Activity Feed
- Got Karma for grouping data in search. 06-05-2020 12:46 AM
- Got Karma for Can AND or OR be used in case statements in eval expressions?. 06-05-2020 12:46 AM
- Got Karma for Can AND or OR be used in case statements in eval expressions?. 06-05-2020 12:46 AM
- Got Karma for Can AND or OR be used in case statements in eval expressions?. 06-05-2020 12:46 AM
- Got Karma for Can AND or OR be used in case statements in eval expressions?. 06-05-2020 12:46 AM
- Got Karma for Can AND or OR be used in case statements in eval expressions?. 06-05-2020 12:46 AM
- Got Karma for How to suppress extra _time line on timechart in dashboard. 06-05-2020 12:46 AM
- Posted How to suppress extra _time line on timechart in dashboard on Splunk Search. 05-10-2012 01:38 PM
- Tagged How to suppress extra _time line on timechart in dashboard on Splunk Search. 05-10-2012 01:38 PM
- Posted Need to change colors in stacked bar chart--how do I get Splunk to use FlashChart? on Dashboards & Visualizations. 05-09-2012 12:41 PM
- Tagged Need to change colors in stacked bar chart--how do I get Splunk to use FlashChart? on Dashboards & Visualizations. 05-09-2012 12:41 PM
- Tagged Need to change colors in stacked bar chart--how do I get Splunk to use FlashChart? on Dashboards & Visualizations. 05-09-2012 12:41 PM
- Tagged Need to change colors in stacked bar chart--how do I get Splunk to use FlashChart? on Dashboards & Visualizations. 05-09-2012 12:41 PM
- Posted Re: How do I access the HiddenChartFormatter? on Splunk Search. 05-09-2012 12:04 PM
- Posted How do I access the HiddenChartFormatter? on Splunk Search. 05-09-2012 10:20 AM
- Tagged How do I access the HiddenChartFormatter? on Splunk Search. 05-09-2012 10:20 AM
- Tagged How do I access the HiddenChartFormatter? on Splunk Search. 05-09-2012 10:20 AM
- Posted Re: Can AND or OR be used in case statements in eval expressions? on Splunk Search. 05-09-2012 08:30 AM
- Posted Can AND or OR be used in case statements in eval expressions? on Splunk Search. 05-08-2012 01:51 PM
- Tagged Can AND or OR be used in case statements in eval expressions? on Splunk Search. 05-08-2012 01:51 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 5 | |||
| 1 |
05-10-2012
01:38 PM
1 Karma
I have a search that creates a timechart. I do not specify a time range. When I run the search I get the results I expect.
But when I add the search to a dashboard I get a line below the time legend on the x axis that says _time. I would like to eliminate this--both the _time and the line it occupies. (That is, I don't just want to replace _time with spaces). When I go to edit visualizaton in the dashboard the x axis is blank.
Can someone help with this?
... View more
- Tags:
- timechart
05-09-2012
12:41 PM
I have a search that returns a stacked barchart. I put it in a dashboard. But, whatever I have tried to do, I can't get default colors to change. From other answers here, I think that the older FlashChart may work the way I want.
My question is, how to I get Splunk to use FlashChart?
... View more
05-09-2012
10:20 AM
I'm new to Splunk. I would like to change the colors on charts. Looking at some answers on this issue I see that you have to get into the HiddenChartFormatter module. But, I can't figure out how to get there. Can someone help?
... View more
05-09-2012
08:30 AM
Ayn,
This does not work at least with timechart
... View more
05-08-2012
01:51 PM
5 Karma
Right now I have a search that contains c(eval(status<=400)) AS SUCCESS c(eval(status>400)) AS FAILURE.
This works, producing a chart of failures and sucesses. But now I want to change it so it has a WARNING category. This would include only status=404. But to do this I would have to change the FAILURE category to something like, status>400 AND status !=404. But the case statement does not seem to allow this.
Can anyone help me with this?
... View more
05-08-2012
12:08 PM
Thanks Kristian! This worked. I tweaked it a bit because I hadn't put my question clearly, but your syntax worked. Here is what I ended up with:
...| timechart c(eval(status>400)) AS FAILURE c(eval(status<=400)) AS SUCCESS
... View more
05-07-2012
05:50 PM
1 Karma
I am serching a log that has statuses. When I run the search and chart it, I get a bar for each status. There are, say, 10 statuses. Instead, I want to group the data into 2 results: one result is the count of status < 400, and the other is the count of status >= 400. Any idea how I get this?
... View more
- Tags:
- grouping
