Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tdoSplunk
tdoSplunk
Path Finder
Member since:
03-20-2019
01-27-2021
Community Statistics
| Posts | 19 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 03-20-2019 |
Activity Feed
- Got Karma for Create Tile or Panel for each row of table?. 03-30-2023 11:03 AM
- Karma Re: Calculate the difference between two time fields within a single event for gcusello. 06-05-2020 12:51 AM
- Got Karma for How to hide search and inpsect links from all panels?. 06-05-2020 12:51 AM
- Got Karma for How to create trellis timechart with stacked bars. 06-05-2020 12:50 AM
- Posted How to hide search and inpsect links from all panels? on Dashboards & Visualizations. 02-03-2020 07:03 AM
- Tagged How to hide search and inpsect links from all panels? on Dashboards & Visualizations. 02-03-2020 07:03 AM
- Tagged How to hide search and inpsect links from all panels? on Dashboards & Visualizations. 02-03-2020 07:03 AM
- Posted Re: Pass Value to macro with inputlookup to return value on Knowledge Management. 01-24-2020 12:15 AM
- Posted Re: help on where command which is malformed on Splunk Search. 01-23-2020 11:38 PM
- Posted Re: Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 04:29 AM
- Posted Re: Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 04:10 AM
- Posted Re: Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 03:59 AM
- Posted Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 02:14 AM
- Tagged Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 02:14 AM
- Tagged Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 02:14 AM
- Tagged Pass value to subsearch with inputlookup on Splunk Search. 01-23-2020 02:14 AM
- Posted Pass Value to macro with inputlookup to return value on Knowledge Management. 01-23-2020 02:10 AM
- Tagged Pass Value to macro with inputlookup to return value on Knowledge Management. 01-23-2020 02:10 AM
- Tagged Pass Value to macro with inputlookup to return value on Knowledge Management. 01-23-2020 02:10 AM
- Tagged Pass Value to macro with inputlookup to return value on Knowledge Management. 01-23-2020 02:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
02-03-2020
07:03 AM
1 Karma
Hi,
I created a lot of panels for my dashboards. Now I want to hide the kinks at the bottom of each panel.
This should work like this
<option name="refresh.link.visible">false</option>
<option name="link.openSearch.visible">false</option>
<option name="link.openPivot.visible">false</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.exportResults.visible">false</option>
Is there a way to implement it for all panels without adding it via simple xml. Perhaps in a conf or something similar?
Hope you can help me.
Best regards
Thomas
... View more
01-24-2020
12:15 AM
https://answers.splunk.com/answers/797495/pass-value-to-subsearch-with-inputlookup-1.html
I posted it twice, sorry
... View more
01-23-2020
11:38 PM
Hi jip31,
why are you using a single quote at the end of this line? | where PROCESS==("TITI","TUTU")
because of the single quote a macro is expected.
remove the quote and/or replace with something like this
| where like(PROCESS,"TITI") OR like(PROCESS,"TUTU")
best regards
... View more
01-23-2020
04:29 AM
I solved it by a join...
First I thought it will be to slow, but it works fine
| join type=left nodeId
[ |inputlookup transfer_nodes.csv
|rename name as DestinationHost]
...
... View more
01-23-2020
04:10 AM
this will not work. it is not possible to pass the token $last_dest_node_id$ to the subsearch
A map would be a possible solution like ...
|map [|inputlookup transfer_nodes.csv
|search nodeId=$last_source_node_id$]
but the table only contained the result of the subsearch, not the conbination of both searches
... View more
01-23-2020
02:14 AM
Hi,
perhaps it is the wrong approach, but i try to use an inputlookup within a search and pass a value to this subsearch.
It looks like this:
index=myindex sourcetype=stype source=sourcename
|eval SourceHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_source_node_id$)
|fields name
|stats first(name) as SourceHost
|eval SourceHost="\"".SourceHost."\""
|return $SourceHost
]
|eval DestinationHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_dest_node_id$)
|fields name
|stats first(name) as DestinationHost
|eval DestinationHost="\"".DestinationHost."\""
|return $DestinationHost
]
|table name,SourceHost,DestinationHost
I get the following error: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.
The problem is the passing of the value $last_source_node_id$ ($last_dest_node_id$)
I already tried to map the subsearch, then the passing works, but the result is not what i expected.
Finally I would like to use a macro like GetTransferNode($last_nodeId$)
Hope you have an idea how to solve it.
best regards and thank you in advance !
... View more
01-23-2020
02:10 AM
Hi,
perhaps it is the wrong approach, but i try to use an inputlookup within a search and pass a value to this subsearch.
It looks like this:
index=myindex sourcetype=stype source=sourcename
|eval SourceHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_source_node_id$)
|fields name
|stats first(name) as SourceHost
|eval SourceHost="\"".SourceHost."\""
|return $SourceHost
]
|eval DestinationHost =[|inputlookup transfer_nodes.csv
|search nodeId IN ($last_dest_node_id$)
|fields name
|stats first(name) as DestinationHost
|eval DestinationHost="\"".DestinationHost."\""
|return $DestinationHost
]
|table name,SourceHost,DestinationHost
I get the following error: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.
The problem is the passing of the value $last_source_node_id$ ($last_dest_node_id$)
I already tried to map the subsearch, then the passing works, but the result is not what i expected.
Finally I would like to use a macro like GetTransferNode($last_nodeId$)
Hope you have an idea how to solve it.
best regards and thank you in advance !
... View more
Labels
- Labels:
-
lookup
-
search macro
07-11-2019
04:05 AM
thank you for your respond, but it is a requirement to use trellis (to have a chart like this, splitted by LoginName). I think timechart is a good way, but perhaps I have to do some extra work before or after it
... View more
07-10-2019
07:37 AM
1 Karma
Hi,
I want to create a timechart as trellis with stacked bars.
I have the following columns:
Workdate, Duration, BookingType, LoginName
2019-06-03,5,1,User1
2019-06-03,2,2,User1
2019-06-03,1,3,User1
2019-06-03,3,1,User2
2019-06-03,3,2,User2
2019-06-03,2,3,User2
...
My Expectation is to see 2 Charts, one for User1 and one for User2 with a stacked bar for the Workdate 2019-06-01
The Total sum for each is 8, separated by the durations by BookingType
My first approach was to use |timechart sum(Duration) as Total by BookingType , then I get nearly the result I want. But it is not possible to use Trellis (by LoginName).
Do you have ideas on how to solve it?
best regards
Thomas
... View more
06-03-2019
01:20 AM
Hi,
thanks for your response. It works nearly perfect. But in some cases e.g. "Current Year" or "Today" the label shows "Custom Time". Is that a normal behaviour?
best regards
Thomas
... View more
05-31-2019
01:48 AM
Hi,
we want to display the selected time range in another dashboard (via drilldown). We already use the $earliest$ and $latest$ so that we can display the time range with "from" "to".
Our goal is now to display the label of the selected time range in the second dashboard as well. e.g. "Last 7 Days" or "Current Year"
I already set an eval to calculate the duration
<eval token="diff">tostring((tokLatestTime - tokEarliestTime), "duration")</eval>
<eval token="durationStr">tostring(floor(diff))</eval>
but it is not really what we are looking for.
Step by step:
1) Choose time range in Dashboard 1 --> e.g. Last 7 Days
2) Click on table --> Drilldown via link
<drilldown>
<link target="_blank">/app/myapp/dashboard2?earliest=$earliest$&latest=$latest$&TimeLabel=????</link>
</drilldown>
3) Show TimeLabel on Dashboard2
Do you have an idea how to get this label?
best regards
Thomas
... View more
03-25-2019
07:18 AM
@niketnilay Thanks !
... View more
03-25-2019
07:17 AM
Hi,
very cool. This could be the solution. But the drilldown/link to the underlying dashboard does not work.
I had a look into the documentation, but found no explanation of how to use the drilldown functionality.
...
|table label,AppDescription,selectedApp, relatedDashboard, link
|rename selectedApp as _selectedApp relatedDashboard as _relatedDashboard link as _link</query>
<finalized>
<condition match=" $job.resultCount$ >= 1">
<set token="tokselectedApp">$result._selectedApp$</set>
<set token="tokrelatedDashboard">$result._relatedDashboard$</set>
</condition>
</finalized>
...
<option name="drilldown">all</option>
<option name="height">200</option>
<option name="refresh.display">progressbar</option>
<option name="status_indicator_app.status_indicator.colorBy">static_color</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">fix_icon</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">3</option>
<option name="status_indicator_app.status_indicator.staticColor">#00BCD4</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
<option name="trellis.enabled">1</option>
<option name="trellis.size">small</option>
<option name="trellis.splitBy">App Name</option>
<drilldown>
<link target="_blank">../$row._selectedApp$/$row._relatedDashboard$</link>
</drilldown>
...
My approach did not work. Do you have an idea?
best regards
... View more
03-22-2019
01:15 AM
Thanks for your reply. Hope my attached description helps you to understand my requirement.
... View more
03-22-2019
01:14 AM
Hi,
the result will be a table with 3 columns (AppName, Description, Link) and about 10 rows. The number of rows is not static and depends on the user.
I want to have a Tile for each row of the table. I created a little mockup how it should look like.
My UseCase is to create a dashboard with all available apps for the user. By clicking on the tile the user will be navigated to related dashboard of the app.
... View more
03-21-2019
01:30 AM
1 Karma
Hi,
is it possible to create a tile for each row of a result (table)? Trellis is not supported, so perhaps there is another way to solve it?
best regards
Thomas
... View more
- Tags:
- splunk-enterprise
03-21-2019
12:59 AM
Thank you very much. Works great for me!
... View more
03-20-2019
05:39 AM
Hi,
I want to create a simple list in my dashboard where I can see all assigned Apps(Only with one column, the AppName). The rows are clickable.
That was no problem, but my second requirement is to create a link to a dashboard of the clicked App.
To achieve this goal I created a search
<query>|rest /servicesNS/-/-/data/ui/views
|rename eai:appName as AppID, label as DashboardName, title as DashboardID
|search DashboardID=*overview
|join AppID [ | rest /services/apps/local |search label="$selectedApp$" |rename title as AppID| table AppID label ]
|eval selectedApp=AppID, relatedDashboard=DashboardID
|table label</query>
<finalized>
<condition match=" $job.resultCount$ >= 1">
<set token="tokselectedApp">$result.selectedApp$</set>
<set token="tokrelatedDashboard">$result.relatedDashboard$</set>
</condition>
</finalized>
</query>
The Tokens will be used to create the link
<drilldown>
<link target="_blank">../$tokselectedApp$/$tokrelatedDashboard$</link>
</drilldown>
This Approach does only work when I modify the search to
<query>|rest /servicesNS/-/-/data/ui/views
|rename eai:appName as AppID, label as DashboardName, title as DashboardID
|search DashboardID=*overview
|join AppID [ | rest /services/apps/local |search label="$selectedApp$" |rename title as AppID| table AppID label ]
|eval selectedApp=AppID, relatedDashboard=DashboardID
|table label, selectedApp, relatedDashboard</query>
But I do not want to have the fields selectedApp and relateddashboard in my results view.
Is the Approach completely wrong or how does it work?
Hope you can help me
best regards,
Thomas
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-27-2021
03:25 AM
|
