About madhav_dholakia

madhav_dholakia · ‎04-08-2025

thanks @richgalloway & @isoutamo - I did expand those searches and used the same to clone required panels under my App - only lookup I needed to clone was reserved_cidrs.csv. Thank you.

madhav_dholakia · ‎04-08-2025

Hello, I am facing an issue when a saved report is used in a simple xml dashboard using | loadjob savedsearch="madhav.d@xyz.com:App_Support:All Calls" My time zone preference is (GMT+01:00) Greenwich Mean Time : London and the report I am referring to (All Calls) is also created by me and runs every 15 mins. Now, when I use this report in a simple xml dashboard, it only provided data as on an hour ago. Example: when the report runs at 08:00 AM and I check dashboard at 08:05 AM, it will show report results for 07:00 AM run and not the latest. I expect this to be due to recent day light saving time changes in UK. Can someone please help how should I handle this? Thank you. Regards, Madhav

madhav_dholakia · ‎04-01-2025

Hello, I would like to clone cloud monitoring console dashboard (Forwarders tab) for only a specific set of HF/UF (and not all). I would like to make this dashboard available in one of the app used by service desk for monitoring. how can I achieve this? Thank you.

madhav_dholakia · ‎03-18-2025

thanks @dural_yyz - this is for Simple XML Dashboards if I understood correctly? I am using dashboard studio. I got this fixed, thanks to this response on Slack Splunk Community. Fix: Search 1 refers to all of those tokens in the final eval but you haven’t defined them. Are you meaning to use the fields you’ve defined in the previous eval statements? If so, you just need to remove the $$ from around the field names in that final eval in search 1 updated Search 1: | makeresults | eval spantime=case($timerange|s$="| where calldate>=relative_time(now(),\"@mon\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"@d\") AND calldate<relative_time(now(),\"@m\")","1h",$timerange|s$="| where calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"-7d@d\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"-24h@h\") AND calldate<relative_time(now(),\"@h\")","1h",true(),"1d") | eval startOfMonth=relative_time(now(),"@mon") | eval noOfDays=round((now()-startOfMonth)/86400) | eval startOfDay=relative_time(now(),"@d") | eval noOfHours=round((now()-startOfDay)/3600-1) | eval topvalues=case($timerange|s$="| where calldate>=relative_time(now(),\"@mon\") AND calldate<relative_time(now(),\"@d\")",noOfDays,$timerange|s$="| where calldate>=relative_time(now(),\"@d\") AND calldate<relative_time(now(),\"@m\")",$noOfHours$,$timerange|s$="| where calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\")","30",$timerange|s$="| where calldate>=relative_time(now(),\"-7d@d\") AND calldate<relative_time(now(),\"@d\")","7",$timerange|s$="| where calldate>=relative_time(now(),\"-24h@h\") AND calldate<relative_time(now(),\"@h\")","24",true(),"1d") Thank you.

madhav_dholakia · ‎03-12-2025

Hello, I am creating a dashboard with below searches to customize number of data points and time span displayed (using timechart) when different timerange is selected. Search 1 - Chart Span: based on, custom timerange token, this returns span period and top values to be used in Search 3, given below. | makeresults | eval spantime=case($timerange|s$="| where calldate>=relative_time(now(),\"@mon\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"@d\") AND calldate<relative_time(now(),\"@m\")","1h",$timerange|s$="| where calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"-7d@d\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"-24h@h\") AND calldate<relative_time(now(),\"@h\")","1h",true(),"1d") | eval startOfMonth=relative_time(now(),"@mon") | eval noOfDays=round((now()-startOfMonth)/86400) | eval startOfDay=relative_time(now(),"@d") | eval noOfHours=round((now()-startOfDay)/3600-1) | eval topvalues=case($timerange|s$="| where calldate>=relative_time(now(),\"@mon\") AND calldate<relative_time(now(),\"@d\")",$noOfDays$,$timerange|s$="| where calldate>=relative_time(now(),\"@d\") AND calldate<relative_time(now(),\"@m\")","$noOfHours$",$timerange|s$="| where calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\")","30",$timerange|s$="| where calldate>=relative_time(now(),\"-7d@d\") AND calldate<relative_time(now(),\"@d\")","7",$timerange|s$="| where calldate>=relative_time(now(),\"-24h@h\") AND calldate<relative_time(now(),\"@h\")","24",true(),"1d") Search 2 - Saved Search: this is a report returning below fields: | table Date Duration "Handled by" Queue _time Search 3 - Chart: using Search 2 as base search and search result token values from Search 1: | timechart span=$Chart Span:result.spantime$ count as HourlyCalls | sort $Chart Span:result.topvalues$ -_time now, when I load the dashboard, default timerange is calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\") , based on this I would expect Search 3 as, | timechart span=1d count as HourlyCalls | sort 30 -_time but it shows below error message: Set token value to render visualization $noOfDays$ $noOfHours$ $spantime$ $topvalues$ can someone please suggest what is wrong here and how can I fix this? Thank you.

madhav_dholakia · ‎02-10-2025

Hi @tscroggins - thanks for the pointer - I removed datasources { ... } from this defaults section and kept only tokens { ... } - and it worked.

madhav_dholakia · ‎02-06-2025

Hello, I am using multiple tokens on a dashboard created in Dashboard Studio and have added default values for the same in json source. When I save and reload the dashboard, these default values for tokens are removed and table viz (using these tokens) is showing as blank Can you please suggest how can I fix this? Thank you. "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": {} } } }, "tokens": { "default": { "tokStatus": { "value": "Status=\"*\"" }, "tokPlannedStartDt": { "value": "LIKE(isPlannedStartDtPassed,\"%\")" }, "tokPlannedEndDt": { "value": "LIKE(isPlannedEndDtPassed,\"%\")" } } } }

madhav_dholakia · ‎12-26-2024

Hello, I am looking to add a UK Map on dashboard studio to show number of open issues (ITSM Data) and RAG Status for Flagship Stores available in different cities like, London, York, Bristol, Liverpool etc. My Search Output looks like, StoreID, City, OpenIssues, Status Store 1, London, 3, Critical/Red Store 2, York, 2, Warning/Amber Store 3, Bristol, 0, Dormant/Green Store 4, Liverpool, 1, Warning/Amber can someone please suggest if/how this can be done? Thank you.

madhav_dholakia · ‎12-09-2024

Hi @Sabahat - apologies for very late repsonse , I hope this has been already resolved but if not, this is visible for sc_admin role, I am not sure about Power User. Thank you.

madhav_dholakia · ‎06-10-2024

Hi @WilmarMeyer - this is on Splunk Side: Server Settings->IP Allow List Management-> "Search Head API Access".

madhav_dholakia · ‎06-09-2024

Hi @marysan - please see attached screenshots for Alert Configuration.

madhav_dholakia · ‎06-07-2024

Hello @marysan - thanks for this. I have created this email_subject field and when used within Email Body $email_subject$, it worked fine but not when used in Email Subject. Can you please suggest if I am missing something? | eval email_subject=MonthYear." - ".Customer." - ".CheckName." - ".Device Thank you.

madhav_dholakia · ‎06-04-2024

thanks @KendallW - I think $result.field$ will not work in this scenario? I am already using he subject line as you mentioned but it is having a blank value (in Email I receive) for the variables.

madhav_dholakia · ‎05-22-2024

Hello, I have an alert setup which reads a lookup file (populated by another report) and if there are any records in the lookup file, emails should be triggered (one for each record). I understand this can be done using trigger "for each result" but I want to use some field values from each record and use it as an email subject. Example: in this case, I want 6 emails to be triggered with subject lines as, Email 1: Selfheal Alert - Cust A - Tomcat Stopped - Device A1- May-24 - Device Level Email 2: Selfheal Alert - Cust A - Tomcat Stopped - Device A2- May-24 - Device Level Email 3: Selfheal Alert - Cust B - Failed Job - Device B1- May-24 - Device Level Email 4: Selfheal Alert - Cust C - Tomcat Stopped - Device C1- May-24 - Device Level Email 5: Selfheal Alert - Cust C - Failed Job- Device C2- May-24 - Device Level Email 6: Selfheal Alert - Cust C - Failed Job - Device C3- May-24 - Device Level How can I achieve this? Thank you.

madhav_dholakia · ‎03-01-2024

below response from Antony Bowesman on Slack Channel worked like a charm for Simple XML Dashboard! The challenge you have it to set the colour depending on the values from two different columns, which is not possible without a hack or JS. The hack is something like this <panel> <html depends="$hidden$"> <style> #coloured_cell2 table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="coloured_cell2"> <title>Colouring a table cell based on it's relative comparison to another cell</title> <search> <query>| makeresults | fields - _time | eval r=mvrange(1,6,1) | mvexpand r | eval cust="Cust".r | fields - r | eval sla=random() % 100 | eval type=case((match(cust,"Cust1|Cust3|Cust4") AND sla>=90) OR (match(cust,"Cust2|Cust5") AND sla>=95), 0, (match(cust,"Cust1|Cust3|Cust4") AND sla>=85 AND sla<90) OR (match(cust,"Cust2|Cust5") AND sla>=90 AND sla<95), 1, (match(cust,"Cust1|Cust3|Cust4") AND sla<85) OR (match(cust,"Cust2|Cust5") AND sla<90), 2) | eval sla=mvappend(sla, type) | table cust sla type</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="sla"> <colorPalette type="expression">case(mvindex(value, 1) == "0", "#00FF00", mvindex(value, 1) == "1", "#FFFF00", true(), "#FF0000")</colorPalette> </format> <drilldown> <set token="explode_search_id">coloured_cell2</set> </drilldown> </table> </panel> what this shows is that you have to make the column you want to colour a multivalue field, where you set the second value of that field the other condition you want to check with the expression. The second value of the field is 'hidden' through the use of CSS (note id=coloured_cell). You will need to set the colour type in the search, as there are problems handling complex multivalue statements in the colorPalette expressions, so here it is 0 for green, 1 for amber and 2 for red. ------------------------------------------------------ below response from Lizzy Li on Slack Channel worked like a charm for DS Dashboard! I would recommend doing that logic in the search and adding another column which specifies the color. Then you make it so that sla is colored based on the value in the color field here i am coloring the product field based on whether there is inventory available. source code looks something like this: { "type": "splunk.table", "dataSources": { "primary": "ds_khzrqtty" }, "title": "Table hiding internal fields - colored by inventory", "options": { "columnFormat": { "_inventory": { "data": "> table | seriesByName(\"_inventory\") | formatByType(_inventoryColumnFormatEditorConfig)", "rowColors": "> table | seriesByName(\"_inventory\") | rangeValue(_inventoryRowColorsEditorConfig)" }, "product": { "data": "> table | seriesByName(\"product\") | formatByType(productColumnFormatEditorConfig)", "rowColors": "> table | seriesByName(\"_inventory\") | rangeValue(_inventoryRowColorsEditorConfig)" } }, "showInternalFields": false }, "context": { "_inventoryColumnFormatEditorConfig": { "number": { "thousandSeparated": false, "unitPosition": "after" } }, "_inventoryRowColorsEditorConfig": [ { "value": "#D41F1F", "to": 1 }, { "value": "#118832", "from": 1 } ], "productColumnFormatEditorConfig": { "string": { "unitPosition": "after" } } }, "description": "Has inventory = green", "showProgressBar": false, "showLastUpdated": false, "hideWhenNoData": false } as you can see, i also made _inventory an internal field so that i could hide it from the display but still use it to color other fields Thank you.

madhav_dholakia · ‎02-27-2024

Hello, after checking this with Splunk Support Team - it was just a case of adding IP (of system where PowerBI Desktop is hosted) to allow list under Server Settings->IP Allow List Management-> "Search Head API Access". Thank you. Regards, Madhav

madhav_dholakia · ‎02-27-2024

--updated this question to achieve the same behavior on DS Dashboard Hello, I have a table viz on my dashboards (simple XML and DS Dashboards) - sample data as given below. | makeresults format=csv data="cust, sla Cust1,85 Cust2,96 Cust3,99 Cust4,89 Cust5,100" | fields cust, sla How can I colour code "sla" column based on given conditions in both Simple XML (without using javascript) and DS dashboards? if (cust IN (Cust1,Cust3,Cust4) AND sla>=90) OR (cust IN (Cust2,Cust5) AND sla>=95) -> Green if (cust IN (Cust1,Cust3,Cust4) AND sla>=85 AND sla<90) OR (cust IN (Cust2,Cust5) AND sla>=90 AND sla<95) -> Amber if (cust IN (Cust1,Cust3,Cust4) AND sla<85) OR (cust IN (Cust2,Cust5) AND sla<90) -> Red Thank you. Regards, Madhav

madhav_dholakia · ‎02-19-2024

Hello, We are trying to achieve Power BI integration with Splunk. We have Power BI installed on windows machine and we also installed ODBC driver to connect to Splunk. As part of configuration we added credentials (same with which we connect to our splunk cloud instance) and URL in Power BI Get Data options but we are getting below error: Steps: POWER BI Desktop -> Get Data -> Other -> ODBC -> and when clicked ok, above mentioned error is displayed. Can you please suggest how I can fix this? Thank you.

madhav_dholakia · ‎01-12-2024

ok, if I use Percentage instead of Value - it gives 2 decimal points. Thank you.

madhav_dholakia · ‎01-12-2024

Hello, I am using a Filler Gauge in one of my dashboards and I would like to use values with 2 decimal values, but I do not see any precision option for Gauge Viz. for example, I would like to display this as 99.60 and not 100. Is it not possible to do at the moment in dashboard studio or is there any workaround available to achieve this? Thank you.

madhav_dholakia · ‎01-10-2024

Hi @ITWhisperer - thanks a lot, this worked like a charm.

madhav_dholakia · ‎01-10-2024

Hello, I have seen a few of the spath topics around, but wasn't able to understand enough to make it work for my data. I would like to create a line chart using pointlist values - it contains timestamp in epoch and CPU% Search I tried but not working as expected to extract this data: index="splunk_test" source="test.json" | spath output=pointlist path=series{}.pointlist{}{} | mvexpand pointlist | table pointlist Please see below sample json. {"status": "ok", "res_type": "time_series", "resp_version": 1, "query": "system.cpu.idle{*}", "from_date": 1698796800000, "to_date": 1701388799000, "series": [{"unit": [{"family": "percentage", "id": 17, "name": "percent", "short_name": "%", "plural": "percent", "scale_factor": 1.0}, null], "query_index": 0, "aggr": null, "metric": "system.cpu.idle", "tag_set": [], "expression": "system.cpu.idle{*}", "scope": "*", "interval": 14400, "length": 180, "start": 1698796800000, "end": 1701388799000, "pointlist": [[1698796800000.0, 67.48220718526889], [1698811200000.0, 67.15981521730248], [1698825600000.0, 67.07217666403122], [1698840000000.0, 64.72434584884627], [1698854400000.0, 64.0411289094932], [1698868800000.0, 64.17585938553243], [1698883200000.0, 64.044969119166], [1698897600000.0, 63.448143595246194], [1698912000000.0, 63.80226399404451], [1698926400000.0, 63.93216493520908], [1698940800000.0, 63.983679174088145], [1701331200000.0, 63.3783379315815], [1701345600000.0, 63.45321248782884], [1701360000000.0, 63.452383398041064], [1701374400000.0, 63.46314971048991]], "display_name": "system.cpu.idle", "attributes": {}}], "values": [], "times": [], "message": "", "group_by": []} can you please help how I can achieve this? Thank you. Regards, Madhav

madhav_dholakia · ‎01-03-2024

Hi, is it possible to change the date format to YYYY-MM-DD and then something like this? | chart sum(sats) over team by Date useother=false | sort 13 Date Thank you.

madhav_dholakia · ‎01-03-2024

Hi @bigll - I would use strptime() and strftime() for any changes with Date and/or Time Format. | makeresults | eval myfield="2020-11-25T11:40:42.001198Z" | eval myfieldepoch=strptime(myfield,"%Y-%m-%dT%H:%M:%S.%6NZ") | eval UpdateDate=strftime(myfieldepoch,"%Y-%m-%d") | eval UpdateTime=strftime(myfieldepoch,"%H:%M:%S.%1N") | table _time myfield myfieldepoch UpdateDate UpdateTime Thank you.

madhav_dholakia · ‎01-03-2024

Hello @petra_bee, Hello @letsgopats39, Did this resolve your query? If yes then please mark the answer as "Accepted" for other community users. Thank you. P.S.: Karma Points are appreciated

Posts	109
Solutions	4
Karma Given	45
Karma Received	7
Member Since	‎04-27-2020

Online Status	Offline
Date Last Visited	‎04-07-2025 11:58 PM

Saved Search ( Scheduled Report) in Simple XML Das...

Splunk Cloud Monitoring Console

Dashboard Studio - Search Result as Token

Default Token Values in Dashboard Studio

Dashboard Studio - UK Map Visulisation

Using Tokens in Alert Email

Simple XML Dashboard & DS Dashboard - Table Column...

Integrating Power BI to Splunk

Filler Gauge - Precision Value

Need help with json spath search

Re: Splunk Cloud Monitoring Console

Saved Search ( Scheduled Report) in Simple XML Das...

Splunk Cloud Monitoring Console

Re: Dashboard Studio - Search Result as Token

Dashboard Studio - Search Result as Token

Re: Default Token Values in Dashboard Studio

Default Token Values in Dashboard Studio

Dashboard Studio - UK Map Visulisation

Re: Integrating Power BI to Splunk

Re: Integrating Power BI to Splunk

Re: Using Tokens in Alert Email

Re: Using Tokens in Alert Email

Re: Using Tokens in Alert Email

Using Tokens in Alert Email

Re: Simple XML Dashboard & DS Dashboard - Table Co...

Re: Integrating Power BI to Splunk

Simple XML Dashboard & DS Dashboard - Table Column...

Integrating Power BI to Splunk

Re: Filler Gauge - Precision Value

Filler Gauge - Precision Value

Re: Need help with json spath search

Need help with json spath search

Re: chart by date ignoring year

Re: Date and Time fields from the string

Re: How to hide Splunk Bar and Edit in Dashboard S...

Are you a member of the Splunk Community?