Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ericvdhout
ericvdhout
Path Finder
Member since:
05-05-2022
12-01-2022
Community Statistics
| Posts | 18 |
| Solutions | 2 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 05-05-2022 |
Activity Feed
- Posted Re: How to use fieldcolors on Splunk Search. 05-09-2022 07:22 AM
- Posted How to use fieldcolors on Splunk Search. 05-09-2022 06:55 AM
- Posted Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? on Splunk Search. 05-09-2022 06:51 AM
- Posted Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? on Splunk Search. 05-09-2022 03:56 AM
- Posted Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? on Splunk Search. 05-06-2022 03:26 AM
- Karma Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? for ITWhisperer. 05-06-2022 03:24 AM
- Posted Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? on Splunk Search. 05-06-2022 03:20 AM
- Karma Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? for ITWhisperer. 05-06-2022 02:48 AM
- Posted Re: (How) are fields stored in splunk in an index when extracted during ingest? on Splunk Search. 05-06-2022 02:47 AM
- Posted Re: limited field extraction on Splunk Search. 05-06-2022 02:45 AM
- Karma Re: (How) are fields stored in splunk in an index when extracted during ingest? for VatsalJagani. 05-06-2022 02:42 AM
- Karma Re: limited field extraction for gcusello. 05-06-2022 02:41 AM
- Posted Re: (How) are fields stored in splunk in an index when extracted during ingest? on Splunk Search. 05-06-2022 02:40 AM
- Karma Re: (How) are fields stored in splunk in an index when extracted during ingest? for isoutamo. 05-06-2022 02:40 AM
- Posted Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? on Splunk Search. 05-06-2022 01:50 AM
- Posted Re: How to get the total of the events with an errorcode to appear as a percentage of the overall total of events? on Splunk Search. 05-06-2022 01:13 AM
- Posted Re: Percentage of total on certain values on Splunk Search. 05-06-2022 12:57 AM
- Posted Re: (How) are fields stored in splunk in an index when extracted during ingest? on Splunk Search. 05-06-2022 12:44 AM
- Posted Re: limited field extraction on Splunk Search. 05-05-2022 08:07 AM
- Posted Re: Percentage of total on certain values on Splunk Search. 05-05-2022 07:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-09-2022
07:22 AM
No idea what FieldColors does, but SeriesColors seems to be my friend. "viz_CgGpI6E0": {
"type": "splunk.area",
"dataSources": {
"primary": "ds_aNB3d69r_ds_d4nLznpt"
},
"title": "Nanoservice request results",
"options": {
"stackMode": "stacked100",
"seriesColors": "[#42663a,#7a1709]"
},
"showProgressBar": false,
"showLastUpdated": false
}
... View more
05-09-2022
06:55 AM
Hi, In one of my graphs I try to fixate the areacolors to red and green. However, I can't figure out how. Tried this: "visualizations": {
"viz_CgGpI6E0": {
"type": "splunk.area",
"dataSources": {
"primary": "ds_aNB3d69r_ds_d4nLznpt"
},
"title": "Nanoservice request results",
"options": {
"stackMode": "stacked100"
},
"fieldColors": {
"OKPerc": "#42663a",
"ErrorPerc": "#7a1709"
},
"showProgressBar": false,
"showLastUpdated": false
},
"viz_r9Pd57Q4": {
"type": "splunk.markdown",
"options": {
"markdown": ""
}
}
}, Also tried placing them inside the "Options" object. "visualizations": {
"viz_CgGpI6E0": {
"type": "splunk.area",
"dataSources": {
"primary": "ds_aNB3d69r_ds_d4nLznpt"
},
"title": "Nanoservice request results",
"options": {
"stackMode": "stacked100",
"fieldColors": {
"OKPerc": "#42663a",
"ErrorPerc": "#7a1709"
}
},
"showProgressBar": false,
"showLastUpdated": false
},
}, But the colors stay wrong. Am I doing it wrong? Current graph: Purple should be green and blue should be red. Cheers,
... View more
Labels
- Labels:
-
chart
05-09-2022
06:51 AM
Well, That did not work the way I wanted, but I will ask an extra question for that, for it is kind of offtopic for here.
... View more
05-09-2022
03:56 AM
Cool, thank you, Am going to dive into that.
... View more
05-06-2022
03:26 AM
certainly helps. You do not, by accidnt, happen to know how I can change the colors of the 2 fields? All over the net I see ways to change it in xml in the source, however I have no xml in the source, merely lookss like json.
... View more
05-06-2022
03:20 AM
That wen surprisingly well 🙂 This is almost what I wanted to see. Thnx (however, I consider the table posiibility Vatsaljagani mentioned a more elegant solution.)
... View more
05-06-2022
02:47 AM
event_type should be an indexed field. However I need to ask how and where the sourcetype/fields are confugured for indexing during indextime. Will get back on that.
... View more
05-06-2022
02:45 AM
As again, thnx all for the many replies and suggestions. I choose gcusello as accepted solution, not because it is the best suggestion, but it just gives an answer to the question I asked about the storage/extraction of the fields in the modes. Al the other suggestions dig deeper into the problem that is behind my question and I highly appreciate this.
... View more
05-06-2022
02:40 AM
Does this field::value thingy also works for charts in dashboards? Troed to change the working, but slow query index="aiam_apigw_app_idx" event_type="APIEND" | timechart span=1m count by platform to index="aiam_apigw_app_idx" event_type::"APIEND" | timechart span=1m count by platform and the first one gave a correct graph, the second one gave no results?
... View more
05-06-2022
01:50 AM
OK, | eval OKPerc = (OK/(OK+Enter))*100 should be | eval OKPerc = (OK/(OK+Error))*100 This really looks like something. Now, I tried to be smart and change | fields - OK, Error to | fields - Error, OK because I would like to have the errorlayer at the bottom. But this did not work. Is that possible?
... View more
05-06-2022
01:13 AM
OK, Tried your suggestion, I guess I am doing something wrong. Looks like this: (for the record, this is roughly the same timeframe as the green/red graph I posted earlier) This is the actual query: index="aiam_apigw_app_idx" event_type="APIEND"
| eval is_error=if(ms_result=="OK" OR ms_result=="200-10000", "OK", "Error")
| timechart count by is_error
| eval ErrorPerc = (Error/(OK+Error))*100
| eval OKPerc = (OK/(OK+Enter))*100
| fields - OK, Error I also chose stacked 100%
... View more
05-06-2022
12:57 AM
index="aiam_apigw_app_idx" event_type="APIEND" | bin starttime as _time span=1m
| stats count as total count(eval(ms_result=="OK" OR ms_result=="200-10000")) as OK by _time
| eval errorpercentage=round(100*(total-OK)/total,2)
| fields - OK total
... View more
05-06-2022
12:44 AM
Thank you all for your insights, I will dig into your suggestions.
... View more
05-05-2022
08:07 AM
Hmmm, funny, This is by no means my experience. I tried splunk on 3 environments now and keep getting to the same conclusion. However, I do have to say we have quite a lot of data (The number of events per 30 minutes fluctuates between 25 mln and 50 mln events per half an hour, depending on time of the day/nr. of requests done to our platform. As for that search ... When I keep it simple, and just request all events in a certain timeframe, Splunk cannot keep up with Elastic. The main issue is then when needing an ad hoc search (for example when under pressure because of a serious incident), I may need to search quickly on a certain ID or ip-address or some other field. When in Elastic, I just filter on that ID for the last 2 days and the resulting few lines are there in a few seconds. Splunk needs way more time for that since it seems just to walk through all events and match the 'fields' or something lime that?
... View more
05-05-2022
07:46 AM
Thnx for the attempt. However, not yet exactly what I was thinking of?
... View more
05-05-2022
06:55 AM
Hi,
Am quite new to splunk, and coming from Elasticsearch, so my knowledge is biased. However I did notice that Elastic performs faster on large datasets. I think 1 of the main reasons is the on-the-fly field extractions splunk performs when searching.
hence we created a source_type for ingesttime fieldextraction. Now I would expect these field would always be available, even when choosing for fast-mode. However, this seems not to be that way.
So my questions: (How) are fields stored in splunk in an index when extracted during ingest?
Can I tell splunk to NOT extract extra fields for a certain index when in fast_mode or smart mode, but just show the fileds extracted during the ingest? Thnx
... View more
Labels
- Labels:
-
field extraction
-
fields
-
other
05-05-2022
06:48 AM
Hi,
Am quite new to splunk so lease bear with me if I ask obvious questions. However things that were relatively simple in grafana (which we are coming from) seem uge tasks here in splunk. So I do hope someone can help me with the following ... I have this index, in whch a field, ms_result is extracted. This field can have numerous resultcodes. Only 2 of them are good ("OK" and "200-10000"). All other codes are errorcodes.
Now I would like the total of the events with an errorcode to appear as a percentage of the overal total of events withing this search (per minute). So let's say, we have 1000 events, and 100 of them have an errorcode, then 10% should ben shown on the (area) graph. Below the picture I would like to recreate. Is this by any means possible?
Thnx
... View more
- Tags:
- chart
- percentage
- total
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-01-2022
11:03 AM
|
