Knowledge Management

bizarre multivalue/mvexpand question

sideview
SplunkTrust
SplunkTrust

In complex reporting views I often use the FlashTimeline module near the top, to allow the user to regenerate the FlashCharts and other reports for just the timerange that they click or drag on the FlashTimeline.

Unfortunately when the reports on such a view get converted to pull data from a summary index, the y-axis scale on the FlashTimeline becomes confusing, because of course each individual 'event' in the summary data is actually representing N events, but nobody tells the FlashTimeline this.

One approach I've taken elsewhere is to strip the FlashTimeline down so that it has no y-axis, and so the bars are all the same height and it becomes effectively a big 'navigation strip'.

However I feel like there's maybe some cruel and unusual search language that can turn my summary rows with count=5 back into 5 rows.

if I could get count=5 turned into count=5,5,5,5,5, then I could split and then mvexpand the rows, and if I did the foo NOT foo | append [] trick, I could theoretically get FlashTimeline's y-axis correct again.

Probably with all the duct tape I'm throwing around here, this isnt a great idea, but if anyone could point me in the right direction I'd like to at least evaluate it.

0 Karma

ziegfried
Influencer

The only option I can think of is to write a custom search command which duplicates those events for you based on the count value.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...