About nikitha15

nikitha15 · ‎09-13-2021

Hi , I want to add a text box in a dashboard panel and the manual input value of that textbox should be added to a new column in an already existing table. I understand that this can be done by lookup to save the values but i am not sure how to go ahead with it. This is the data format of the table i have with sample data(the original data i have is confidential). EMAIL NAME IP ID(new column) nish123@gmail.com Nishanth 10.10.10.0 abc098@gmail.com ABC 224.0.0.0 amit187@gmail.com Amit Sharma 63.125.0.0 I want to add a text box to this panel whose values should be inputted into ID column based on the unique value of EMAIL. and i want to save this table with the new values of ID. How can this be done?? Any help would be appreciated.thanks

nikitha15 · ‎09-08-2021

Hi , I want to add a text box in a dashboard panel and the manual input value of that textbox should be added to a new column in an already existing table. I understand that this can be done by lookup to save the values but i am not sure how to go ahead with it. This is the data format of the table i have with sample data(the original data i have is confidential). EMAIL NAME IP ID(new column) nish123@gmail.com Nishanth 10.10.10.0 abc098@gmail.com ABC 224.0.0.0 amit187@gmail.com Amit Sharma 63.125.0.0 I want to add a text box to this panel whose values should be inputted into ID column based on the unique value of EMAIL. and i want to save this table with the new values of ID. How can this be done?? Any help would be appreciated.thanks

nikitha15 · ‎07-09-2021

Thanks a ton. This worked.

nikitha15 · ‎07-07-2021

Hi i have a json data which i am working on and i used fieldsummary to get data similar to below image. sample example: suppose i have my result like this I want to get count of value "Denver" in the field values from the above image. I tried spath but it's not working. output should be like: value Count Denver 1 Any help is appreciated. thanks.

nikitha15 · ‎03-15-2021

Hi all, I have only started working on splunk recently and i am stuck at one query. So, I have JSON data like below: catDevices: [ { model: A1_1234 Name: ZASNJHCDNA } { model: A1_5678 Name: JNDIHUEDHNJ }] Devices : [ JNDIHUEDHNJ NVBBVUYVBHI ] I want to compare "Devices" with caDevices{}.Name and if it matches i want to display Devices and model list. I tried this query index=main sourcetype=device |rename Devices{} as success | mvexpand success |dedup success |rename catDevices{}. model as Model ,rename catDevices{}.Name as device_name |eval zip = mvzip(Model, device_name) |fields - _raw |mvexpand zip | rex field = zip "(?<MODEL>.*),(?<DEVICE>.*)" | fields - zip | eval Status = if(match(MODEL,"A1*"), if(success == DEVICE, success, "NO MATCH"), "NO MATCH") | table success, MODEL, Status | where Status != "NO MATCH" | stats count(success) It worked but as the data increases , due to mvexpand threshold the result is not accurate. Can you please tell me how i can correct my query or if you can provide a different solution for my question, any help would be appreciated. thanks in advance.

nikitha15 · ‎06-18-2020

Hey everyone. I have never tried creating event annotation before so i am not able to grasp it properly. I want to show a line for both min and max values of a date field. For ex. Dates. Target 6/09/2020. X 6/10/2020. X . . . . 6/23/2020. X So the min and max values i.e 6/09/2020 and 6/23/2020 of dates field should be shown as lines (event annotation) . For now the dates in between shouldn't display but later i should be able to add data for any dates and it should show as line or area chart. And the event annotation should display target x and the date when we hover on that. All the examples i have seen of annotations are using timecharts . I want something like the mock image below. Any help would be great.Thanks.

nikitha15 · ‎06-16-2020

Hey everyone. I am a newbie to splunk and i am stuck at this problem. So i have a column chart which shows data for a time range between two dates ex. 6/9/2020-6/23/2020 like in the pic below. So the query i used for this is Index=main sourcetype = timeline | eval dates= beginning_date."-".ending_date | stats count by dates, target | xyseries dates target count So now what i want is...if i append another search to this which contains data on 6/15/2020, It is treating 6/15/2020 as a seperate date. Like this In the above image i want the line chart on date 2020-06-15 to go on to top of the column chart as that date lies in between 2020-06-09 - 2020-06-23(changed format of time).i want to overlay line chart on top of column chart. Here these are the fields i used beginning date. Ending date 6/9/2020. 6/23/2020 And i want to create the query with these fields and not _time. Any help is appreciated and if there is anything u didn't understand in my question plz let me know. Thanks a lot.

nikitha15 · ‎06-15-2020

Hi...ya this is working but one thing. Does this only work for _time , bcoz i have dates in a seperate field that i have created and if i give that field name it's not working. Or is it bcoz, i created that field so the dates are in a string format and not date format???can u plz help me with this

nikitha15 · ‎06-15-2020

Hi...i dnt think that is the way i want it to show. I have updated my question and added a pic ...plz check.

nikitha15 · ‎06-15-2020

Hi everyone, hope u r all doing good. So i have a query i am not able to figure out.I need to show a visualisation of column chart which shows each bar containing data between two dates. I'll explain it clearly. As u can see in the picture i attached...it shows a timeline visualisation and data between two dates 6/9/2020-6/23/2020. In the exact same way i want to show on a column chart. So that later if i add any data between those dates for ex. On 6/15/2020 and 6/16/2020 etc....and if i overlay it , it should show me a line chart on that column chart.I hope i am clear if not plz tell me. So the query that I used for that timeline graph is: Index= main sourcetype= timeline | rename "beginning_date" as start_date | rename "ending_date" as end_date | eval _time= strptime(start_date, "%m/%d/%Y") | eval end_time= strptime(end_date, "%m/%d/%Y") | eval duration = (end_time - _time) * 1000 | eval duration = IF(duration < 86400000, 0, duration) | stats count by _time, duration, "target" | table _time "target" duration so most of this query is from the timeline gallery example dashboard in Splunk. I don't think duration work with a column chart to show 6/9/2020-6/23/2020 format like this. I have two fields Beginning_date. Ending_date 6/9/2020. 6/23/2020 Like this and I need to show something like the below pic: It would be really helpful if anyone could help me with this. Thanks.

nikitha15 · ‎05-29-2020

I am still getting 34k as result .i need 40k. But thanks a lot , i learned a new approach.

nikitha15 · ‎05-29-2020

Hi all, so the question looks pretty simple but i am not able to figure out the accurate answer. So i need to find the count of common values between two different fields from two different sourcetypes . I have an index=main and two sourcetypes sourcetype1 and sourcetype2. These two sourcetypes each have a hostname field and i need to find the common values between the two hostname fields. The query i used is this: Index=main sourcetype=sourcetype1 | dedup hostname | table hostname | append [ search index=main sourcetype= sourcetype2 | dedup hostname | table hostname ] |table hostname | stats count by hostname | where count >1 The problem is the values in hostname field in sourcetype1 are almost 75k and values in hostname field in sourcetype2 are almost 90k. And i am getting a result of 22k by using that query. But the actual count of common values is almost 40k . So I don't understand where i am gng wrong. Can anyone plz tell me if my query is right or if there is any other approach to this i can use?? Thanks a lot.

nikitha15 · ‎05-28-2020

Hi, i am new to splunk so i am having a little bit of problem understanding the timestamp concept. So with the data that i am working the _time column has taken the date and time from event data. But i want the _time column to display date and time when i uploaded that data in splunk for indexing. So basically if this is the format: (Time ) Events (11/13/2019.2:30:20 ) 11-13-2019 14:30:20 So this is how the time is being taken from the event but i want it to change to the date 24th april, 2020 (04/24/2020) on which i uploaded the data . How can i do this?? Plz help me.

Posts	14
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎05-28-2020

Online Status	Offline
Date Last Visited	‎09-13-2021 01:43 PM

Add manual input through text box into a new colum...

Add manual input through text box into a new colu...

Find the count of a specific field value in json a...

compare two fields in json data and display data i...

Event annotation for the min and max value of a fi...

How to overlay line chart on a timerange column ch...

How to get a column chart to show count between tw...

How do i find common values between two different ...

How to change _time to the time when i uploaded th...