Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About HattrickNZ
HattrickNZ
Motivator
Member since:
10-29-2012
07-03-2021
Community Statistics
| Posts | 515 |
| Solutions | 13 |
| Karma Given | 181 |
| Karma Received | 54 |
| Member Since | 10-29-2012 |
Activity Feed
- Got Karma for Is there a way to remove the `Real-time` part that appears from the drop down time picker. 06-19-2024 02:16 PM
- Got Karma for In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?. 09-12-2022 01:38 AM
- Got Karma for declaring a variable in splunk dasboard and make available to all searches. 08-29-2022 08:58 AM
- Karma Re: calculating values in new rows/columns and appending based on values in existing rows/columns for martin_mueller. 07-03-2021 02:24 AM
- Posted Re: How to convert epoch time with milliseconds into splunk at indexing time on Splunk Search. 07-02-2021 08:56 PM
- Karma Re: How to restart a splunk on windows through Command Prompt and control panel? for kamlesh_vaghela. 07-02-2021 03:18 PM
- Got Karma for Commented code moves in splunk Dashboard. 06-17-2020 12:40 PM
- Karma Re: the way fields are arranged in a timechart / join combination particularily the 2nd search being joined for woodcock. 06-05-2020 12:50 AM
- Karma Re: stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host. for jkat54. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for nareshinsvu. 06-05-2020 12:50 AM
- Karma Re: 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent? for cmerriman. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for nvanderwalt_spl. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for MuS. 06-05-2020 12:50 AM
- Karma Re: I want to do `latest=-10m@5m` for maheshsn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for niketn. 06-05-2020 12:50 AM
- Karma Re: How to sort the column names alphabetically at the end of the search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: Checkbox - when 1 box is selected another(default only) is unselected for diogofgm. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
07-02-2021
08:56 PM
%s is for 10 digits epoch? I have a 9 digit epoch and it seems the %s is not bsorking forb me?
... View more
05-20-2020
04:14 PM
<row>
<panel>
<input type="checkbox" token="Registrations">
<label></label>
<choice value="Registered Subscribers">Registered Subscribers</choice>
</input>
</panel>
</row>
I am thinking something like this: 500
I know this works for inside chart tags but what about panels that have input types? tks
... View more
Labels
- Labels:
-
CSS
05-20-2020
04:04 PM
for example I have a 2x2 grid of 4 charts but I only have 3 charts.
I want to show the first 3 charts in the first 3 quadrants and blank/empty in the 4th quadrant.
This is what i have got
Code:
<panel>
<title>blank/delete</title>
<chart>
<search>
<query>blank/delete</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
... View more
05-13-2020
07:15 PM
1 Karma
Has anyone noticed that when you comment out a bit of code in splunk simple XML dashboard, and then save it.
ANd then go back later to edit the same dashboard, the commented out code has moved to the top.
Any one notice this? Can it be made to not happen? I want the code to stay where it is.
I find this useful for comparing an old query chart with an new edited one, but this moving the commented code makes this hard.
Anyone any ideas or suggestions? I guess I could use the clone option but that does not really work for this scenario.
tks
... View more
04-27-2020
04:05 PM
hi there
I have a time chart panel that has 3 nodes in the chart/legend.
I want to be add a tick box or equivalent that allows the user to switch between
1/ the timechart view of the 3 nodes in one chart
to
2/ the trellis view which shows 3 seperate time charts(that is, one time chart per node)
what is the code to do this using simple XML?
pic show the time chart, on top, and the trellis view on the bottom.
I want a tick box to be able to switch between the 2, so they appear only in the one panel.
code below of the above 2 panes in the pic.
<row>
<panel>
<title>test trelis view</title>
<chart>
<search>
<query>index=core host="snzclakl598" elementType=MSCServer measObjLdn=* measInfoId=83888089 duration=PT900S | timechart span=15m avg(c84163062) as "Outgoing Calls-Seizure Traffic" by userLabel</query>
<earliest>@w0</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>test trelis view - want a tick box that jsut allows this to be turned into a trellis view</title>
<chart>
<search>
<query>index=core host="snzclakl598" elementType=MSCServer measObjLdn=* measInfoId=83888089 duration=PT900S | timechart span=15m avg(c84163062) as "Outgoing Calls-Seizure Traffic" by userLabel</query>
<earliest>@w0</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
</chart>
</panel>
</row>
... View more
04-06-2020
07:22 PM
hi there
THis is my sample data. I want to use the heat map option and highlight the max and min per each column.
So I would have 2 values highlighted in each column, the max and the min.
Can this be done in Splunk 7.3.1?
| makeresults
| eval data = "
1 10;
2 9;
3 8;
4 7;
5 6;
6 5;
7 4;
8 3;
9 2;
10 1;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<Date>\d+)\s+(?<Y>\d+)"
| fields + Date Y | fields - _time
|search Y = * |
chart count(Y) by Y | sort + Y
this is what I get just using the default setting.
similar question asked here before
https://answers.splunk.com/answers/116018/splunk-6-simple-xml-dataoverlaymode-on-table-can-we-specify-which-column-to-show-heatmap-on.html
... View more
12-11-2019
02:31 PM
Fixed your code for you. Or it works at least. THe submit is redundant or does not work. Hope it may help!
<form>
<label>Transaction Search</label>
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="Tran_Type">
<label>TRANSACTION TYPE</label>
<choice value="inward">INWARD</choice>
<choice value="outward">OUTWARD</choice>
<default>outward</default>
<change>
<condition value="outward">
<set token="out">*</set>
<unset token="income"></unset>
</condition>
<condition value="inward">
<set token="income">*</set>
<unset token="out"></unset>
</condition>
</change>
</input>
</fieldset>
<row>
<panel depends="$out$">
<html>
<h1> test OUTWARD</h1>
</html>
</panel>
<panel depends="$income$">
<html>
<h1> test INWARD</h1>
</html>
</panel>
</row>
</form>
... View more
12-11-2019
02:16 PM
link works for me now.
... View more
09-17-2019
07:50 PM
1 Karma
https://answers.splunk.com/answers/718182/how-come-the-comment-macro-is-not-working-1.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
this might be the reason
... View more
09-17-2019
07:49 PM
how do you comment in splunk?
I have tried the below from the below ref, but cannot get it to work, (apologies I cannot get the single quote thing to appear as I would like).
comment("THIS IS A COMMENT")`
comment("This part of the search returns only one value")`
I did think it was a single quote but not this single quote ' . the one that is used to format code in this text.
Ah this one. -> `
ref
https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Addcommentstosearches
... View more
- Tags:
- comment
09-04-2019
09:54 PM
my search looks like this ... | fields _time fieldname |
eval wday = strftime(_time, "%a") | where wday = "Thu" | fields - wday | timewrap d series=exact |
1/
my serach produces this earliest =-15d@w1 latest =+8d@w1
but there is 3 values in each 5min slot, but they do not come in at the same time in that 5min slot.
That is why I use the partial=false, to not show this data/time point until it has all the 3 values
But partial=false does not work in this instance. it does in the below exampl
2/
my serach produces this earliest =-15d@w1 latest =now
note the same graph as above except for the latest change. but the partial=false works here and does not show this data/time point until it has all the 3 values.
Anyway I can get timechart, partial=false to work in my example 1 above?
Or do you need more information?
tks
... View more
08-18-2019
07:50 PM
1 Karma
hi there
Can I download all data (from each individual panel) from a dashboard, without having to click through each individual panel (e.g.Export to csv, filename, export)?
This way if I had 10 panels o charts, I would then have 10 csv files for each chart. But I do not want to go through and download each panel individually.
thanks
Kevin
related -
https://answers.splunk.com/answers/425256/download-data-from-dashboard.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
... View more
08-11-2019
01:55 PM
I have a checkbox, and I want the default value to be *, that is All. e.g. device = (device="*")
But once an individual choice is selected I want All to be unselected. e.g. device = (device="Choice1")
How do I do this?
Default All is selected, and then I choose choice1, I get this:
device = (device="*" OR device="Choice1")
I do not want this, I want just device="Choice1", where device="*" would be unselected.
This is my code:
<panel>
<input type="checkbox" token="device" searchWhenChanged="true">
<!-- checkbox dropdown -->
<label>Select a device(for per device, need to unselect all):</label>
<default>*</default>
<!-- <choice value="*">All</choice> -->
<!-- The final value will be surrounded by prefix and suffix -->
<prefix>(</prefix>
<suffix>)</suffix>
<!-- Each value will be surrounded by the valuePrefix and valueSuffix -->
<valuePrefix>device="</valuePrefix>
<valueSuffix>"</valueSuffix>
<!-- All the values and their valuePrefix and valueSuffix will be concatenated together with the delimiter between them -->
<delimiter> OR </delimiter>
<choice value="*">All</choice>
<choice value="Choice1">Choice1</choice>
<choice value="Choice2">Choice2</choice>
<choice value="Choice3">Choice3</choice>
</input>
<html>
<h3> device = $device$</h3>
</html>
</panel>
... View more
- Tags:
- checkbox
07-30-2019
01:48 PM
tks, as already mentioned by @MuS partial=false seems to b what I want
- How does it make its decisions?
- Is it tied to the span=5m and the current time?
my understanding is that it won't display the X.25 - X.30 data, in that time, until the time has passed the X.30+ e.g. X.31 or X.30.01
... View more
07-28-2019
03:59 PM
i can't get that to work and don't think it can as that does not allow me to control the latest time to be @ a 5minute end time e.g. X.05, X.10, .... x.55
... View more
07-24-2019
06:34 PM
tks
the @m of latest=-5m@m will bring it to the close minute. e.g. if i run the query/graph @ X:58 then the query/graph will run up X:53.
What i want is to Run the query/graph up to X:50.
Or What is want is to Run the query/graph up to X:00, X:05, X:10...X:50, X:5 (5 minute intervals only). Not other times outside of this and independent of when the query/graph is run.
... View more
07-24-2019
02:31 PM
I want to do latest=-10m@5m
But I am discovering I cannot do the @5m, I can only do
@m @h @d @mon @y
the reason for wanting the @5m is because the complete data does not come in until the full 5minutes is complete.
And if I can only use @m the if I look at the graph at X:58 (for example) the graph will show a drop as the full 5 minutes of data will not be available to be shown. So I want to show the full previous 5minutes(up to X:55).
Any ideas of ways around this? tks
... View more
07-17-2019
07:28 PM
1 Karma
tks @niketnilay. that works and more tks for the cascade effect. Very Nice!
... View more
07-17-2019
07:02 PM
tks, but I think I am only guessin, this is what I tried. I could get the code to look right but not sure if I can get it to work, or indeed if it can work. tks though. let me know if can explain it better.
<input type="dropdown" token="week_or_day_view">
<label>Week/Day View2:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
<choice value=' eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>
</input>
another:
<input type="dropdown" token="week_or_day_view">
<label>Week/Day View3:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
<search>
<query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact </query>
<earliest>0</earliest>
</search>
</input>
... View more
07-16-2019
04:40 PM
TLDR;
I have 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?
I have 2 dropdowns
1/ selects the day of the week and that then draws the gragh for that day
example of search, where $select_wday$ is the variable that would change from the dropdown:
timechart span=5m max(globalStatActiveSubscribers) by device |
eval wday = strftime(_time, "%a") |
where wday = "$select_wday$" |
fields - wday |
timewrap d series=exact
2/ I want this to control whether timewrap is a weekly view or daily view
but it has a variable inside a variable ( $select_wday$ is inside $week_or_day_view$ )
example of search,
timechart span=5m max(globalStatActiveSubscribers) by device | $week_or_day_view$
The 2 dropdowns:
1/
<input type="dropdown" token="select_wday">
<label>Select Day:</label>
<choice value="Mon">Mon</choice>
<choice value="Tue">Tue</choice>
<choice value="Wed">Wed</choice>
<choice value="Thu">Thu</choice>
<choice value="Fri">Fri</choice>
<choice value="Sat">Sat</choice>
<choice value="Sun">Sun</choice>
<default>$Date$</default>
</input>
2/
<input type="dropdown" token="week_or_day_view">
<label>Week/Day View:</label>
<choice value='eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>
<choice value="timewrap d series=exact">week</choice>
<default>day</default>
</input>
Dropdown 1 works on its own, but when I introduce dropdown 2 it does not work.
Dropdown 2 works for choice2 but not for choice 1 becuase of the variable $select_wday$ inside that choice.
Maybe related:
https://answers.splunk.com/answers/558791/dropdown-based-on-another-dropdown.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
https://answers.splunk.com/answers/233717/the-formatting-of-a-graph-is-not-holding-for-the-d.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
https://answers.splunk.com/answers/79678/dropdown-question.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
https://answers.splunk.com/answers/239138/how-do-i-make-a-dropdown-dynamic-based-on-a-feedse.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
https://answers.splunk.com/answers/235589/how-to-clear-dropdown-box.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
https://answers.splunk.com/answers/680173/how-can-i-retrieve-another-field-value-from-dashbo.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
... View more
05-23-2019
07:56 PM
1 Karma
big tks!! this worked fro me.
... View more
05-22-2019
06:59 PM
I was having trouble evaluating a field and I think it was because I was dividing by zero.
This is my solution.
Hope fully it is self explainatory.
Have I understodd this correctly? Have you got a better one/solution?
| makeresults
| eval data = "
1-Sep 657 34 0;
2-Sep 434 34 0;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)\s+(?<kpi2>\d+)\s+(?<kpi3>\d+)"
| fields + Date kpi1 kpi2 kpi3 | fields - _time
| eval kpi4=kpi2/kpi3 | rename comment as "kpi4 column will not show up because kpi3 = zero"
| eval kpi5=if(kpi3=0,"",kpi2/kpi3) | rename comment as "kpi5 column will show up because I handle the kpi3=zero and return blank" |
... View more
03-20-2019
03:04 PM
How do I get the labels on the X-axis in this graph?
Ideally I would like the labels to be 0 - 129157 on the xaxis from left to right.
I think I may have to use a bin option(3/ reference below), which I may ask elsewhere but I thought I would ask this specific question first.
1/ https://answers.splunk.com/answers/584026/splunk-dashboard-timechart-x-axis-does-not-show-ho-1.html
2/ https://answers.splunk.com/answers/75828/x-axis-x-axis-dont-show-up-in-chart.html
3/ https://answers.splunk.com/answers/549858/how-to-display-numeric-x-axis-labels-on-line-chart.html
4/ https://answers.splunk.com/answers/557511/how-can-i-show-all-labels-on-x-axis-even-results-a.html
I can get the labels to appear on the xaxis with this sample search:
| makeresults
| eval data = "
1 10;
2 9;
3 8;
4 7;
5 6;
6 5;
7 4;
8 3;
9 2;
10 1;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<Date>\d+)\s+(?<Y>\d+)"
| fields + Date Y | fields - _time
|search Y = * |
chart count(Y) by Y | sort + Y
This is my sample search to simulate the pic above
| makeresults
| eval data = "
0 50;
1 57;
2 89;
3 196;
4 293;
5 424;
6 481;
7 518;
8 527;
9 501;
10 526;
11 452;
12 424;
13 373;
14 338;
15 301;
16 271;
17 258;
18 242;
19 217;
20 196;
21 176;
22 194;
23 180;
24 139;
25 146;
26 116;
27 143;
28 109;
29 103;
30 104;
31 117;
32 108;
33 89;
34 104;
35 86;
36 97;
37 102;
38 87;
39 81;
40 77;
41 88;
42 81;
43 68;
44 88;
45 72;
46 75;
47 88;
48 75;
49 70;
50 69;
51 59;
52 65;
53 60;
54 62;
55 62;
56 63;
57 70;
58 63;
59 51;
60 56;
61 45;
62 63;
63 62;
64 57;
65 39;
66 54;
67 48;
68 38;
69 53;
70 47;
71 51;
72 46;
73 52;
74 47;
75 48;
76 40;
77 43;
78 41;
79 36;
80 35;
81 31;
82 45;
83 41;
84 29;
85 42;
86 42;
87 39;
88 50;
89 33;
90 47;
91 42;
92 35;
93 32;
94 29;
95 48;
96 48;
97 40;
98 62;
99 46;
100 50;
101 49;
102 48;
103 59;
104 38;
105 57;
106 64;
107 65;
108 54;
109 79;
110 58;
111 76;
112 81;
113 59;
114 77;
115 80;
116 82;
117 88;
118 79;
119 101;
120 86;
121 104;
122 111;
123 93;
124 98;
125 114;
126 104;
127 123;
128 122;
129 137;
130 146;
131 131;
132 147;
133 117;
134 145;
135 165;
136 144;
137 178;
138 170;
139 169;
140 169;
141 159;
142 169;
143 177;
144 159;
145 195;
146 158;
147 193;
148 186;
149 199;
150 184;
151 181;
152 209;
153 187;
154 197;
155 196;
156 209;
157 183;
158 207;
159 214;
160 184;
161 238;
162 215;
163 194;
164 229;
165 239;
166 249;
167 216;
168 240;
169 197;
170 234;
171 237;
172 243;
173 240;
174 262;
175 255;
176 238;
177 245;
178 229;
179 224;
180 225;
181 226;
182 224;
183 244;
184 237;
185 222;
186 214;
187 189;
188 210;
189 209;
190 214;
191 216;
192 213;
193 200;
194 197;
195 199;
196 186;
197 187;
198 174;
199 163;
200 166;
201 188;
202 157;
203 170;
204 140;
205 141;
206 142;
207 143;
208 120;
209 140;
210 146;
211 119;
212 96;
213 131;
214 107;
215 111;
216 99;
217 109;
218 119;
219 95;
220 103;
221 98;
222 87;
223 79;
224 70;
225 76;
226 88;
227 79;
228 79;
229 68;
230 71;
231 64;
232 63;
233 61;
234 47;
235 59;
236 54;
237 46;
238 34;
239 41;
240 36;
241 30;
242 38;
243 27;
244 36;
245 24;
246 34;
247 23;
248 19;
249 26;
250 23;
251 21;
252 17;
253 12;
254 18;
255 15;
256 14;
257 9;
258 5;
259 9;
260 10;
261 6;
262 10;
263 10;
264 5;
265 3;
266 5;
267 6;
268 2;
269 2;
270 4;
271 1;
272 6;
273 3;
274 2;
275 2;
276 2;
277 1;
279 1;
280 1;
281 1;
282 1;
283 1;
284 1;
285 1;
286 1;
288 2;
289 1;
292 1;
295 1;
298 1;
299 1;
300 1;
304 1;
376 1;
377 1;
712 1;
942 1;
1097 1;
1299 1;
1455 1;
4978 1;
5240 1;
5979 1;
6060 1;
6432 1;
6617 1;
7168 1;
7182 1;
7211 1;
7231 1;
7253 1;
7280 1;
7285 1;
7286 1;
7331 1;
7351 1;
7356 1;
7386 1;
7444 1;
7457 1;
7465 1;
7468 1;
7592 1;
7616 1;
7620 1;
7656 1;
127017 1;
127376 1;
129157 1;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<sentMessage>\d+)\s+(?<count>\d+)"
| fields + sentMessage count | fields - _time
... View more
03-20-2019
02:29 PM
chart count by sentMessage | or chart count by sentMessage | did not make any difference to the x-axis for me. in either case the x-axis had no labels. have I understood the question/answer correctly?? tks
... View more
03-11-2019
06:00 PM
This is my sample search:
| makeresults
| eval data = "
1-Sep 657 34 35;
2-Sep 434 34 35;
"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)\s+(?<kpi2>\d+)\s+(?<kpi3>\d+)"
| fields + Date kpi1 kpi2 kpi3 | fields - _time
| search kpi1 = *
|rename kpi1 as "Incoming Calls in Mobile Office Directions - Call Release by Bearer Fail Times"
| rename kpi2 as "Incoming Calls in Mobile Office Directions - Common Resources Application Failures"
| rename kpi3 as "Incoming Calls in Mobile Office Directions - Assignment Failures"
| <command(s) goes here>
This gives me the columns in the following order - left to right
1/
Date
Incoming Calls in Mobile Office Directions - Call Release by Bearer Fail Times
Incoming Calls in Mobile Office Directions - Common Resources Application Failures
Incoming Calls in Mobile Office Directions - Assignment Failures
Is there a command that I can add on that will sort these alphabetically to give me
2/
Date
Incoming Calls in Mobile Office Directions - Assignment Failures
Incoming Calls in Mobile Office Directions - Call Release by Bearer Fail Times
Incoming Calls in Mobile Office Directions - Common Resources Application Failures
I know I can reorder the kpis in this part of the search
| fields + Date kpi1 kpi2 kpi3 |
But my question is more about after that and putting a specific command or commands to sort it alphabetically as 2/ above.
| <command(s) goes here>
... View more
- Tags:
- fieldnames
- search
- sort
