About tsmithsplunk

tsmithsplunk · ‎07-10-2017

Thanks for the ideas. I will be specific with the dedup & fields statements and see if that helps. Do you know if the maxresultrows default value has changed since v5.0?

tsmithsplunk · ‎07-10-2017

There's nothing at all complicated in these searches. Here's a sample: index=x sourcetype=y (keyword OR keyword) (keyword OR keyword OR keyword) | dedup _raw | eval WaitTime=totalTimeCreateToFinish/60000 - timeStartToFinish/60000 | eval runTime=timeStartToFinish/60000 | eval type=replace(name, "blah", "") | eval type=replace(type, "blah", "") | eval type=replace(type, "blah", "") | fields *

tsmithsplunk · ‎07-10-2017

I am revamping a dashboard that was written using Splunk 5.0.14 to Splunk 6.2.5. I have both versions running on top of the same events. I noticed that my v6 dashboard has incorrect counts for all of my charts. These are month long views of different stats (like -1mon@mon TO @mon ), so there are a lot of events involved - and all the searches are saved and scheduled. When I run the v6 searches for a smaller time range (interactively), say a few days, then the counts are accurate. So I'm assuming there is some implicit return limit on searches that was not in place in v5.0.14. How can I increase the limit on my saved searches? Thanks!

tsmithsplunk · ‎06-22-2017

That makes sense. I'll try to refactor my search to see if that helps. But if loadjob can't guarantee field order then I suppose my only choice is to switch over to real time searches and let the users wait. Thanks!

tsmithsplunk · ‎06-22-2017

I found an old post with a possible solution: https://answers.splunk.com/answers/39664/dynamic-saved-search-foo-substitution.html But for some reason it doesn't quite work. When I run the saved search using "loadjob" from the search bar in Splunk it looks correct. When I embed it in a Search module it mangles the series so that the X axis is no longer time but one of the field's output. This is my search module: <module name="Search" layoutPanel="panel_row2_col1" autoRun="False"> <param name="search">| loadjob savedsearch="xxx:search:JobDistribution$view_month$"</param> <module name="HTML"> <param name="html"><![CDATA[<div style="font-weight:bold; color:green">Job Distribution</div>]]></param> <module name="HiddenChartFormatter"> <param name="charting.axisTitleY.text">Job Count</param> <param name="charting.legend.placement">bottom</param> <param name="charting.chart">line</param> <param name="charting.axisTitleX.text"></param> <param name="charting.axisLabelsX.majorUnit">P0Y0M1DT0H0M0S</param> <module name="FlashChart" /> </module> </module> </module> The $view_month$ param substitution works fine. The chart however is a mess... trying to include an image on this post...

tsmithsplunk · ‎06-22-2017

That looks easy with Splunk 6.6, but I don't think it's supported in Splunk 5.0.x

tsmithsplunk · ‎06-21-2017

I thought this would be an easy one. I have a simple XML dashboard that I'm converting to advanced XML because I need give the user the choice of timeframe. Simple XML can't handle this because I insist on using saved searches. There's too many events to run them in real time. So, I have a Pulldown module for the the time range drop down (This month, Last month, Two months ago, etc) and I have a SavedSearch module where I need the "name" to be parameterized. The obvious attempt failed: <param name="name">JobDistribution$view_month$</param> My idea was to have a separate saved search for each month named like so: JobDistribution, JobDistribution_1MonthAgo, JobDistribution_2MonthAgo, etc. "view_month" is the name of the Pulldown where its values are "", "_1MonthAgo", etc. The substitution is not happening and Splunk tells me it can't find the saved search "JobDistribution$view_month$". Can the name of the search be parameterized? Thanks! Splunk 5.0.14 & SideviewUtils 2.2.2

tsmithsplunk · ‎06-21-2017

Your second idea works great. Thanks.

tsmithsplunk · ‎06-21-2017

I have a search that uses timechart to show a count of certain events per day for a one month period. Nothing fancy: index=x earliest=-30d@d ... | timechart span=1d count by threadpool Works fine but of course it shows only about 5 X axis labels. I would prefer it show one for every day in the month. There is room for this but only if the date/time label can be reformatted. It currently shows as "Mon May 1 2017". That label is too long. So when I force a label per day using: <option name="charting.axisLabelsX.majorUnit">P0Y0M1DT0H0M0S</option> Now all the label text overlaps and it becomes unreadable. I can't find a way to reformat the date on a timechart (if this is possible let me know!), so how can I change my search to use "chart" and still get a data point per day per series? Thanks! Using v5.0.14 (I know, we're way behind. I wish I could rotate the labels but that isn't supported.)

tsmithsplunk · ‎12-08-2016

Is it possible to modify the time when using the redirector? I would like to affect a kind of "time zoom". The big picture spans a week of events, but I'd like to click on an event then get the details for that one day. In my case $click.value$ is the time. How can I set the earliest and latest search params to be one day based on the day of the $click.value$? thanks!!

tsmithsplunk · ‎04-04-2016

Thanks! That's really close. The only thing is that the average has the same bin size as the raw data. I decided to show the average as a single value - with a post process module.

tsmithsplunk · ‎03-29-2016

Also, how do you get those handy code callout blocks to appear?

tsmithsplunk · ‎03-29-2016

Still no luck, but I'm not married to one display option. I've also been trying to show the average as a single value. Not sure how to do "eval" type operations outside of a search: < module name="HTML" > < param name="html" >DPS average: sum($results.DocsPerSec$)/$results.count$< /param > < /module > Is there a module that can do aggregation functions and basic math with results fields?

tsmithsplunk · ‎03-25-2016

I removed the timechart and added your phrases, but the events came back raw, not tabularized. There must be some other prep work for charting.

tsmithsplunk · ‎03-25-2016

Just adding on the eventstats clause did not provide any more series data. Is something else implied that I'm not aware of?

tsmithsplunk · ‎03-25-2016

Using "rex mode=sed" worked for me. If your field has a finite known number of values you can use multiple "rex" commands to replace the codey looking values with readable text.

tsmithsplunk · ‎03-25-2016

I've read many posts on the subject of displaying an average line across a chart. But I can't find a solution that doesn't require performing the search twice, as in a join. This seems like a real common problem based on the number of similar posts. So my question is can you display the average somehow over the chart of discrete values without the extra search? The search looks like index=.. search params earliest=-1h | timechart span=1m cont=f avg(DPS) as DocsPerSec So my table data looks like this: time DocsPerSec 9:23 120 9:24 (null) 9:25 1545 9:26 756 So what I'm looking for is a column chart for the individual data points, and the average of all data points for the entire time. It's like having a span value of 1m for the discrete data and a span value of 1h for the average. I know the trendline can produce a running average, but that's not the same thing. Maybe it's not possible because the average isn't known until all time has been processed? I think I could use the search in a post process event in a dashboard to get a single value for the average - to be displayed elsewhere. Maybe that's the best bet.

tsmithsplunk · ‎11-05-2013

Very helpful. Thanks to both sideview and Norbert!

tsmithsplunk · ‎11-02-2013

That could certainly be useful. Of course, I have moved on - basically I gave up on date range slices and just display the entire month of data. Thanks.

tsmithsplunk · ‎10-21-2013

I tried the multisearch approach and it works great. Pretty quick too. I tacked on a nice | untable "" measure value which allowed me to chart the results as a PIE.

tsmithsplunk · ‎10-17-2013

Hello experts. After mining this site I figure its not possible to do math on distinct vales. I've seen answers that help people munge multiple searches into one to avoid this issue. Well I have 2 distinct searches that don't have any fields in common. I only want to perform math on the counts from both. 1st search: index=here sourcetype=this SpecialKeyword 2nd search: index=here sourcetype=this SqlTransactionRollbackException AND CertainCommandObject You could say its a flaw in the logs that the data I need is written in separate events. Nevertheless I'd like to take the count of the 2nd search and divide by the count of the 1st, giving me a percentage of errors for a certain type of action. There are no fields in common between the two that differ in their values. The 2nd has a SQLSTATE of "40001" ... can that be compared to null somehow? index=here sourcetype=this SpecialKeyword OR (SqlTransactionRollbackException AND CertainCommandObject) | stats eval(count(SQLSTATE="40001")/count(SQLSTATE=null)) as "my desired value" I can't seem to find the right query.

tsmithsplunk · ‎10-07-2013

I'm trying to get user entered dates or ranges to effect a dashboard that runs off a saved search. TextFields and PullDowns do not work because my saved search looks like this: index=here sourcetype="apps_log" *Command | stats count by applog_orgName, _time | bin _time span=1d In the PostProcess module I can't enter a "earliest" or "latest" since it just gets appended to the search and those params are invalid there. So....maybe a TimeRangePicker will work, however, the saved search is grabbing data from -28d@d to @d. The date range needs to stay in that window or else a whole new search is run which takes quite a bit of time. The dashboard is supposed to give a quick view. Is it possible to specify the values for the picker so they only apply to my one dashboard and not all over the app? I realize I can add custom ranges and hide standard ones, but I don't want to change the TimeRangePickers all over Splunk.

tsmithsplunk · ‎10-03-2013

I'm not sure I get it. Is it possible to define time ranges that only apply to a certain module on a certain dashboard? It appears you are disabling the default ranges for all modules wherever they may appear.

tsmithsplunk · ‎09-30-2013

That must be it. I looked back in my notes from a year ago when sideview utils was first installed and I had v2.2.2. I have no idea how 1.3.5 got installed. I have informed IT and I'm sure once the new version gets installed things will start working. Many thanks!

tsmithsplunk · ‎09-27-2013

Does anyone know if the sideview utils Pulldown module can use a saved search? I've been tinkering with this and it appears like the Pulldown is not recognizing the upstream SavedSearch.

Posts	36
Solutions	0
Karma Given	4
Karma Received	11
Member Since	‎10-11-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How can I increase the search return limit in Splu...

Saved search name as a parameter

Formatting axis lables on a time based chart

Displaying average from a timechart

How to perform math on single values

TimeRangePicker for a dashboard

Sideview utils pulldown stopped working after upgr...

Can't find sample code for sideview utils

can a ConvertToIntention work on a HiddenPostProce...

can advanced xml be edited in splunk web

Re: How can I increase the search return limit in ...

Re: How can I increase the search return limit in ...

How can I increase the search return limit in Splu...

Re: Saved search name as a parameter

Re: Saved search name as a parameter

Re: Saved search name as a parameter

Saved search name as a parameter

Re: Formatting axis lables on a time based chart

Formatting axis lables on a time based chart

Re: Sideview Utils Redirector - Time Range

Re: Displaying average from a timechart

Re: Displaying average from a timechart

Re: Displaying average from a timechart

Re: Displaying average from a timechart

Re: Displaying average from a timechart

Re: stacked graph legend change

Displaying average from a timechart

Re: TimeRangePicker for a dashboard

Re: TimeRangePicker for a dashboard

Re: How to perform math on single values

How to perform math on single values

TimeRangePicker for a dashboard

Re: How to select few options under TimeRangePicke...

Re: Sideview utils pulldown stopped working after ...

Re: Sideview utils pulldown stopped working after ...