Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About GaryZ
GaryZ
Path Finder
Member since:
03-31-2023
Friday
Community Statistics
| Posts | 43 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 03-31-2023 |
Activity Feed
- Posted Re: Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. Friday
- Posted Re: Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. Thursday
- Posted Re: Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. Wednesday
- Posted Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? on Dashboards & Visualizations. Tuesday
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. a week ago
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. a week ago
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. a week ago
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. a week ago
- Posted Re: Why does my search return shortened number of results on Dashboards & Visualizations. a week ago
- Posted Why does my search return shortened number of results on Dashboards & Visualizations. a week ago
- Posted How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Tagged How to create a search that provides option for a LIKE and not LIKE option on Splunk Search. 12-11-2023 02:17 PM
- Posted Re: Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 04:56 PM
- Posted Re: Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 04:54 PM
- Karma Re: Inside drilldown tags - how to apply transformative operations on set tags - <set> for ITWhisperer. 12-07-2023 04:54 PM
- Posted Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 11:01 AM
- Tagged Inside drilldown tags - how to apply transformative operations on set tags - <set> on Splunk Dev. 12-07-2023 11:01 AM
Friday
@bowesmana Thank you for confirming. That was how I understood this as well. I was curious if there were options I wasn't aware of. Thank you once again.
... View more
Thursday
@bowesmana Is there a way to switch from chart to table? The options given earlier seems to only apply to variations of charts. Curious if there's options to go from chart to table.
... View more
Wednesday
Hello @danspav , Is there a listing of all the different charting options? I've tried to use what are some of the possible names for the different charting types. Some worked and some didn't. I'm sure there's some that I've missed as well. Is there an option where I can also switch from a chart to a table? TIA The following work <choice value="line">Line Chart</choice>
<choice value="column">Bar Chart</choice>
<choice value="area">Area</choice>
<choice value="bar">Bar</choice>
<choice value="pie">Pie</choice>
<choice value="scatter">scatter</choice>
<choice value="bubble">bubble</choice> The following DIDN'T work <choice value="box-plot">boxplot</choice>.
<choice value="histogram">histogram</choice>
<choice value="horizon">horizon</choice>
<choice value="scatterline">scatterline</choice>
... View more
Tuesday
Can you dynamically change the charts (ie. from bar to line), using a dropdown menu? At the moment, I've created multiple charts and utilizing show and hide (depending on the options selected), to serve this purpose. I was wondering if there's an easier/cleaner/simpler way of achieving this.
... View more
a week ago
Thank you @bowesmana, I was looking for | where (Check_Feature_Availability="false") AND ("a" IN ("a")) Thank you.
... View more
a week ago
I'm looking for a particular string in the list of strings. The "a" in the first part is not from a field, it's just a string that I'm trying to compare against. I'm trying to implement the following logic in python "word1" in ['word1', 'word2', ..., 'word_x', ]
... View more
a week ago
|search (Check_Feature_Availability=false) AND NOT ("Choice1" IN ("Choice1", "Choice2", "Choice3")) OR
(Check_Feature_Availability=true) AND ("Choice1" IN ("Choice1", "Choice2", "Choice3")) The list is really all the options from a multi-valued dropdown menu. The values are all different.
... View more
a week ago
I am trying to dynamically alter my searched data, by utilizing a value from my data source (Check_Feature_Availability - boolean data) with a selected value from a multi-dropdown in the dashboard (list of strings).
... View more
a week ago
What I'm trying to achieve from this, is try to implement an "exclusive or" logic. |search (Check_Feature_Availability=false) AND NOT ("a" IN ("a", "b", "c")) OR
(Check_Feature_Availability=true) AND ("a" IN ("a", "b", "c")) TIA
... View more
a week ago
I apologize if the following question might be a bit basic. But I'm confused with the results. When I append the following code into the "search" line, it returns a shortened list of results. (from 47 to 3) AND ("a" in ("a")) original code. index=main_service ABC_DATASET
Arguments.email="my_email@company_X.com"
| rename device_model as hardware,
device_build as builds,
device_train as trains,
ABC_DATASET.Check_For_Feature_Availability as Check_Feature_Availability
| search (Check_Feature_Availability=false) AND ("a" in ("a"))
| table builds, trains, Check_Feature_Availability I was expecting to see the same number of results. Am I wrong about my expectations, or am I missing something here? TIA index=main_service ABC_DATASET Arguments.email="my_email@company_X.com" | rename device_model as hardware, device_build as builds, device_train as trains, ABC_DATASET.Check_For_Feature_Availability as Check_Feature_Availability | search (Check_Feature_Availability=false) AND ("a" in ("a")) | table builds, trains, Check_Feature_Availability
... View more
Labels
- Labels:
-
Classic dashboard
-
single value
-
table
-
token
12-11-2023
02:17 PM
Is there a way of creating a search where we can have both LIKE and NOT LIKE, based on user selected option? ie. if $user_option_tk$ == True: | where NOT (error_string LIKE "%$filter_tk$%") else: | where error_string LIKE "%$filter_tk$%"
... View more
12-07-2023
04:56 PM
@bowesmana You are correct. I did have to change my index to point at 0 instead of 1
... View more
12-07-2023
11:01 AM
Can you apply transformative operations inside set tags from drilldown tags? ex: <drilldown> <set token="form.builds_tk">$click.value$</set> </drilldown> Would like to take the value captured from click value, split it (or regex), then use the first value. ex: <drilldown> <set token="form.builds_tk">mvindex(split("$click.value$", "-"), 1)</set> </drilldown>
... View more
Labels
- Labels:
-
app
-
modular input
-
other
-
simple XML
-
visualization
10-30-2023
02:03 PM
Thanks!!! @ITWhisperer
... View more
10-30-2023
12:23 PM
I am looking to create an acronym from a dynamic string, by capturing the first letter of each broken substring How do I write the script, so I can capture whatever number of substrings gets generated from the original string? ie. "Hello_World_Look_At_Me" => "HWLAM" "Hello_World" => "HW" I'm thinking of doing the following, but this seems to be pretty lengthy. Would like to know if there's a more efficient way of getting this done. | eval txt1 = "Hello_World_Look_At_Me" | eval tmp = split(txt1, "_") | eval new_word = substr(mv_index(tmp,1), 1) + ...
... View more
10-06-2023
03:18 PM
@bowesmana Thank you. Your example helped me grasp this better.
... View more
10-05-2023
10:16 AM
@bowesmana I've used this code to check on the values <html>
<h3>Token values</h3>
<table border="0" cellpadding="12" cellspacing="0">
<tr>
<td>
<p>
<b>Time range (epoch time)</b>
</p>
<p>
<b>$$timeSelect1.earliest$$</b>: $timeSelect1.earliest$<br/>
<b>$$timeSelect1.latest$$</b>: $timeSelect1.latest$<br/>
<b>$$timeSelect1.earliest_ts$$</b>: $timeSelect1.earliest_ts$<br/>
<b>$$timeSelect1.latest_ts$$</b>: $timeSelect1.latest_ts$<br/>
<b>$$earliest$$</b>: $earliest$<br/>
<b>$$latest$$</b>: $latest$<br/>
<b>$$table_minutes_away$$</b>: $table_minutes_away$<br/>
<b>$$drilldownsettingtimerange$$</b>: $drilldownsettingtimerange$<br/>
</p>
</td>
<td>
<p>
<b>Filter Values</b>
</p>
<p>
<b>$$displayUnits$$</b>: $displayUnits$<br/>
<b>$$filterBy$$</b>: $filterBy$<br/>
<b>$$removeParam$$</b>: $removeParam$<br/>
<b>$$rankBy$$</b>: $rankBy$<br/>
<b>$$filterNWCompletionCode$$</b>: $filterNWCompletionCode$<br/>
<b>$$filterNWPredictionCode$$</b>: $filterNWPredictionCode$<br/>
<b>$$useLoad$$</b>: $useLoad$<br/>
<b>$$showLive$$</b>: $showLive$<br/>
</p>
</td>
<td>
<p>
<b>Click Values</b>
</p>
<p>
<b>$$job.runDuration$$</b>: $job.runDuration$<br/>
<b>$$whereclick$$</b>: $whereclick$<br/>
<b>$$clickname$$</b>: $click.name$<br/>
<b>$$clickvalue$$</b>: $click.value$<br/>
<b>$$clickname2$$</b>: $click.name2$<br/>
<b>$$clickvalue2$$</b>: $click.value2$<br/>
<b>$$clickearly$$</b>: $clickearly$<br/>
<b>$$clicklate$$</b>: $clicklate$<br/>
<b>$$row.duration$$</b>: $row.duration$<br/>
<b>$$rownode$$</b>: $rownode$</p>
</td>
<td>
<p>
<b>Search Values</b>
</p>
<p>
<b>$$radar|s$$</b>: $radar|s$<br/>
<b>$$form.pre_source$$</b>: $form.pre_source$<br/>
<b>$$form.source|s$$</b>: $form.source|s$<br/>
<b>$$source$$</b>: $source$<br/>
<b>$$form.terms|s$$</b>: $form.terms|s$<br/>
<b>$$terms$$</b>: $terms$<br/>
<b>$$subsystems|s$$</b>: $subsystems|s$<br/>
<b>$$categories|s$$</b>: $categories|s$<br/>
<b>$$hidden$$</b>: $hidden$<br/>
<b>$$mlModelsAvailable$$</b>: $mlModelsAvailable$</p>
</td>
<td>
<p>
<b>Search Values</b>
</p>
<p>
<b>$$search_results$$</b>: $search_results$<br/>
</p>
</td>
</tr>
</table>
</html> This is what I see when I clicked on any parts of the stacked charts (no difference in values)
... View more
10-04-2023
02:12 PM
@bowesmana I'm using the stats statement to help with debugging the actions I'm doing on the UI. I've tried adding a html panel to help better understand the various actions from the drill down. However I'm not seeing what I'm expecting to see. I currently have a stacked column chart. I would like to hover or click on any of the data in the stacked chart, to get the x,y, z data. (i.e. x = build, y = duration time, and z= name of task/column-segment) Do you happen to know how I can capture this information, when I click on a point in the stacked column?
... View more
09-26-2023
01:37 PM
@bowesmana , I've created the tokens via Drilldown Editor. However when I try using the tokens in a panel, ie. | stats values($value2$), values($trellis_split$), values($trellis_value$), values($row_axis_name$), values($row_fieldname$), values($d_trellis_split$), values($d_trellis_value$), values($d_trellis_name$), values($d_value1$), I'm only seeing name1 & trellis_name. Everything else is blanked.
... View more
09-25-2023
03:08 PM
Is there a way of capturing the x, y and z data from a stacked chart? At the moment, my x and y are as follows x = build info y = duration z = process name. (various names stacked in the same column)
... View more
Labels
- Labels:
-
chart
-
field extraction
-
lookup
-
other
-
stats
09-07-2023
04:52 PM
@yuanliu I'm fairly new to Splunk this year. Can you explain what you mean? - "You can still use the fields in statistical functions" I've tried | tstats count where index=abc Arguments.email=“myemail@abc.com" by device_build, Arguments.test_url, UserKey_ABC.job1 | rename UserKey_ABC.Day as day, UserKey_ABC.job1 as job1 But that didn't work for me either. Thanks.
... View more
09-07-2023
02:58 PM
I'm having trouble capturing the custom key - "UserKey_ABC" in the following script. With the following code, I'm not able to see any results. However, if I remove "UserKey_ABC", I am able to get the results. I'm certain I do have this key in my events. How do I approach this issue? | tstats count where index=abc Arguments.email=“myemail@abc.com" by device_build, Arguments.test_url, UserKey_ABC | rename UserKey_ABC.Day as day, UserKey_ABC.job1 as job1, UserKey_ABC.Version as version, Arguments.test_url as test_url, device_build as build | table build, lib, day, job1, version, test_url
... View more
Labels
- Labels:
-
field extraction
-
fields
-
metadata
-
subsearch
-
tstats
07-06-2023
03:04 PM
I am looking to dynamically update the Splunk Dashboard panel title, depending on options I've chosen from a dropdown menu in Splunk Dashboard. I've tried the following <row>
<panel>
<title>Panel1: (Hardware: $hardware1$ - $unit_used$</title>
...
<search base="main_search">
<query>
...
| eval _unit_used = "ms"
</query>
<done>
<set token="unit_used">$result._unit_used$</set>
</done>
</search> However when the script runs, I am seeing "Hardware: abc - $result.unit_used$". instead of seeing "Hardware: abc - ms" Is there a way of achieving this? Thanks
... View more
06-14-2023
12:05 PM
@DalJeanis I'm having the same issue. I've tried changing my html code to use <code_word> I get the following error When I leave it as the following | rex field = session "(?<session_text>.*_)[\D]*" I would get the "Unexpected close tag" error message
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
