Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pshangguan
pshangguan
New Member
Member since:
03-18-2018
06-05-2020
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-18-2018 |
Activity Feed
- Posted Re: Looking for multiple results in query on Splunk Search. 10-18-2018 10:52 AM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-18-2018 09:56 AM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-18-2018 09:45 AM
- Posted Can I display the results from multiple queries in a single value panel? on Dashboards & Visualizations. 10-18-2018 09:18 AM
- Tagged Can I display the results from multiple queries in a single value panel? on Dashboards & Visualizations. 10-18-2018 09:18 AM
- Tagged Can I display the results from multiple queries in a single value panel? on Dashboards & Visualizations. 10-18-2018 09:18 AM
- Tagged Can I display the results from multiple queries in a single value panel? on Dashboards & Visualizations. 10-18-2018 09:18 AM
- Tagged Can I display the results from multiple queries in a single value panel? on Dashboards & Visualizations. 10-18-2018 09:18 AM
- Tagged Can I display the results from multiple queries in a single value panel? on Dashboards & Visualizations. 10-18-2018 09:18 AM
- Posted Multiple queries for single value panel? on Splunk Search. 10-16-2018 01:40 PM
- Tagged Multiple queries for single value panel? on Splunk Search. 10-16-2018 01:40 PM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-16-2018 10:47 AM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-16-2018 09:44 AM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-15-2018 03:25 PM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-15-2018 02:57 PM
- Posted Re: Change background color according to query status on Dashboards & Visualizations. 10-15-2018 02:39 PM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-15-2018 02:34 PM
- Posted Re: Looking for multiple results in query on Splunk Search. 10-15-2018 12:11 PM
- Posted Looking for multiple results in query on Splunk Search. 10-15-2018 10:38 AM
- Tagged Looking for multiple results in query on Splunk Search. 10-15-2018 10:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-18-2018
10:52 AM
In another word, I want to do something like:
index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-TST6/" | stats latest(_time) as tst6t by job_result | ... tst6t_success_time ... | ... tst6t_failure_time...
tst6t_success_time and tst6t_failure_time are from tst6t. No idea how to pick them up from tst6t...
... View more
10-18-2018
09:56 AM
I want to display the last run time in the panel title field, and the last success run time in the single value title field.
... View more
10-18-2018
09:45 AM
sorry i am not sure how to retrieve them individually as i am new to splunk and xml 🙂
... View more
10-18-2018
09:18 AM
I have some queries:
index=job_console source="DEV2" "Finished:" | sort - _time
<_time value here> Result: 2018-10-16T12:43:04.100-0700 line:30 Finished: FAILURE
index=job_console source="DEV2" "Finished: SUCCESS" | sort - _time
<_time value here> Result: 2018-10-16T12:15:14.888-0700 line:20 Finished: SUCCESS
index=jenkins_console source="DEV2" "DATAFLOW " | sort - _time
<_time value here> 2018-10-16T12:43:03.125-0700 line:26 DATAFLOW FAIL: RFL_REPL
I want to display the last run status, which is "FAILURE" from the above first query, the last successful time _time, which is from the second query, and the failure reason for the last run which is from the 3rd query in a single value panel, use the "title" fields.
Can I can do all three queries?
Thanks!
... View more
10-16-2018
01:40 PM
I have some
index=job_console source="*DEV2*" "Finished:" | sort - _time
<_time value here> Result: 2018-10-16T12:43:04.100-0700 line:30 Finished: FAILURE
index=job_console source="*DEV2*" "Finished: SUCCESS" | sort - _time
<_time value here> Result: 2018-10-16T12:15:14.888-0700 line:20 Finished: SUCCESS
index=jenkins_console source="*DEV2*" "DATAFLOW " | sort - _time
<_time value here> 2018-10-16T12:43:03.125-0700 line:26 DATAFLOW FAIL: RFL_REPL
I want to display the last run status, which is "FAILURE" from the above first query, the last successful time time, which is from the second query, and the failure reason which is from the 3rd query in a single value panel, use the "title" fields.
Can I can do all three queries?
Thanks!
... View more
- Tags:
- splunk-cloud
10-16-2018
10:47 AM
tst6t only have the two times, how do i know which one is for "SUCCESS" and whicch one is for "FAILURE"?
... View more
10-16-2018
09:44 AM
I got two results:
job_result . tst6t
FAILURE . 1539707765.083
SUCCESS . 1539704175.318
... View more
10-15-2018
03:25 PM
How can I get two time values? one for the latest run, and one for the success run in your query?
... View more
10-15-2018
02:57 PM
index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | sort -_time | stats latest(job_result) as dev2status, latest(_time) as dev2st by job_result, latest(_time) as dev2t
... View more
10-15-2018
02:39 PM
I tried to use the following code:
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
<option name="rangeValues">[4,4.5]</option>
It always display red background.
What I want is to display the environment name in the single value panel, but use "job_result" to decide what color to use. The value for "colorBy" only takes numbers.
... View more
10-15-2018
02:34 PM
I used "latest(_time) as dev2st by job_result" in the stats command and the it did not get anything. I am getting "no results found" in the panel.
... View more
10-15-2018
12:11 PM
I changed it to:
stats latest(job_result) as dev2status, latest(_time=if(eval(job_result=“SUCCESS”))) as dev2st, latest(_time) as dev2t
It did not pickup the _time for the latest successful job run...
... View more
10-15-2018
10:38 AM
I have the following query I use to get the latest status and time(_time).
index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-TST6/" | sort -_time | stats latest(job_result) as status, latest(_time) as tst6t
Now, I want to get the time(_time) of the job that run successfully -> job_result=SUCCESS. I wanyt to seew if I can get those two times from the same query and display them inside the same dashboard panel. I tried different ways and could not get it working.
Thanks!
... View more
- Tags:
- splunk-cloud
10-15-2018
10:32 AM
I will try and see how far I an go with this... Thanks now.
... View more
10-12-2018
09:13 AM
I have a single value dashboard panel, it displays the status of from a query. I hav the following query that changes the display text color according to the query status.
index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | sort -_time | stats latest(job_result) as dev2status, latest(_time) as dev3t | eval PST=dev3t-25200 | eval Dev2Time=strftime(PST, "%Y-%d-%m %H:%M:%S") | eval host="DEV2" | fields host dev2status Dev2Time | head 1 | eval range=if(dev2status=="FAILURE", "severe", "low")
Now I want to change the background color to either RED or GREEN by the status(SUCCESS or FAILURE), keep the text color as default BLACK.
What I need to do?
Thanks!
... View more
- Tags:
- splunk-cloud
10-11-2018
01:43 PM
What I did is to check the dev2s directly, like this:
eval range=if(dev2s=="FAILURE", "severe", "low")
This time, it picked up the right color. Thanks for your help!
... View more
10-11-2018
01:21 PM
I also tried to flip the logic and get red display all the time, including SUCCESS.
... View more
10-11-2018
01:16 PM
Sure. I changed the visualization to:
fields dev2s | eval range=if(dev2value=="bad", "severe", "low")
Just the status which is FAILURE for this environment, it still picks up "low".
... View more
10-11-2018
12:52 PM
it seems eval range=if(dev2value=="bad", "severe", "low") always picks up the last value...
... View more
10-11-2018
12:42 PM
Thanks for the code. I tested it and worked for the green.
<single>
<title>$dev2title$</title>
<search>
<query>index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | sort -_time | stats latest(job_result) as dev2s, latest(_time) as dev2t | eval Dev2Time=strftime(dev2t, "%Y-%m-%d: %H:%M:%S") | eval dev2value=if(dev2s==SUCCESS,"good","bad") | fields dev2s Dev2Time | head 1 | eval range=if(dev2value=="bad", "severe", "low")</query>
<done>
<set token="dev2title">$result.Dev2Time$</set>
</done>
<earliest>-4h@h</earliest>
<latest>now</latest>
<refresh>2m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
Somehow, I always get text displayed in green. I tested the query, when dev2value is "FAILURE", "severe" was picked up, but the display is still green which is "low".
... View more
10-11-2018
09:35 AM
I am very new to Splunk and XML, and I am trying to display the status of my Jenkin's jobs.
Here is my query:
index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | sort -_time | stats latest(job_result) as status, latest(_time) as dev2t | eval Dev2Time=strftime(dev2t, "%Y-%m-%d: %H:%M:%S") | fields status Dev2Time | head 1
This displays the status of the query in Black now.
The "status" is either SUCCESS, FAILURE, or some other value if the job did not run within the time range. I want to display the environment name(in this case DEV2 as the job name indicated) instead of the status in RED if the status is FAILURE, display it in GREEN if the status is SUCCESS, and display in GREY is the status is something else.
I could not find useful info yet. Thanks.
... View more
10-10-2018
01:14 PM
That worked. Thanks!!!
... View more
10-09-2018
03:09 PM
I have the following code:
<panel>
<single>
<title>$mytitle$</title>
<search>
<query>index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | stats latest(job_result) as status, latest(_time) as time | fields status time</query>
<done>
<set token="mytitle">time</set>
</done>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</single>
</panel>
I am getting "time" displayed in the panel instead of the actual time. I run the query in splunk search and was able to see the status and the time.
... View more
10-09-2018
12:24 PM
A single event. I am trying to find the latest event and display its status(using single field panel), and I want to use the event time _time and display it in the title field.
... View more
10-09-2018
12:22 PM
I want to catch the event time which I believe is in _time.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
