panel> <title>NAM Region</title> <chart> <search base="baseSearch"> <query> eval Used=Used."(".Used."%)"</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.showPercent">true</option> <option name="charting.chart.stackMode">stacked100</option> <option name="charting.drilldown">none</option> <option name="charting.legend.placement">top</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> The way i want it to work but not working ############################# The reason is, i have many panels and the common string in all panel is "index=Temp_Index="http:hec_splunk" sourcetype="json:script_output" "Source Team"="UNIX_SA" and i want to use this in base search. I tried using "| fields *" from the other solutions suggested in splunk community but is it not working. <row> <panel depends="$nevershowup$"> <event> <title>BASE SEARCH PANEL</title> <search id="baseSearch"> <query>index=Temp_Index="http:hec_splunk" sourcetype="json:script_output" "Source Team"="UNIX_SA" </query> <earliest>$timepicker.earliest$</earliest> <latest>$timepicker.latest$</latest> </search> <option name="list.drilldown">none</option> </event> </panel> </row> <row> <panel> <title>NAM Region</title> <chart> <search base="baseSearch"> <query> | where like('Region', "%APAC%") | stats sum(TotalSpace) AS Total sum(UsedSpace) AS Used sum(AvailableSpace) AS Available | eval Total=round(Total/1024,0) | eval Used=round(Used/1024,0) | eval Available=round(Available/1024,0) | table Used,Available | transpose | eval Used=Used."(".Used."%)"</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.showPercent">true</option> <option name="charting.chart.stackMode">stacked100</option> <option name="charting.drilldown">none</option> <option name="charting.legend.placement">top</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row>

dustintroop · ‎06-03-2020

Thanks Ciao for the Time & Response. I'm getting error that "The arguments in the if function are invalid". Sorry I think i'm not clear in explaining the problem statement. Let me try again. Let's say if i have a 100 events from hundred different devices. I want to count the number of events that contains a string "Fail" and the Number of events that doesn't contain the string "Fail"

dustintroop · ‎06-03-2020

I have an events for each device with multiple checks as below and i want to find the device count which has "Pass" on all the fields and the device count which has "Fail" in even one field Device1 check1: Pass check2: Fail check3: Pass Device2 check1: Pass check2: Pass check3: Pass Device3 check1: Fail check2: Fail check3: Pass I'm looking something similar to this Healthy_Device_Count =1 Un_Healthy_Device_Count=2

dustintroop · ‎05-24-2020

One last help. how can i add Pass percentage and Fail Percentage in the table ?. Below is the current search. index=abcd source="bcd" earliest=-24h@h | where like('Source_Team', "%BDLM%") | rex max_match=0 "(?Pass*)" | rex max_match=0 "(?Fail*)" | rex max_match=0 "(?(Pass|Fail))" | eval passCount=mvcount(Pass), failCount=mvcount(Fail), TotalCount=mvcount(BOTH) | stats sum(TotalCount) as Total_Checks, sum(passCount) as Pass_Count, sum(failCount) as Fail_Count by Product | fillnull value=0 Pass_Count,Fail_Count,Total_Checks

dustintroop · ‎05-24-2020

Thanks again @richgalloway. You have driven me to the solution. I have a unique identifier for a each product in the "Source_Team" field. So i renamed both the field name as well as the values in that fields to have what i desired to display. Appreciate your Valuable Time & help.

dustintroop · ‎05-24-2020

@richgalloway. Thanks a bunch for consolidating the search. It is working when i remove the "by product" string from the search at the end. So, i'm not able to add the First column The Events against which i'm performing this search doesn't have a field called product. I want to add the first column manually [since this field didn't exists anywhere] to the table.

dustintroop · ‎05-24-2020

dustintroop · ‎05-24-2020

I'm generating the output for Column 2, 3 from search. I want to add column to the start of the table. In the below example, I want to add the First Column "Product" with values "Product1" & "Product2". Please shed some light here. Appreciate your help in advance. example Product Pass Count Fail Count Product1 5 5 Product2 1 4

Posts	11
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎05-24-2020

Online Status	Offline
Date Last Visited	‎11-05-2020 09:16 PM

Splunk Base Search issues

String matches

Adding First Column to the Table

Re: Splunk Base Search issues

Re: Splunk Base Search issues

Re: Splunk Base Search issues

Splunk Base Search issues

Re: String matches

String matches

Re: Adding First Column to the Table

Re: Adding First Column to the Table

Re: Adding First Column to the Table

Re: Adding First Column to the Table

Adding First Column to the Table