About madhav_dholakia

madhav_dholakia · ‎03-01-2024

below response from Antony Bowesman on Slack Channel worked like a charm for Simple XML Dashboard! The challenge you have it to set the colour depending on the values from two different columns, which is not possible without a hack or JS. The hack is something like this <panel> <html depends="$hidden$"> <style> #coloured_cell2 table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="coloured_cell2"> <title>Colouring a table cell based on it's relative comparison to another cell</title> <search> <query>| makeresults | fields - _time | eval r=mvrange(1,6,1) | mvexpand r | eval cust="Cust".r | fields - r | eval sla=random() % 100 | eval type=case((match(cust,"Cust1|Cust3|Cust4") AND sla>=90) OR (match(cust,"Cust2|Cust5") AND sla>=95), 0, (match(cust,"Cust1|Cust3|Cust4") AND sla>=85 AND sla<90) OR (match(cust,"Cust2|Cust5") AND sla>=90 AND sla<95), 1, (match(cust,"Cust1|Cust3|Cust4") AND sla<85) OR (match(cust,"Cust2|Cust5") AND sla<90), 2) | eval sla=mvappend(sla, type) | table cust sla type</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="sla"> <colorPalette type="expression">case(mvindex(value, 1) == "0", "#00FF00", mvindex(value, 1) == "1", "#FFFF00", true(), "#FF0000")</colorPalette> </format> <drilldown> <set token="explode_search_id">coloured_cell2</set> </drilldown> </table> </panel> what this shows is that you have to make the column you want to colour a multivalue field, where you set the second value of that field the other condition you want to check with the expression. The second value of the field is 'hidden' through the use of CSS (note id=coloured_cell). You will need to set the colour type in the search, as there are problems handling complex multivalue statements in the colorPalette expressions, so here it is 0 for green, 1 for amber and 2 for red. ------------------------------------------------------ below response from Lizzy Li on Slack Channel worked like a charm for DS Dashboard! I would recommend doing that logic in the search and adding another column which specifies the color. Then you make it so that sla is colored based on the value in the color field here i am coloring the product field based on whether there is inventory available. source code looks something like this: { "type": "splunk.table", "dataSources": { "primary": "ds_khzrqtty" }, "title": "Table hiding internal fields - colored by inventory", "options": { "columnFormat": { "_inventory": { "data": "> table | seriesByName(\"_inventory\") | formatByType(_inventoryColumnFormatEditorConfig)", "rowColors": "> table | seriesByName(\"_inventory\") | rangeValue(_inventoryRowColorsEditorConfig)" }, "product": { "data": "> table | seriesByName(\"product\") | formatByType(productColumnFormatEditorConfig)", "rowColors": "> table | seriesByName(\"_inventory\") | rangeValue(_inventoryRowColorsEditorConfig)" } }, "showInternalFields": false }, "context": { "_inventoryColumnFormatEditorConfig": { "number": { "thousandSeparated": false, "unitPosition": "after" } }, "_inventoryRowColorsEditorConfig": [ { "value": "#D41F1F", "to": 1 }, { "value": "#118832", "from": 1 } ], "productColumnFormatEditorConfig": { "string": { "unitPosition": "after" } } }, "description": "Has inventory = green", "showProgressBar": false, "showLastUpdated": false, "hideWhenNoData": false } as you can see, i also made _inventory an internal field so that i could hide it from the display but still use it to color other fields Thank you.

madhav_dholakia · ‎02-27-2024

Hello, after checking this with Splunk Support Team - it was just a case of adding IP (of system where PowerBI Desktop is hosted) to allow list under Server Settings->IP Allow List Management-> "Search Head API Access". Thank you. Regards, Madhav

madhav_dholakia · ‎02-27-2024

--updated this question to achieve the same behavior on DS Dashboard Hello, I have a table viz on my dashboards (simple XML and DS Dashboards) - sample data as given below. | makeresults format=csv data="cust, sla Cust1,85 Cust2,96 Cust3,99 Cust4,89 Cust5,100" | fields cust, sla How can I colour code "sla" column based on given conditions in both Simple XML (without using javascript) and DS dashboards? if (cust IN (Cust1,Cust3,Cust4) AND sla>=90) OR (cust IN (Cust2,Cust5) AND sla>=95) -> Green if (cust IN (Cust1,Cust3,Cust4) AND sla>=85 AND sla<90) OR (cust IN (Cust2,Cust5) AND sla>=90 AND sla<95) -> Amber if (cust IN (Cust1,Cust3,Cust4) AND sla<85) OR (cust IN (Cust2,Cust5) AND sla<90) -> Red Thank you. Regards, Madhav

madhav_dholakia · ‎02-19-2024

Hello, We are trying to achieve Power BI integration with Splunk. We have Power BI installed on windows machine and we also installed ODBC driver to connect to Splunk. As part of configuration we added credentials (same with which we connect to our splunk cloud instance) and URL in Power BI Get Data options but we are getting below error: Steps: POWER BI Desktop -> Get Data -> Other -> ODBC -> and when clicked ok, above mentioned error is displayed. Can you please suggest how I can fix this? Thank you.

madhav_dholakia · ‎01-12-2024

ok, if I use Percentage instead of Value - it gives 2 decimal points. Thank you.

madhav_dholakia · ‎01-12-2024

Hello, I am using a Filler Gauge in one of my dashboards and I would like to use values with 2 decimal values, but I do not see any precision option for Gauge Viz. for example, I would like to display this as 99.60 and not 100. Is it not possible to do at the moment in dashboard studio or is there any workaround available to achieve this? Thank you.

madhav_dholakia · ‎01-10-2024

Hi @ITWhisperer - thanks a lot, this worked like a charm.

madhav_dholakia · ‎01-10-2024

Hello, I have seen a few of the spath topics around, but wasn't able to understand enough to make it work for my data. I would like to create a line chart using pointlist values - it contains timestamp in epoch and CPU% Search I tried but not working as expected to extract this data: index="splunk_test" source="test.json" | spath output=pointlist path=series{}.pointlist{}{} | mvexpand pointlist | table pointlist Please see below sample json. {"status": "ok", "res_type": "time_series", "resp_version": 1, "query": "system.cpu.idle{*}", "from_date": 1698796800000, "to_date": 1701388799000, "series": [{"unit": [{"family": "percentage", "id": 17, "name": "percent", "short_name": "%", "plural": "percent", "scale_factor": 1.0}, null], "query_index": 0, "aggr": null, "metric": "system.cpu.idle", "tag_set": [], "expression": "system.cpu.idle{*}", "scope": "*", "interval": 14400, "length": 180, "start": 1698796800000, "end": 1701388799000, "pointlist": [[1698796800000.0, 67.48220718526889], [1698811200000.0, 67.15981521730248], [1698825600000.0, 67.07217666403122], [1698840000000.0, 64.72434584884627], [1698854400000.0, 64.0411289094932], [1698868800000.0, 64.17585938553243], [1698883200000.0, 64.044969119166], [1698897600000.0, 63.448143595246194], [1698912000000.0, 63.80226399404451], [1698926400000.0, 63.93216493520908], [1698940800000.0, 63.983679174088145], [1701331200000.0, 63.3783379315815], [1701345600000.0, 63.45321248782884], [1701360000000.0, 63.452383398041064], [1701374400000.0, 63.46314971048991]], "display_name": "system.cpu.idle", "attributes": {}}], "values": [], "times": [], "message": "", "group_by": []} can you please help how I can achieve this? Thank you. Regards, Madhav

madhav_dholakia · ‎01-03-2024

Hi, is it possible to change the date format to YYYY-MM-DD and then something like this? | chart sum(sats) over team by Date useother=false | sort 13 Date Thank you.

madhav_dholakia · ‎01-03-2024

Hi @bigll - I would use strptime() and strftime() for any changes with Date and/or Time Format. | makeresults | eval myfield="2020-11-25T11:40:42.001198Z" | eval myfieldepoch=strptime(myfield,"%Y-%m-%dT%H:%M:%S.%6NZ") | eval UpdateDate=strftime(myfieldepoch,"%Y-%m-%d") | eval UpdateTime=strftime(myfieldepoch,"%H:%M:%S.%1N") | table _time myfield myfieldepoch UpdateDate UpdateTime Thank you.

madhav_dholakia · ‎01-03-2024

Hello @petra_bee, Hello @letsgopats39, Did this resolve your query? If yes then please mark the answer as "Accepted" for other community users. Thank you. P.S.: Karma Points are appreciated

madhav_dholakia · ‎01-03-2024

Hi @VatsalJagani - In my data source, after making changes as below - this worked as expected. This was suggested by Camden Marchetti in Slack Splunk Usergroup. From: | eval epoch=relative_time(now(),$temp$) To: | eval epoch=relative_time(now(),$$temp$$) Thank you very much for your inputs on this as well as my other questions in this forum.

madhav_dholakia · ‎01-03-2024

thanks @shoaibalimir - Hi @richgalloway, Shoaib is my colleague and these are the limitations due to which we are not using Add-on. Can you please suggest what are the alternates? Thank you.

madhav_dholakia · ‎12-27-2023

Hi @VatsalJagani - apologies for the delayes response. Yes, that static Month is already in place. I have got 35 dashboards having three different Time ranges available to select in the dropdown (Last Month, Last to Last Month, Month To Date) - so I am looking for the header to update based on the time range selected. For example, if I run this report today for "Last Month" - Report Title would be Monthly Report - Nov 2023 if I run this report today for "Last to last Month" - Report Title would be Monthly Report - Oct 2023 if I run this report today for "Month to date" - Report Title would be Monthly Report - Dec 2023 Thank you.

madhav_dholakia · ‎12-20-2023

Hi, to hide edit button, I use this option in Canvas Config. Also, there is an idea "in Development" to allow Hide Splunk Bar in Dashboard Studio. Thank you.

madhav_dholakia · ‎12-20-2023

thanks @richgalloway - yes, we looked at this Add-on but we found some limitations w.r.t. our use case - Please allow me some time and I will share more details on the use case.

madhav_dholakia · ‎12-20-2023

Hello, I am creating a dashboard in Dashboard Studio and wanted to have just 3 timeranges available for a user: Last Month ("-mon@mon" to "@mon") Last to last Month ("-2mon@mon" to "-mon@mon") Month to date ("@mon" to "@d") I think I can get all these options in the default timerange input as well, but I do not want User to select anything other than these 3 options - and this is something I cannot prevent when using default timerange input (or at least I am not sure how do I do that, until and unless I create a separate user role with specific time ranges allowed, may be). so as a work around, I have created a drop down with these 3 token labels and values are set in form of relative_time function, i.e., where tempDt>=relative_time(now(),"-mon@mon") and tempDt<relative_time(now(),"@mon") where tempDt>=relative_time(now(),"@mon") and tempDt<relative_time(now(),"@d") where tempDt>=relative_time(now(),"-2mon@mon") and tempDt<relative_time(now(),"-mon@mon") in the main search (not available on demo dashboard definition shared here) I am using a variable tempDt and then one of the token value will filter data based on this tempDt. index=abc earliest="-2mon@mon" ```there exist a field called tempDt``` $timerange$ All this worked as expected - no issues. ------------------------------------------------------------------------------------------------------------------------ Now, I also want to display Month Name in Dashboard Header (created using Markdown Text) based on Token Value, if Last Month then strftime(relative_time(now(),"-mon@mon"),"%b-%Y") if Last to last month then strftime(relative_time(now(),"-2mon@mon"),"%b-%Y") if Month To Date then strftime(relative_time(now(),"@mon"),"%b-%Y") Please see below dashboard source code that I have tried but Markdown text is not populated with the Month Name - when I run the same search outside dashboard, it works ok. { "visualizations": { "viz_q7o2tu52": { "type": "splunk.markdown", "options": { "markdown": "### **Monthly Service Review ($MD Search:result.month$)**" } } }, "dataSources": { "ds_zBQAeHol": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults \n| eval temp=case(LIKE($timerange|s$,\"%-2mon@mon%\"),\"-2mon@mon\",LIKE($timerange|s$,\"%-mon@mon%\"),\"-mon@mon\",LIKE($timerange|s$,\"%@d%\"),\"@mon\",true(),\"@d\")\n| eval epoch=relative_time(now(),$temp$)\n| eval month=strftime(epoch,\"%b-%Y\")\n| table month", "queryParameters": { "earliest": "-24h@h", "latest": "now" } }, "name": "MD Search" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "options": { "items": [ { "label": "Last Month", "value": "where tempDt>=relative_time(now(),\"-mon@mon\") and tempDt<relative_time(now(),\"@mon\")" }, { "label": "Month to Date", "value": "where tempDt>=relative_time(now(),\"@mon\") and tempDt<relative_time(now(),\"@d\")" }, { "label": "Last to last Month", "value": "where tempDt>=relative_time(now(),\"-2mon@mon\") and tempDt<relative_time(now(),\"-mon@mon\")" } ], "defaultValue": "where tempDt>=relative_time(now(),\"-mon@mon\") and tempDt<relative_time(now(),\"@mon\")", "token": "timerange" }, "title": "Time Range", "type": "input.dropdown" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "input_global_trp", "type": "input", "position": { "x": 640, "y": 130, "w": 198, "h": 82 } }, { "item": "viz_q7o2tu52", "type": "block", "position": { "x": 540, "y": 30, "w": 400, "h": 90 } } ], "globalInputs": [] }, "description": "", "title": "MD Markdown Token Test" } Can you please help how can I achieve this? Thank you. Regards, Madhav

madhav_dholakia · ‎12-20-2023

Hello, What are the best methods to ingest Datadog Log and Metrics Data into Splunk Cloud/HF? We have a requirement to fetch datadog dashboard and populate it to Splunk Dashboard. Thank you. Regards, Madhav

madhav_dholakia · ‎12-20-2023

apologies for the delayed response - I am getting this checked from Couchbase side if raw data there showing the same values. Thank you.

madhav_dholakia · ‎12-14-2023

thanks @VatsalJagani - Couchbase JSON Document is also showing 17 and not 17.0 so here, Source System (Couchbase) and Splunk Record (when viewed as "highlight syntax") are same, its just Splunk Record _raw is different. What could be possibly causing this? Thank you.

madhav_dholakia · ‎12-13-2023

Hi, we are ingesting Couchbase JSON Documents into Splunk Cloud using Kafka. When I open the same document (1st one ingested in Splunk - _raw and 2nd one is Couchbase JSON) and compare in Visual Studio Code, I can see differences as shown below: Splunk syntax highlighted data for this record is identical to original Couchbase JSON. Can you please help me understand why _raw is showing this data differently and also is there any way to get _raw data in the same format at original JSON? Thank you.

madhav_dholakia · ‎12-10-2023

thanks @PickleRick , that was helpful - for now I am settled with below approach and will monitor if this is causing any more issues: I have created a saved search (Report) to run evey minute and then dashboard panels are using | loadjob and refreshes every 15 seconds.

madhav_dholakia · ‎12-10-2023

thanks @gcusello - only reason to refresh panels every 15 seconds is to get the results from last executed report run in 15 seconds, rather than to wait for a minute to see the latest results on dashboard once report run is completed. Thank you for your help on this.

madhav_dholakia · ‎12-08-2023

thsnks @gcusello - I got your point. why this needs to be almost realtime is, because it includes Live Calls Data so as soon as a call is landed, it should be reflected on this dashboard. for now, as you suggested, I have created a saved search (Report) to run evey minute and then dashboard panels are using | loadjob and refreshes every 15 seconds. Alternately, if I create a Splunk User with only (and limited) access to this dashboard and then it can be used by anyone who wants to access this dashboard - in this case I would expect multiple search job requests won't be submitted hence this should not cause performance issues I am seeing currently - is this understading correct? Thank you.

madhav_dholakia · ‎12-08-2023

yes, but then it won't be a near realtime which is required. any other option to recreate this dashboard so that we can get data refreshed every 10 (or 15) seconds? Thank you.

Posts	95
Solutions	3
Karma Given	38
Karma Received	5
Member Since	‎04-27-2020

Online Status	Offline
Date Last Visited	‎03-04-2024 05:21 AM

Simple XML Dashboard & DS Dashboard - Table Column...

Integrating Power BI to Splunk

Filler Gauge - Precision Value

Need help with json spath search

Splunk Dashboard Studio - Markdown Text

Splunk Integration with Datadog

Splunk Event _raw data is different from Source Ev...

(Near) Realtime Search - Simple XML Dashboard

Simple XML Dashboard - Table Panel Formating Query

RegEx Help - how to extract the numbers from strin...

Re: Simple XML Dashboard & DS Dashboard - Table Co...

Re: Integrating Power BI to Splunk

Simple XML Dashboard & DS Dashboard - Table Column...

Integrating Power BI to Splunk

Re: Filler Gauge - Precision Value

Filler Gauge - Precision Value

Re: Need help with json spath search

Need help with json spath search

Re: chart by date ignoring year

Re: Date and Time fields from the string

Re: How to hide Splunk Bar and Edit in Dashboard S...

Re: Splunk Dashboard Studio - Markdown Text

Re: Splunk Integration with Datadog

Re: Splunk Dashboard Studio - Markdown Text

Re: How to hide Splunk Bar and Edit in Dashboard S...

Re: Splunk Integration with Datadog

Splunk Dashboard Studio - Markdown Text

Splunk Integration with Datadog

Re: Splunk Event _raw data is different from Sourc...

Re: Splunk Event _raw data is different from Sourc...

Splunk Event _raw data is different from Source Ev...

Re: (Near) Realtime Search - Simple XML Dashboard

Re: (Near) Realtime Search - Simple XML Dashboard

Re: (Near) Realtime Search - Simple XML Dashboard

Re: (Near) Realtime Search - Simple XML Dashboard