Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About spisiakmi
spisiakmi
Contributor
Member since:
06-26-2019
03-26-2025
Community Statistics
| Posts | 92 |
| Solutions | 10 |
| Karma Given | 2 |
| Karma Received | 5 |
| Member Since | 06-26-2019 |
Activity Feed
- Posted Re: bar timeline chart of duration of any signal on Dashboards & Visualizations. 03-24-2025 07:03 AM
- Posted bar timeline chart of duration of any signal on Dashboards & Visualizations. 03-24-2025 02:13 AM
- Posted Re: count of events in dynamic time defined by token on Security. 09-19-2024 07:24 AM
- Posted Re: count of events in dynamic time defined by token on Security. 09-19-2024 12:18 AM
- Posted count of events in dynamic time defined by token on Security. 09-18-2024 09:26 AM
- Tagged count of events in dynamic time defined by token on Security. 09-18-2024 09:26 AM
- Posted Re: run specific query depens on token value on Splunk Enterprise. 04-25-2024 01:08 AM
- Posted run specific query depens on token value on Splunk Enterprise. 04-24-2024 11:26 PM
- Posted Re: how to read from lookup table on Splunk Enterprise. 12-13-2023 07:04 AM
- Posted how to read from lookup table on Splunk Enterprise. 12-13-2023 05:31 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-06-2023 04:13 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-06-2023 01:24 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-06-2023 12:53 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 11:25 PM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:56 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:53 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:42 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:20 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 07:13 AM
- Posted column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 02:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-24-2025
07:03 AM
Hi Will, many thanks for you support. I tried your code directly and became this view (Screenshot 2025-03-24 145511.jpg). Not so as your screenshot. And it is not clear for me, where is considered the dlt. As a duration of the state.
... View more
03-24-2025
02:13 AM
Hi, here is the data | delta _time as dlt | eval dlt=abs(dlt) | table _time, state, dlt "_time",state,dlt "2025-03-21T13:25:33.000+0100","Störung", "2025-03-21T13:21:46.000+0100",Verteilzeit,"227.000" "2025-03-21T13:05:01.000+0100","Personal fehlt","1005.000" "2025-03-21T11:23:35.000+0100","Produktion ON","6086.000" "2025-03-21T11:23:19.000+0100",Wartung,"16.000" "2025-03-21T11:21:41.000+0100","Störung","98.000" "2025-03-21T11:20:04.000+0100","Produktion OFF","97.000" "2025-03-21T11:19:57.000+0100","Produktion ON","7.000" "2025-03-21T10:47:01.000+0100","Produktion OFF","1976.000" "2025-03-21T10:46:55.000+0100","Produktion ON","6.000" "2025-03-21T10:46:28.000+0100",Verteilzeit,"27.000" "2025-03-21T10:46:21.000+0100",Verteilzeit,"7.000" There are 7 different signals. Each (state) is comming from the system as an impuls in specific time stamp and represents the state of any workplace. The interval between these signals is the delta (dlt) or duration of the previous state. There is guaranteed no overlapping. I would like to visualise a bar chart of this duration on the timeline. E.g. last 24h. See an example (duration.jpg). Each begin of color is in fact timestamp of the state. If there is any idea, please. This would help me a lot.
... View more
09-19-2024
07:24 AM
Hi gcusello, thank you very much for supporting me. Unfortunately it is not, what I have to achieve. 1. I need saved search, so 1 query in fact. 2. your solution is using dropdown, where only 1 value is/can be chosen. I need to run a search through all elements of the token. Something like foreach item of the token, run query.
... View more
09-19-2024
12:18 AM
Hi gcusello, thank you for your reply. In fact there should be a saved search running on daily basis. Example: for every row in lookup table should run a query. index=myindex att1=F1 AND earliest=strptime("12.09.2024", "%d.%m.%Y") | stats count as cnt index=myindex att1=F2 AND earliest=strptime("23.04.2024", "%d.%m.%Y") | stats count as cnt index=myindex att1=F3 AND earliest=strptime("15.06.2024", "%d.%m.%Y") | stats count as cnt index=myindex att1=F4 AND earliest=strptime("16.03.2024", "%d.%m.%Y") | stats count as cnt result: att1 cnt att2 att3 F1 234 1100 12.09.2024 F2 4235 1100 23.04.2024 F3 3763 1100 15.06.2024 F4 42314 1100 16.03.2024
... View more
09-18-2024
09:26 AM
Hi can anybody help with this problem, please?
source1: lookup Tab (lookup.csv)
att1 att2 att3
F1 1100 12.09.2024
F2 1100 23.04.2024
F3 1100 15.06.2024
F4 1100 16.03.2024
att1 is also in index=myindex
I want to have in a table for all att1 from lookup.csv count of all events from index=myindex att1=$att1$ AND earliest=strptime($att3$, "%d.%m.%Y")
output:
att1 count(from myindex) att2 att3
F1 count 1100 12.09.2024
F2 count 1100 23.04.2024
F3 count 1100 15.06.2024
F4 count 1100 16.03.2024
... View more
04-25-2024
01:08 AM
Hi ITWhisperer, exactly this very simple elegant solution I needed. Thank you very much. Works fine.
... View more
04-24-2024
11:26 PM
Hi, on a dashboard I have a simple check box element: LastOne_tkn (token name). If the check box is enabled, the LastOne_tkn=TRUE. There is simple small table view, which shows some results. I would like to run query in that table view based on LastOne_tkn condition. LastOne_tkn=TRUE (dedup activated) index=machinedata | dedup Attr1 | table Attr1, Attr2 LastOne_tkn=otherwise (dedup deactivated) index=machinedata | table Attr1, Attr2 Any idea, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
12-13-2023
07:04 AM
Hi dtburrows3, thank you very much. It works. I like that solution with the temporary field.
... View more
12-13-2023
05:31 AM
Hi, can anybody help with this task? inputs: "nice_date",sFaultInverter1,sFaultInverter2,sFaultInverter3,sFaultPFC,"sFaultSR-Plaus",sFaultSR,sFaultSpeed "05.12.2023 10:46:53",0,0,1,0,"-1",0,0 "05.12.2023 10:43:27","-1","-1","-1","-1","-1","-1","-1" "05.12.2023 10:41:17",0,320,0,0,"-1",0,0 "05.12.2023 10:30:32",0,0,1,0,"-1",0,0 "05.12.2023 10:28:51",0,0,1,0,"-1",0,0 "05.12.2023 10:28:10","-1","-1","-1","-1","-1","-1","-1" Lookup Attribut,Value,ErrorCode sFaultInverter1,-1,NoCommunication sFaultInverter1,0,noError sFaultInverter1,1,CompressorCurrentSensorFault sFaultInverter1,2,FactorySettings sFaultInverter1,4, sFaultInverter1,8, sFaultInverter1,16,InverterBridgeTemperatureSensorFault sFaultInverter1,32,DLTSensorFault sFaultInverter1,64,ICLFailure sFaultInverter1,128,EEPROMFault sFaultInverter1,256,UpdateProcess sFaultInverter1,512, sFaultInverter1,1024, sFaultInverter1,2048, sFaultInverter1,4096, sFaultInverter1,8129, sFaultInverter1,16384, sFaultInverter1,32768, sFaultInverter2,-1,NoCommunication sFaultInverter2,0,noError sFaultInverter2,1,CommunicationLos sFaultInverter2,2,DcLinkRipple sFaultInverter2,4, sFaultInverter2,8,AcGridOverVtg sFaultInverter2,16,AcGridUnderVtg sFaultInverter2,32,DcLinkOverVtgSW sFaultInverter2,64,DcLinkUnderVtg sFaultInverter2,128,SpeedFault sFaultInverter2,256,AcGridPhaseLostFault sFaultInverter2,512,InverterBridgeOverTemperature sFaultInverter2,1024, sFaultInverter2,2048, I would like to have table with e.G. 3 columns: "nice_date",sFaultInverter1,ErrorCode "05.12.2023 10:46:53",0,noError "05.12.2023 10:43:27","-1",NoCommunication "05.12.2023 10:41:17",0,noError "05.12.2023 10:30:32",0,noError "05.12.2023 10:28:51",0,noError "05.12.2023 10:28:10","-1",NoCommunication for each value of sFaultInverter1 an ErrorCode from the lookUp table. Any help?
... View more
Labels
- Labels:
-
using Splunk Enterprise
12-06-2023
04:13 AM
And here is the solution
| eval row=mvrange(0,6)
| mvexpand row
| addinfo
| eval _time=case(row=0,info_min_time,row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=4,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=5,info_max_time)
| eval value=case(row=0,0,row=1,0,row=2,1,row=3,1,row=4,0,row=5,0)
| table _time, value
... View more
12-06-2023
01:24 AM
This is, what I want to achieve. 3.jpg. Time range from the time range picker. In this case the day 05.12.2023.
... View more
12-06-2023
12:53 AM
1. there is a time range picker object on the dashboard. If I select any range, e.G. the whole day 05.12.2023, this time range I would like to have on x-axis in area chart. 2. in this case,
| eval _time=case(row=0,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S"))
| eval value=case(row=0,0,row=1,1,row=2,1,row=3,0)
the time range of the x-axis in area chart is from the first StartTime (05:30) ... last EndTime (13:30).
... View more
12-05-2023
11:25 PM
I have 1 question. The solution shows the time range in restricted _time. It is possible to expand it into/show in selected time range, which is defined in the time range picker? To the range addinfo.info_max_time, addinfo.info_min_time?
... View more
12-05-2023
09:56 AM
Attached result 2.jpg
... View more
12-05-2023
09:53 AM
Hi ITWhisperer, I fixed it. Thank you very very much for your help, with this, it is working properly (look attached 2.jpg): | sort StartTime | eval row=mvrange(0,4) | mvexpand row | eval _time=case(row=0,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S")) | eval value=case(row=0,1,row=1,1,row=2,1,row=2,0) ´here is the difference | table _time value
... View more
12-05-2023
09:42 AM
But, if I use this code on the content, which I mentioned in the main describtion, I receive these results (see attch 1.jpg). And this is quiet good for me, except the triangel step. Any idea, how to fix it? | eval row=mvrange(0,4) | mvexpand row | eval _time=case(row=0,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S")) | eval value=case(row=0,1,row=1,1,row=2,1,row=3,0) | table _time value
... View more
12-05-2023
09:20 AM
From your code I recived this: "_time",value ,0 ,1 ,1 ,0
... View more
12-05-2023
07:13 AM
Hi ITWhisperer, thx for sharing it. Unfortunately, if I run your code I receive no results.
... View more
12-05-2023
02:26 AM
Hi, I have StartTime,EndTime "2023-12-05 05:30:00.0000000","2023-12-05 08:00:00.0000000" "2023-12-05 08:00:00.0000000","2023-12-05 09:30:00.0000000" "2023-12-05 10:28:00.0000000","2023-12-05 13:30:00.0000000" I need to visualize a column chart, with 3 columns (in this case) with height 1 (y axis). The width of the first column is between "2023-12-05 05:30:00.0000000","2023-12-05 08:00:00.0000000", second one between "2023-12-05 08:00:00.0000000","2023-12-05 09:30:00.0000000", the third between "2023-12-05 10:28:00.0000000","2023-12-05 13:30:00.0000000". The x axis should be the time. Attached example. Any idea, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
07-21-2023
03:18 AM
The problem has been fixed by splunk admins. Unfortunately I don't know how. Problem appeared when they deleted old indexers from the cluster and the still have been configured on the FW side.
... View more
07-17-2023
11:17 PM
Hi, can anybody help, please? I'm using Splunk Universal Forwarder 9.0.4 (build de405f4a7979) and from 15.07.2023 I have no indexed data in Splunk. .After restart there is only 1 error: Invalid key in stanza [webhook] in C:\Program Files\SplunkUniversalForwarder\etc\system\default\alert_actions.conf, line 229: enable_allowlist (value: false). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' I tried this step: 1. removed [webhook] enable_allowlist = false or 2. changed it into true nothing helped. Any advice, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
03-29-2023
09:05 AM
Hi somesoni2, this is amazing simple. Absolutely perfect. Thank you very much. Works fine.
... View more
03-29-2023
06:47 AM
Hi, can I ask you for helping me with this small problem, please?
If I read the content of the lookUp using any criteria I receive attribute Attr1. This Attr1 is multivalue attribute.
Attr1
7470486
7470487
7470597
7470543
I want to create query, where will be index=test ID=7470486 OR 7470487 OR 7470597 OR 7470543
... View more
03-23-2023
09:19 AM
1 Karma
Hi richgalloway, thank you for response, I solved this problem. In fact you were absolutely right. I sent the value through a token to search of any element, can be also hidden, and this search ends like | collect index=machinedata_w48_sum testmode=false
... View more
03-23-2023
03:55 AM
Hi, can anybody help, please?
Problem:
In dashboard I have label. If I write something in the label <number> and press Enter, I would like to make an action: write something in summary index.
Label: serial_num Index: index_sum Fields to be saved in summary index: $Label$, <actual_time>, identifier
... View more
Labels
- Labels:
-
using Splunk Enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-26-2025
11:59 AM
|
Karma from
