Knowledge Management

bizarre multivalue/mvexpand question

sideview
SplunkTrust
SplunkTrust

In complex reporting views I often use the FlashTimeline module near the top, to allow the user to regenerate the FlashCharts and other reports for just the timerange that they click or drag on the FlashTimeline.

Unfortunately when the reports on such a view get converted to pull data from a summary index, the y-axis scale on the FlashTimeline becomes confusing, because of course each individual 'event' in the summary data is actually representing N events, but nobody tells the FlashTimeline this.

One approach I've taken elsewhere is to strip the FlashTimeline down so that it has no y-axis, and so the bars are all the same height and it becomes effectively a big 'navigation strip'.

However I feel like there's maybe some cruel and unusual search language that can turn my summary rows with count=5 back into 5 rows.

if I could get count=5 turned into count=5,5,5,5,5, then I could split and then mvexpand the rows, and if I did the foo NOT foo | append [] trick, I could theoretically get FlashTimeline's y-axis correct again.

Probably with all the duct tape I'm throwing around here, this isnt a great idea, but if anyone could point me in the right direction I'd like to at least evaluate it.

0 Karma

ziegfried
Influencer

The only option I can think of is to write a custom search command which duplicates those events for you based on the count value.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...