About danspav

danspav

Hi @MattKr, Here's an option that will run from the UI. | rest /services/data/indexes splunk_server=local | stats count by title | rename title as index | map [| metadata type=sourcetypes index=$index$ | eval index="$index$"] maxsearches=100 In the first line, make sure splunk_server=<NAME OF INDEXER>, for Splunk Cloud local is fine. Make the maxsearches=XXX match the total number of indexes you have. This uses the metadata command to get the sourcetypes, and earliest/latest times, and the number of matching events. The one drawback is that the index isn't included in the results, so I've set it up via the map command so it will run the metadata search for each index. Couple of things to note: This will run as many searches as you have indexes - so be careful. The metadata search is lightening fast as it only runs on the index metadata (hence the name) so there's no real data being brought back - just data about the index. You need to run it as an all-time search to get all of your data... Pick a time to do this to reduce any impact. I ran the search on a small cloud environment with 52 indexes over all time and it completed in 4.9s. Give that a go.

danspav

안녕하세요 릴리, 두 차트는 사용된 시간 범위로 인해 다르게 나타납니다. 첫 번째 차트는 데이터가 있는 경우에만 차트에 선을 표시하는 Splunk 검색에서 가져온 것입니다. 두 번째 차트는 데이터가 없더라도 "전체 기간"에 대한 타임라인을 표시하는 Dashboard Studio의 차트입니다. 차트 2를 차트 1처럼 보이게 하려면 데이터와 일치하도록 시간 범위를 설정하면 됩니다. 데이터와 일치하도록 시간 범위를 설정하면: (저는 한국어를 잘 못해서 번역기를 사용해야 했어요.)

danspav

Hi @viktoriiants., How about something like this: index=_internal | eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d") | eval dayNum=tonumber(strftime(_time,"%w")) + 1 ``` 1=Sunday, ..., 7=Saturday``` | stats count as "Session count" by dayOfWeek, date | addtotals col=t row=f | eval sort = if(isnull(date),1,0) | sort - sort + date | fields - sort Here we're creating a new temporary field to sort on, where we set it to 1 for our total row, and 0 for all other rows. Then we sort by this column and the date column. Finally, we remove the "sort" column.

danspav

Hi @karthi2809, Try this CSS: #input_link_split_by {width:fit-content!important;} #input_link_split_by.input-link button{ width: fit-content!important; margin-right:2px; background-color: #3c444d; border-top-color: #3c444d; border-top-style: solid; border-top-width: 1px; border-right-color: #3c444d; border-right-style: solid; border-right-width: 1px; border-left-color:#3c444d; border-left-style: solid; border-left-width: 1px; border-top-left-radius: 10px; border-top-right-radius: 10px; transition: background-color 0.5s ease; transition: border-color 0.5s ease; } #input_link_split_by button:hover{ background-color:#d2e3a0; border-right-color: #d2e3a0; border-top-color:#d2e3a0; border-left-color:#d2e3a0; color: black; } #input_link_split_by button[aria-checked="true"]{ background-color: #d2e3a0; color: black; } That gives you tabs that keep their colour after you have selected them: The key bit is: #input_link_split_by button[aria-checked="true"] Which is the CSS to identify a selected tab. Cheers, Spav

danspav

@NoIdea, There are different namespaces for tokens - default, submitted, and environment. You're running into the issue because you're using the "default" tokens. These are the ones we normally use as they are updated on the fly, whereas the submitted tokens are only updated after clicking the submit button. You can refer to these tokens using the namespace followed by a colon, eg: Default: $tok1$ Submitted: $submitted:tok1$ I've tried to understand the values you've put for the tokens and made an alternative dashboard showing the use of submitted tokens: <form version="1.1" theme="light"> <label>answers</label> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="tok1" searchWhenChanged="false"> <label>Tok1</label> <choice value="All">*</choice> <choice value="" "AND upper(STATUS)=upper('Active')"">Y</choice> <choice value="" "AND upper(STATUS)=upper('Inactive')"">N</choice> <prefix>Status="</prefix> <default>*</default> </input> <input type="text" token="tok2" searchWhenChanged="false"> <label>UserID</label> <default></default> <prefix> AND UserID=\"*" + upper(</prefix> <suffix>) + "*"</suffix> </input> </fieldset> <row> <panel id="table_1"> <html><h2>Using $$tok1$$</h2><table><tr><td><strong>$$tok1$$=</strong></td><td><textarea>$tok1$</textarea></td></tr><tr><td><strong>$$tok2$$=</strong></td><td><textarea>$tok2$</textarea></td></tr></table> <style>textarea{padding: 4px; font-size:16px;resize:none;width: 300px;border: 1px solid black;} div[id^="table"] td{border:1px solid black;padding: 4px;} div[id^="table"]{width: fit-content; } </style> </html> </panel> </row> <row> <panel id="table_2"> <html><h2>Using $$submitted:tok1$$</h2><table><tr><td><strong>$$submitted:tok1$$=</strong></td><td><textarea>$submitted:tok1$</textarea></td></tr><tr><td><strong>$$submitted:tok2$$=</strong></td><td><textarea>$submitted:tok2$</textarea></td></tr></table></html> </panel> </row> <row> <panel> <html><h2>The Search</h2>| search * $submitted:tok1$ $submitted:tok2$ </html> </panel> </row> </form> By putting your evals and conditionals directly into the values the form should work: Hopefully that gets you closer to what you're after. There is another way to tackle this - but I don't quite understand your search. It's almost SPL but not quite. If the above isn't what you're after, can you explain your search a bit more?

danspav

I think I understand - try this search to create a table with fields: _time, percentage and one or more columns based on the value calculated each hour: | gentimes start=-7 | eval sample=random()%100 | eval perc=random()%50 | rename starttime as _time | append[|makeresults | eval sample=100, perc=45| table _time, sample, perc] | timechart span=1d max(sample) as name, avg(perc) as "percentage" ``` Calculate how we name the fields based on the value of: name ``` | eval rename_field_to=if(name=100,"C","N/A") | eval "The Sample Yields {rename_field_to}" = name | fields - rename_field_to, name This will create three or four columns: _time = time percentage = hourly average of the perc field The Sample Yields C = If the max for that hour was 100 The Sample Yields N/A = If the max for that hour was not 100 If you only want "The Sample Yields C" or nothing, then you can filter out with a | search name="C" after the timechart command. The main SPL is : | eval "The Sample Yields {rename_field_to}" = name That will allow you to name a field using the value of another field. If you want NA to simply be N/A then you can do a rename: | rename "The Sample Yields N/A" as "N/A" Is that closer to what you were after?

danspav

Ok, here's a quick fix to stop any dashboards loading after a page refresh: <condition value="dash_a"> <link target="_blank">/app/search/dash_a</link> <set token="form.link_dash"></set> <set token="link_dash"></set> </condition> This will only create a new window with a dashboard if the token matches dash_a, and do nothing if it's blank. Once we load the dashboard, we reset the token (both form.token and token) to an empty string. That way if the page reloads, we do nothing. We can also make the condition statement a bit smarter. If you set the choice values to be the name of the dashboard you want to load, we can do this: Final Version <form version="1.1" theme="light"> <label>Dash_C</label> <fieldset submitButton="false"> <input type="link" token="link_dash"> <label>View other Dashboard:</label> <choice value="dash_a">Dashboard 1 ↗</choice> <choice value="dash_b">Dashboard 2 ↗</choice> <choice value="dash_c">Dashboard 3 ↗</choice> <change> <condition value=""> </condition> <condition> <link target="_blank">/app/search/$link_dash$</link> <set token="form.link_dash"></set> <set token="link_dash"></set> </condition> </change> </input> </fieldset> <row><panel depends="$CSS$"><html><style> .splunk-linklist{width:fit-content!important;} .splunk-linklist button{ min-width: 120px;} .splunk-linklist button span{ -webkit-box-pack: left; justify-content: left;-webkit-box-align: left; align-items: left;} .splunk-linklist button{background-color: #dddddd82;margin: 4px 2px 0px 0px; transition: 0.3s;} .splunk-linklist button:hover {background-color:#007abd!important;color:white!important;}</style></html></panel> </row> </form> The condition block will do nothing if the link_dash token is blank, but will load the dashboard in $link_dash$ if it's not blank. It then sets the token to "" so it won't load the dashboard again on a refresh. By using the <condition> as above, it allows you to add as many dashboards as you want via the dropdown UI without needing to update the code.

danspav

Hi @joelsz, Using Splunk 9.1.0 I set up 3 dashboards: dash_a, dash_b, dash_c When you click a button it loads the corresponding dashboard, and that's all. I've added some starter CSS to pretty up the buttons: <form version="1.1" theme="light"> <label>Dash_C</label> <fieldset submitButton="false"> <input id="linkToOtherDash" type="link" token="link_dash"> <label>View other Dashboard:</label> <choice value="dash_a">Dashboard 1 ↗</choice> <choice value="dash_b">Dashboard 2 ↗</choice> <choice value="dash_c">Dashboard 3 ↗</choice> <change> <condition value="dash_a"> <link target="_blank">/app/search/dash_a</link> </condition> <condition value="dash_b"> <link target="_blank">/app/search/dash_b</link> </condition> <condition value="dash_c"> <link target="_blank">/app/search/dash_c</link> </condition> </change> </input> </fieldset> <row><panel depends="$CSS$"><html><style> .splunk-linklist{ width:fit-content!important; } .splunk-linklist button{ min-width: 120px; } .splunk-linklist button span{ -webkit-box-pack: left; justify-content: left; -webkit-box-align: left; align-items: left; } .splunk-linklist button{ background-color: #dddddd82; margin: 4px 2px 0px 0px; transition: 0.3s; } .splunk-linklist button:hover { background-color: #007abd!important; color: white!important; } </style></html></panel> </row> </form> Note that if you click a button, then go back to the original dashboard and click edit then cancel, it will load the second dashboard again. If you want to avoid that then update the links and remove target="_blank" .

danspav

Hi @deepdive100., You can create the column name based on what the field "name" is set to using by: |makeresults |eval sample="100" |eval name=if(sample=100,"C",N/A) |timechart max(sample) by name This creates a table with columns: _time, C. If the values are less or more than 100, there'll be an additional column "N/A" If you have a dashboard and you want to pick which column is displayed, you could do something like: |makeresults |eval sample="100" |eval name=if(sample=100,"$DROPDOWN_TOKEN$",N/A) |timechart max(sample) by name And set up an input that sets the token $DROPDOWN_TOKEN$.

danspav · ‎01-21-2024

Hi @Hemant93, Masking sensitive data is typically performed on the Heavy Forwarder / Indexer before it goes into the Splunk index. We can do that job with a props.conf file. [maskpii] SEDCMD-pii-dob = s/@dob=['"][^'"]+['"]/@dob='***MASKED***'/g SEDCMD-pii-ssn = s/@ssn=['"][^'"]+['"]/@ssn='***MASKED***'/g This file uses the maskpii sourcetype, and tells Splunk to change any dob or snn value to "***MASKED***". Put that props file on either the heavy forwarder or indexer (wherever your data is sent first) and restart Splunk. Using that file I ingested your sample data and here's the result:

danspav · ‎01-18-2024

Hi @PaulaCom, Here's a way to convert your date to "Jan", "Feb" etc: strftime(date_field, format) see docs We can use the field Order_Date like this: eval month = strftime(strptime(Order_Date, "%d/%m/%Y"), "%b") That adds another step of converting the date to a unix timestamp, then converting that timestamp to the Month in english. Now that we have the month, we can make it a field by using special curly brackets: | eval {month} = Total That will create a field called "Jan" or "Feb" with the value of the total for sales. Here's the Search all together: |makeresults | eval data="Account_No=\"123\", Total=\"15.00\", Order_Date=\"1/01/2023\"@@Account_No=\"123\", Total=\"35.00\", Order_Date=\"15/02/2023\"@@Account_No=\"123\", Total=\"45.00\", Order_Date=\"19/02/2023\"@@Account_No=\"456\", Total=\"15.00\", Order_Date=\"1/01/2023\"@@Account_No=\"456\", Total=\"50.00\", Order_Date=\"25/01/2023\"@@Account_No=\"456\", Total=\"10.00\", Order_Date=\"19/02/2023\"" | makemv data delim="@@" | mvexpand data | rename data as _raw | extract ``` The above just creates the test data``` | eval month = strftime(strptime(Order_Date, "%d/%m/%Y"), "%b") | stats sum(Total) as Total by Account_No, month | eval {month}=Total | fields - Total, month | stats sum(*) as * by Account_No | table Account_No, Ja*, Fe*,Ma*,Ap*,Ma*,Jun*, Jul*,Au*,Se*,Oc*,No*,De* The last table bit at the end is so that the months are listed in the right order. The result is: Hopefully that gets you closer to what you were looking for. Cheers, Daniel

danspav · ‎01-18-2024

Hi @jholman2000, I don't think there's a way to set two token values from the one dropdown like you can with simpleXML dashboards, but here's a workaround - You can create a simple search that will use the environment token and produce the appropriate index name, which can then be used in your main search. { "type": "ds.search", "options": {"query": "| makeresults\n| eval index=if(\"$api_env$\"=\"prod\",\"wf_wb_cbs\",\"wf_wb_cbs_np\")\n| table index", "enableSmartSources": true }, "name": "IndexName" } The search will be pretty quick, and will only run on the search head. It just looks at the environment token and sets the index to prod or nonprod as appropriate. The key part is the "enableSmartSources" which you get when checking the "Access search results or metadata" checkbox. Now you can refer to the index name: $IndexName:result.index$ So your final search will be: index=$IndexName:result.index$ CA03430 sourcetype="cf:logmessage" cf_app_name="CA03430-cmsviewapi-$api_env$" | spath "msg.customerIdType" | eval eventHour = strftime(_time,"%H") | where eventHour >= "07" and eventHour < "20" | stats count by "msg.customerIdType" Hope that helps you out. Cheers, Daniel

danspav · ‎01-17-2024

Hi @anooshac, You were probably really close to the solution for this - but it looks like using tokens to set the colour on tables only works before the table has loaded. The only workaround out I found was to re-run the search each time you select a new radio button. Here's a working version for you to build from. The radio buttons set the type: Both and Type A => Highlight Columns A and B Type B => Highlight Column B The table has a format for ColumnA and ColumnB that looks for the right Type in the token: <format type="color" field="ColumnB"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeB.*"),"#FF0000", "")</colorPalette> </format> To make the dashboard redraw with the right columns highlighted, I added this to the query: ``` $field_to_highlight$ ``` That won't do anything to the search results, but will force the search to be run again. Here is a working dashboard: <form version="1.1" theme="dark"> <label>Answers for anooshac</label> <fieldset submitButton="false"> <input type="radio" token="field_to_highlight" searchWhenChanged="true"> <label>Option</label> <choice value="TypeA__TypeB">Both</choice> <choice value="TypeA_TypeB">Type A</choice> <choice value="TypeB">Type B</choice> <default>TypeATypeB</default> </input> </fieldset> <row> <panel> <table> <title>Content</title> <search> <query>| gentimes start=-20 | eval type=if(random()%2==0,"Type A","Type B") | appendcols[|windbag] | fields starttime, endtime, sample, lang, type | rename starttime as "ColumnA", endtime as "ColumnB" | head 20 ``` $field_to_highlight$```</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="ColumnA"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeA.*"),"#FF0000", "")</colorPalette> </format> <format type="color" field="ColumnB"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeB.*"),"#FF0000", "")</colorPalette> </format> </table> </panel> </row> </form> Hopefully that's close to what you were after.

danspav · ‎01-17-2024

Hi @vishalrohila, You can create dynamic dropdowns by creating searches that populate based on the value of tokens. For example, you can create a dropdown to let users pick either A or W, and that sets a token, $A_or_W$ Then, in the second dropdown you can populate the list based on a lookup, search, or faking the results, and filter out based on what should be shown for A or W. Faking the search to make the options: | makeresults | eval parent="a;w" | makemv parent delim=";" | mvexpand parent | eval options=case(parent="a", "a;b;c", parent="w", "x;y;z") | makemv options delim=";" | mvexpand options | search parent="$A_or_W$" | table options With that configured, you get a dropdown for A or W selection, which then populates the second dropdown with ABC or XYZ. Your example was fairly generic, so your actual use case might be a better fit for a lookup, with Parent / Label / Value fields. Either way, they list can be filtered by the first lookup. Here's the Dashboard code for you to try out: {"visualizations":{}, "dataSources":{"ds_gKyzOqv5":{"type":"ds.search","options":{"query":"| makeresults\n| eval parent=\"a;w\"\n| makemv parent delim=\";\"\n| mvexpand parent\n| eval options=case(parent=\"a\", \"a;b;c\",parent=\"w\", \"x;y;z\")\n| makemv options delim=\";\"\n| mvexpand options\n| search parent=\"$A_or_W$\"\n| table options"},"name":"dropdown"}}, "defaults":{"dataSources":{"ds.search":{"options":{"queryParameters":{"latest":"$global_time.latest$","earliest":"$global_time.earliest$"}}}}}, "inputs":{"input_global_trp":{"type":"input.timerange","options":{"token":"global_time","defaultValue":"-24h@h,now"},"title":"Global Time Range"},"input_gkLCoAVl":{"options":{"items":[],"token":"dd_7gHCFird","selectFirstSearchResult":true},"title":"Dropdown Input Title","type":"input.dropdown","dataSources":{"primary":"ds_gKyzOqv5"}},"input_VpWiOave":{"options":{"items":[{"label":"All","value":"*"},{"label":"A","value":"a"},{"label":"W","value":"w"}],"token":"A_or_W","defaultValue":"*"},"title":"Choose A or W","type":"input.dropdown"}}, "layout":{"type":"grid","options":{"width":1440,"height":960}, "structure":[],"globalInputs":["input_global_trp","input_VpWiOave","input_gkLCoAVl"]}, "description":"", "title":"test"} Hopefully that helps.

danspav · ‎10-26-2023

Hi @smanojkumar, I think you're almost there! The last step is to prevent url encoding of the token. In my example I put the link directly in an <html> block so this step wasn't necessary. But if you're using the drilldown option from a visualisation, you'll need to make sure Splunk doesn't encode the URL for you. To do that you can use this format: $office_filter_drilldown|n$ Change your drilldown section to resemble something like this: <drilldown> <link target="_blank">antivirus_details?form.compliance_filter=$click.value$&$office_filter_drilldown|n$&form.machine=$machine$&form.origin=$origin$&form.country=$country$&form.cacp=$cacp$&form.scope=$scope$</link> </drilldown> That way Splunk won't try to encode any characters in the token, giving you the correct URL. There are a few different filters available for tokens: Filter Description Wrap value in quotes $token_name|s$ Ensures that quotation marks surround the value referenced by the token. Escapes all quotation characters, ", within the quoted value. HTML format $token_name|h$ Ensures that the token value is valid for HTML formatting. Token values for the <HTML> element use this filter by default. URL format $token_name|u$ Ensures that the token value is valid to use as a URL. Token values for the <link> element use this filter by default. Specify no character escaping $token_name|n$ Prevents the default token filter from running. No characters in the token are escaped. See more info on Splunk docs Give that a go and see how you get on. Cheers, Daniel

danspav · ‎10-25-2023

Doh! that will teach me for not testing. I'm sure that dashboard worked on an earlier version of Splunk, but you're right, it keeps those pesky commas. Here's an updated version with two key changes: I've set up the drilldown token to have a value when the dashboard first loads - in case you click the drilldown link before you've changed the dropdown. The regex is fine - but the token seems to be treated like a multivalue field - so I've simply concatenated an empty string to it: $form.multi$ + "" - this tricks Splunk into treating it like a normal string. <form version="1.1"> <init> <set token="drilldown">form.multi=val1</set> </init> <label>Send Multi Value Token Drilldown</label> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="multi" searchWhenChanged="true"> <label>Multiselect</label> <choice value="val1">key1</choice> <choice value="val2">key2</choice> <choice value="val3">key3</choice> <choice value="val4">key4</choice> <choice value="val5">key5</choice> <default>val1</default> <prefix>(</prefix> <suffix>)</suffix> <initialValue>val1</initialValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="drilldown">replace($form.multi$ + "","([^,]+),?","&form.multi=$1")</eval> </change> </input> </fieldset> <row> <panel> <title>Token Values</title> <html> <h1>Token: $multi$</h1> <h1>Drildown Token: $drilldown$</h1> <a href="send_multi_value_token_drilldown?$drilldown$" target="_BLANK">Drilldown</a> </html> </panel> </row> </form> I think that version should work - tested on a Splunk Cloud instance. Cheers, Daniel

danspav · ‎10-24-2023

Hi @smanojkumar, Here's a sample dashboard that has a multi-select with prefix/suffix values, and a second token that you can append to drill-downs. Save the dashboard as "send_multi_value_token_drilldown" <form version="1.1"> <label>Send Multi Value Token Drilldown</label> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="multi" searchWhenChanged="true"> <label>Multiselect</label> <choice value="val1">key1</choice> <choice value="val2">key2</choice> <choice value="val3">key3</choice> <choice value="val4">key4</choice> <choice value="val5">key5</choice> <default>val1</default> <prefix>(</prefix> <suffix>)</suffix> <initialValue>val1</initialValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="drilldown">replace('form.multi',"([^,]+),?","&form.multi=$1")</eval> </change> </input> </fieldset> <row> <panel> <title>Token Values</title> <html> <h1>Token: $multi$</h1> <h1>Drildown Token: $drilldown$</h1> <a href="send_multi_value_token_drilldown?$drilldown$" target="_BLANK">Drilldown</a> </html> </panel> </row> </form> The trick here is in the <change> event on the multiselect. Each time you change the value of the dropdown, it creates a new token with the $form.multi$ token rather than just using $multi$: <eval token="drilldown">replace('form.multi',"([^,]+),?","&form.multi=$1")</eval> Try changing the values and then click on the "drilldown" link. You will see the same dashboard load in a new window with the same values pre-selected. On your dashboard, just add the $drilldown$ token to your dashboard, and it will propagate the values. Cheers, Daniel

danspav · ‎10-24-2023

Hi @Abass42, You can achieve this using the foreach command. | makeresults | eval _raw="10/24/2023 06:00:04,source=SXXXX-88880000,destination=10.10.100.130,DuBlIn_,11.11.119.111,port_80=True,port_443=True,port_21=False,port_22=True,port_25=False,port_53=False,port_554=False,port_139=False,port_445=False,port_123=False,port_3389=False" | extract ``` Above is to generate the test data ``` ``` Iterate through each port_xxx field to pick out the open ones ``` | foreach port_* [| eval open_ports=if(<<FIELD>>=="True", mvappend(open_ports, "<<MATCHSTR>>"), open_ports)] | mvexpand open_ports | table _time, destination, gpss_src_ip, open_ports We use foreach to pick out all the fields that start with port_ and test to see if they are true. If they are, we add the number part of the field name (<<MATCHSTR>>) to a new multivalue field. Then we continue with your mvexpand and table to show the results. The results look like this: The Splunk Docs page for ForEach explains the use of <<FIELD> and <<MATCHSTR>> Cheers, Daniel

danspav · ‎10-23-2023

Hi @JWai28 , Assuming you have a time dropdown called "global_time" and a drop-down called "dd_span": With values set up like this (note the '+' next to each value): You could try something like this in your search: index=main [| makeresults | eval earliest_epoch=strptime("$global_time.earliest$", "%Y-%m-%dT%H:%M:%S.%3QZ") | eval earliest_relative=relative_time(now(),"$global_time.earliest$") | eval earliest = coalesce(earliest_epoch, earliest_relative) | eval latest=relative_time(earliest, "$dd_span$") | table earliest_epoch, earliest, latest | return earliest, latest] Breaking this down: This converts the global_time.earliest token into an epoch time (The dashboard either supplies a date string, or something like "-15m" - both cases are catered for). Then it creates the latest token based on the earliest time. Finally, it returns those values to the main search - setting the earliest and latest values. It's a bit ugly, but should do the job. Cheers, Daniel

danspav · ‎10-23-2023

Hi @lanning_bradley, If you are able to create a React based dashboard, you can us this https://splunkui.splunk.com/Packages/react-ui/StepBar There's a tutorial to help get you up and running with Splunk UI Toolkit here: https://splunkui.splunk.com/Create/ComponentTutorial Cheers, Daniel

danspav · ‎10-23-2023

Hi @DaveBunn, I wrote the Word Tree Viz and as cool as it is... I don't think it will give you what you need in this case. However, you may be interested in the Treeview Viz. Here's some SPL to create a treeview representation of the hierarchy: |makeresults | eval raw = "Name=\"Dave Bunn \", OrgPosition=\"12345_Dave_Bunn \",Manager=\"1230_Mrs_Bunn\",MiscDetails=\"some text about my job\"@@@ Name=\"Mrs Bunn\",OrgPosition=\"1230_Mrs_Bunn\",Manager=\"10_The_Big_Boss\",MiscDetails=\"some text about Mrs Bunns job\"@@@ Name=\"Big Boss\",OrgPosition=\"10_The_Big_Boss\",Manager=\"0_The_Director\",MiscDetails=\"Manager of HR\"" | makemv raw delim="@@@" | mvexpand raw | rename raw as _raw | fields _raw | extract | fields - _time, _raw ``` Above: Creating the test data ``` | rename OrgPosition as id, Manager as parentid, Name as label ``` This bit is to fix any managers that don't appear in the data - i.e. 0_The_Director``` | appendpipe[|stats count by parentid| eval label=parentid, id=parentid | table label, id] ``` Reverse so the appendpipe appears first for the visualisation``` | reverse | eval iconDoc="user-circle", iconFolderOpen="users" | eval color=if(label="Dave Bunn","#DC4E41",null()) And here's what it looks like: Alternatively, you could use the Network Diagram Viz: SPL looks like this: |makeresults | eval raw = "Name=\"Dave Bunn \", OrgPosition=\"12345_Dave_Bunn \",Manager=\"1230_Mrs_Bunn\",MiscDetails=\"some text about my job\"@@@ Name=\"Mrs Bunn\",OrgPosition=\"1230_Mrs_Bunn\",Manager=\"10_The_Big_Boss\",MiscDetails=\"some text about Mrs Bunns job\"@@@ Name=\"Big Boss\",OrgPosition=\"10_The_Big_Boss\",Manager=\"0_The_Director\",MiscDetails=\"Manager of HR\"" | makemv raw delim="@@@" | mvexpand raw | rename raw as _raw | fields _raw | extract | fields - _time, _raw ``` Above: Creating the test data ``` | appendpipe[| stats count by Manager | eval type="user", nodeText=Manager, from=Manager | table from, nodeText, type] | appendpipe[| stats count by Name, OrgPosition | eval type="user", from=OrgPosition, nodeText=Name | table from, nodeText, type] | appendpipe[| stats count by OrgPosition, Manager | eval from=Manager, to=OrgPosition | table from, to] | eval color=if(nodeText="Dave Bunn","red",null()) | table from, to, nodeText, color, type | search from=* When choosing a hierarchal view, that gives you this: It will look a bit more impressive when there are more people and roles listed. Hopefully those two visualisations give you something to work from. Cheers, Daniel

danspav · ‎10-23-2023

Hi @Thulasiraman , Here's one way to create a table using some of Splunk's built-in JSON commands. |makeresults | eval json="{ \"Group10\": { \"owner\": \"Abishek Kasetty\", \"fail\": 2, \"total\": 12, \"agile_team\": \"Punchout_ReRun\", \"test\": \"\", \"pass\": 6, \"report\": \"\", \"executed_on\": \"Mon Oct 23 03:10:48 EDT 2023\", \"skip\": 0, \"si_no\": \"10\" }, \"Group09\": { \"owner\": \"Lavanya Kavuru\", \"fail\": 45, \"total\": 190, \"agile_team\": \"Hawks_ReRun\", \"test\": \"\", \"pass\": 42, \"report\": \"\", \"executed_on\": \"Sun Oct 22 02:57:43 EDT 2023\", \"skip\": 0, \"si_no\": \"09\" }}" ``` Above is just to create the test data``` | eval keys = json_keys(json) | eval keys = json_array_to_mv(keys) | mvexpand keys | eval group = json_extract(json, keys) | fields - _time, json | spath input=group ``` Table out the fields you're interested in ``` | table agile_team, pass, fail The search is doing the following: Get all the "GroupXX" keys (assuming these change each time you run the search) Convert the Group keys to a multivalue field MVExpand the keys so there's one per event Pull out each Group's values using the key Run spath to convert the JSON to fields Table out what you need The output looks like this: Cheers, Daniel

danspav · ‎08-04-2023

Hi @kevin_larsson, Here's a dashboard you can use to get started: It has 2 dropdowns: Deployment Date - this just works out the past 7 days and lists them in MMM DD format (the token is in unix epoch format) Range - This is a list of +/- day ranges to spread out your search. The token is a number indicating the days to add or subtract from your date. Behind the scenes when you change one of the dropdowns there is an eval token that calculates the relative time difference between your selected time and the +/- range. <change> <eval token="earliest">relative_time($deployment_date$,"-" . $form.range$ . "d")</eval> <eval token="latest">relative_time($deployment_date$,"+" . $form.range$ . "d")</eval> </change> $deployment_date$ is the value for the Date dropdown, and $form.range$ is the value for the +/- dropdown. It would be easy enough to change the range to minutes, days, months etc. Here's the full code for the dashboard: <form version="1.1" theme="light"> <label>My Dashboard</label> <fieldset submitButton="false"> <input type="dropdown" token="deployment_date" searchWhenChanged="true"> <label>Deployment Date</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>starttime</fieldForValue> <search> <query>|gentimes start=-7 | eval label = strftime(starttime,"%b %d") | reverse</query> <earliest>-1m@m</earliest> </search> <change> <eval token="earliest">relative_time($deployment_date$,"-" . $form.range$ . "d")</eval> <eval token="latest">relative_time($deployment_date$,"+" . $form.range$ . "d")</eval> </change> <selectFirstChoice>true</selectFirstChoice> </input> <input type="dropdown" token="range" searchWhenChanged="true"> <label>Range</label> <choice value="1">+/- 1 Day</choice> <choice value="2">+/- 2 Days</choice> <choice value="3">+/- 3 Days</choice> <choice value="4">+/- 4 Days</choice> <choice value="5">+/- 5 Days</choice> <default>1</default> <initialValue>1</initialValue> <change> <eval token="earliest">relative_time($form.deployment_date$,"-" . $form.range$ ."d")</eval> <eval token="latest">relative_time($form.deployment_date$,"+" . $form.range$ ."d")</eval> </change> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults | eval earliest=$earliest|s$, latest=$latest|s$ | eval earliest_readable=strftime(earliest,"%Y-%m-%d"), latest_readable=strftime(latest,"%Y-%m-%d") | table earliest, earliest_readable, latest, latest_readable</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> Cheers, Daniel

danspav · ‎08-03-2023

Hi @isxtn, There's probably going to be a few ways to tackle this - here's one that may work for you: | rex field=_raw "q=(?<q>.+?)(&|\\\u\d)" That breaks down like this: Create a field called "q" that uses up all characters until it sees either: an & or the literal string "\u" followed by a number This should match when things are correctly separated by an ampersand, but also if the ampersand is character encoded. The question mark after the .+ in the regex tells Splunk to not use greedy matching, so it will stop looking at the first "&" or "\u" that it sees. To avoid the "Regex: PCRE does not support \L, \l, \N{name}, \U, or \u" error, I've escaped both the backslash and the u character. Here's a test search to show it in action: | makeresults | eval raw = "apple: honeycrisp ball: baseball car: Ferrari query: param1=val1&param2=val2&param3=val3&q=goodbye+cruel+world\\u0026param=val status: 200@apple: honeycrisp ball: baseball car: Ferrari query: param1=val1&param2=val2&param3=val3&q=goodbye+cruel+world&param=val status: 200" | makemv raw delim="@" | mvexpand raw | rename raw as _raw | rex field=_raw "q=(?<q>.+?)(&|\\\u\d)" | table _raw, q That results in: Cheers, Daniel

danspav · ‎08-03-2023

Hi @rjdefrancisco, If you are using the chart in a dashboard, you could create a new search that calculates the timespan and saves the value to a token. Then you can use the token in your main search: <dashboard version="1.1" theme="light"> <label>My Dashboard</label> <search> <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query> <done> <set token="timespan">$result.timespan$</set> </done> </search> .... </dashboard> Then you can update your main search to use the token: ... | chart sparkline(count,$timespan$) as Sparkline, count by src_ip ... Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block: <init> <set token="timespan">60m</set> </init> Cheers, Daniel

Posts	84
Solutions	26
Karma Given	6
Karma Received	46
Member Since	‎04-07-2019

Online Status	Online
Date Last Visited	3 hours ago

Re: Summary of Indexes and SourceTypes

Re: Dashboard time

Re: addtotals result move to the top row

Re: How to change background colour on click tab a...

Re: Can't understand how fieldSet SubmitButton wor...

Re: Using field names as variable in column name

Re: Link list triggers "change" on page load

Re: Link list triggers "change" on page load

Re: Using field names as variable in column name

Re: How to configure to mask the sensitive field d...

Re: Total spend per field per month

Re: Dashboard Studio how to use a token to set a s...

Re: How to color a table column based on values se...

Re: How to create a dynamic dropdown in Dashboard ...

Re: Passing token value to another dashboard

Re: Passing token value to another dashboard

Re: Passing token value to another dashboard

Re: Multiple Values for open ports, trying to tabl...

Re: how to use add time to token in dashboard stud...

Re: Is there a StepControlWizard replacement?

Re: Hierarchy of organisation

Re: Convert json array to table

Re: How to combine Absolute and Relative time Modi...

Re: Regex search: How to make sure the next charac...

Re: How to adjust dynamic timespan in sparklines?