Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nagarajsf
nagarajsf
Explorer
Member since:
10-28-2019
07-27-2020
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-28-2019 |
Activity Feed
- Tagged Getting error when trying to send cloud watch alerts using lambda function in AWS. on Splunk Dev. 07-26-2020 10:51 AM
- Posted Getting error when trying to send cloud watch alerts using lambda function in AWS. on Splunk Dev. 07-23-2020 04:34 PM
- Karma Re: Multivalve drilldown and dropdown is not working in query results for renjith_nair. 06-05-2020 12:50 AM
- Karma How to change the width of panels in xml? for auaave. 06-05-2020 12:49 AM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-20-2019 08:15 PM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-18-2019 04:52 PM
- Posted Re: rename the search results for multiple conditions on Splunk Search. 11-15-2019 01:08 PM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-15-2019 11:05 AM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-14-2019 01:37 PM
- Posted Re: Multivalve drilldown and dropdown is not working in query results on Dashboards & Visualizations. 11-13-2019 08:21 PM
- Posted Re: rename the search results for multiple conditions on Splunk Search. 11-08-2019 10:59 AM
- Posted rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Tagged rename the search results for multiple conditions on Splunk Search. 11-07-2019 09:58 PM
- Posted cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
- Tagged cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
- Tagged cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
- Tagged cascade token is not resolving in query with multiple dropdown on Dashboards & Visualizations. 11-07-2019 09:44 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-23-2020
04:34 PM
Hi, I'm trying send cloud watch alerts to Splunk using lambda and I created lambda function using blueprint "splunk-cloudwatch-logs-processor" in AWS but function throwing me an error: START RequestId: 61c99093-e39e-4e86-90b3-1b97415aaa2c Version: $LATEST
2020-07-23T23:29:33.236Z 61c99093-e39e-4e86-90b3-1b97415aaa2c INFO Received event: {
"key1": "value1",
"key2": "value2",
"key3": "value3"
}
2020-07-23T23:29:33.236Z 61c99093-e39e-4e86-90b3-1b97415aaa2c ERROR Invoke Error {"errorType":"TypeError","errorMessage":"Cannot read property 'data' of undefined","stack":["TypeError: Cannot read property 'data' of undefined"," at Runtime.exports.handler (/var/task/index.js:31:47)"," at Runtime.handleOnce (/var/runtime/Runtime.js:66:25)"]}
END RequestId: 61c99093-e39e-4e86-90b3-1b97415aaa2c
REPORT RequestId: 61c99093-e39e-4e86-90b3-1b97415aaa2c Duration: 4.30 ms Billed Duration: 100 ms Memory Size: 512 MB Max Memory Used: 66 MB Any suggestions? Thanks.
... View more
Labels
11-20-2019
08:15 PM
Hi @renjith.nair ,
In same XML code, this time I do see that token is resolving in search but it's not showing any data in graph or
table of the dashboard, if the same query I run in the search its throwing result.
Any suggestions?
... View more
11-18-2019
04:52 PM
Thank you, it's working now as I expected.
... View more
11-15-2019
01:08 PM
Yes, I ran query without or with stats count , in both cases, it is giving value of which match provided in the case.
For instance if I gave match(MANAGER_NAME,"^prdplhdpx*"),"Prd" in a first place of case then giving matched value of it and its not considering other match options, match(AMONAME,"^qatehdp*"),"Dev",match(AMONAME,"^devehdp*"),"QAT") .
basically MANAGER_NAME1 value is populating first match of case and it's ignoring other options
... View more
11-15-2019
11:05 AM
Same XML I'm using which mentioned in query. when I swapping between different environments and platforms, the dashboard is not working.
and I attached screenshots of activity which I performing on dashboard and it's not working.
... View more
11-14-2019
01:37 PM
Hi @renjith.nair,
I have tried with different name but still the same issue. Replaced tokEnvironment with tokEnvironment1 .
... View more
11-13-2019
08:21 PM
Hello @renjith.nair ,
when this token is resolving for the first time creation of dashboard, but it's acting strange if I refresh or some login dashboard, and they check, then it's not resolving as expected.
when I checked in query of the chart, I'm getting query with unsalved token
$tokPlatform$ MANAGER_NAME=prdehdp*
OR MANAGER_NAME=prdplhdpx* OR
MANAGER_NAME=prdasdp | eval
compound_exp=AMONAME + "#" +
NETWORKELEMENTCODE|timechart span=5m
count(compound_exp) BY SEVERITY
... View more
11-08-2019
10:59 AM
Hello @FrankVl ,
Added example values above query.
I trying as you suggested but it giving me only first value Prd , but I need all matching values to Prod, Dev, QAT
index=alarms sourcetype=ommc_alarms APPLICATION=spk OR APPLICATION=*spk3* | eval MANAGER_NAME1=case(match(MANAGER_NAME,"^prdplhdpx*"),"Prd",match(AMONAME,"^qatehdp*"),"Dev",match(AMONAME,"^devehdp*"),"QAT")
| stats count by MANAGER_NAME1
I want to create a dropdown dashboard based on selection of the environment.
... View more
11-07-2019
09:58 PM
Hello, I'm trying to rename query output and those are string values.
expecting output for field MANAGER_NAME would be like below,
XZ* = PRD
X* = PRD
XY = PRD
YL = DEV
ZN = QAT
tried with below query but it's not working any suggestions?
index=alarms sourcetype=ommc_alarms APPLICATION=spk OR APPLICATION=*spk3* | eval MANAGER_NAME1=case(MANAGER_NAME==XZ* OR MANAGER_NAME==X* OR MANAGER_NAME==XY,"Prd") | eval MANAGER_NAME2=case(AMONAME=="YL*",Dev,AMONAME=="ZN*",QAT)
| stats count by MANAGER_NAME1 ,MANAGER_NAME2
... View more
11-07-2019
09:44 PM
I have a dashboard with a dropdown that contains a list of values. The value of the choices must match to another dropdown list and get the respective results in dashboard but we tokens are not resolving in query when I checked in dashboard.
<form>
<label>Da1</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="field1">
<label>Select Window</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="tokPlatform" searchWhenChanged="true">
<label>Select Platform</label>
<default>On-prem</default>
<choice value="APPLICATION=Hadoop OR APPLICATION=*Unix*">On-prem</choice>
<choice value="MANAGER_NAME=*.corporate.com OR NETWORKELEMENTCODE= PRD.* ">Cloud-AWS</choice>
<choice value="Null">Cloud-Azure</choice>
</input>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Select Environment</label>
<default>Prod</default>
<choice value="$tokPlatform$ MANAGER_NAME=prdehdp* OR MANAGER_NAME=prdplhdpx* OR MANAGER_NAME=prdasdp">Prod</choice>
<choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=dev*">Dev</choice>
<choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=QAT*">QAT</choice>
</input>
</fieldset>
<panel id="ticketStatusPanel">
<title>HDP INFRA ALERTS CHART</title>
<chart>
<title>ALERTS SEVERITY</title>
<search>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE|timechart span=5m count(compound_exp) BY SEVERITY </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"CRITICAL":0xFF0000,"MINOR":0xFF8000, "MAJOR":0xFF8000}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
<set token="clicked_group">$click.name2$</set>
</drilldown>
</chart>
</panel>
<panel id="countTicketPanel">
<title>TICKET STATUS CHART</title>
<chart>
<title>Ticket status</title>
<search>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE |timechart span=4m count(compound_exp) BY TICKET_STATUS</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="trellis.size">large</option>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
<set token="clicked_group">$click.name2$</set>
</drilldown>
</chart>
</panel>
</row>
<row id="row2">
<panel id="t2">
<title>Important alerts by severity ($resultcount$)</title>
<table id="table2">
<search>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE | rename TTID as Ticket | table Ticket,MANAGER_NAME,SEVERITY,DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE | dedup Ticket | sort - SEVERITY desc</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<done>
<eval token="resultcount">$job.resultCount$</eval>
</done>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<format type="color" field="SEVERITY">
<colorPalette type="map">{"CRITICAL":#DC4E41,"MINOR":#F8BE34,"MAJOR":0xFF8000}</colorPalette>
</format>
</table>
</panel>
<panel id="t1">
<title>OPEN TICKET STATUS ($resultcount1$)</title>
<table id="table1">
<search>
<done>
<eval token="resultcount1">$job.resultCount$</eval>
</done>
<query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | rename TTID as Ticket | eval ot = strptime(CREATED_DATE, "%Y-%m-%d %H:%M:%S")
| eval ud = strptime(UPDATE_DATE, "%Y-%m-%d %H:%M:%S")
| eval nowstring=strftime(now(), "%Y-%m-%d %H:%M:%S")
| eval open_status(hr)=tostring((now() - ot), "duration" ) | eval lastactionON(hr)=tostring((now() - ud), "duration" )
| table Ticket,TICKET_STATUS,UPDATE_DATE, open_status(hr), lastactionON(hr) | where TICKET_STATUS!= "Resolved" | dedup Ticket</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="TICKET_STATUS">
<colorPalette type="map">{"Assigned":#DC4E41,"Working":#F8BE34 }</colorPalette>
</format>
</table>
</panel>
</row>
... View more
11-07-2019
07:05 PM
Hello @Ayn ,
it could be work for numbers only or will work for sting value with some wild entry like below,
MANAGER contains with prefixed value prd so that I'm expecting eval like
eval name=case(MANAGER==prdehdp* OR prdplhdpx* OR *prdasdp*,"prd") |
eval name1=case(X==dev* ,"dev") |
eval name2=case(Y==QAT*,"QAT") | stats count by name,name1,name2
Thanks
... View more
11-07-2019
12:50 PM
Hi @adonio
How can we pass query to drop-down list, instead getting information based on content could define some values for fixed objects like A,B, C and backend we need to target some queries.
I posted some question similar to this,
fyi :https://answers.splunk.com/answers/780873/multivalve-drilldown-and-dropdown-is-not-working-i.html
link text
... View more
11-06-2019
07:10 PM
Hi @d12harshal ,
I'm also facing the same issue, for multi dropdown dashboard token is not working in query search.
https://answers.splunk.com/answers/780873/multivalve-drilldown-and-dropdown-is-not-working-i.html
... View more
11-06-2019
06:29 PM
And also in given XML file, the token $tokEnvironment$ is not resolving when check-in dashboard query lookup.
... View more
11-06-2019
06:00 PM
Hi @niketnilay
I'm stucked at same kind of scenario, how we can pass input/value to system variables (Dev1,Dev2,Dev3, Test1,Test2,Test3 ,Prod1,Prod2,Prod3) .
I have posted question, and it somehow related to it, could you please assist here?
https://answers.splunk.com/answers/780873/multivalve-drilldown-and-dropdown-is-not-working-i.html
link text
... View more
11-06-2019
10:01 AM
Hi @renjith.nair,
let say if I select On-prem in first dropdown, then in second dropdown, I could see any of the Prd, Dev, QAT .
base search starting with index=alarms sourcetype=ommc_alarms APPLICATION=Hadoop OR APPLICATION=*Unix* and I passing it as token $tokPlatform$ in all other places in XML.
$tokPlatform$ -- > index=alarms sourcetype=ommc_alarms APPLICATION=Hadoop OR APPLICATION=*Unix*
$tokEnvironment$ --> $tokPlatform$ MANAGER_NAME=prdehdp* OR MANAGER_NAME=prdplhdpx* OR MANAGER_NAME=prdasdp
... View more
11-05-2019
04:17 PM
alt text
Hello, I'm trying to two drill-down options for my dashboard and in that one to select the platform and the other one is for the environment.
Let say I have platform A and B and in both of them have environment C, D, and E.
I have written as below but output in dashboard is NULL or no data found.
FYI: For a single option it is working fine and I able to see dashboard with values.
</form>
<panel id="dropdown">
<title>Welcome, $username$!</title>
<input type="dropdown" token="tokPlatform" searchWhenChanged="true">
<label>Select Platform</label>
<default>On-prem</default>
<choice value="index=alarms sourcetype=ommc_alarms APPLICATION=Hadoop OR APPLICATION=*Unix*">On-prem</choice>
<choice value="index=alarms sourcetype=ommc_alarms MANAGER_NAME=*.corporate">Cloud-AWS</choice>
<choice value="Null">Cloud-Azure</choice>
</input>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Select Environment</label>
<default>Prod</default>
<choice value="$tokPlatform$ MANAGER_NAME=prdehdp* OR MANAGER_NAME=prdplhdpx* OR MANAGER_NAME=prdasdp">Prod</choice>
<choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=dev*">Dev</choice>
<choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=QAT*">QAT</choice>
</input>
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<html>
</html>
</panel>
</row>
<row id="row1">
<panel depends="$alwaysHideCSS$">
<html>
<style>
#countTicketPanel{
width:25% !important;
}
#ticketStatusPanel{
width:75% !important;
}
#row1{
border-radius: 6px;
font-family:"Roboto","Droid","Helvetica Neue",Helvetica,Arial,sans-serif;
text-decoration: none;
margin:auto;
background-color: #ea0a8e;
color: #ea0a8e;
padding: 1px 1px 1px 1px;
border-top: 1px solid #CCCCCC;
border-right: 1px solid #333333;
border-bottom: 1px solid #333333;
border-left: 1px solid #CCCCCC;
position:auto;
}
#row2{
border-radius: 6px;
font-family:"Roboto","Droid","Helvetica Neue",Helvetica,Arial,sans-serif;
text-decoration: none;
margin:auto;
background-color: #ea0a8e;
color: #ea0a8e;
padding: 1px 1px 1px 1px;
border-top: 1px solid #CCCCCC;
border-right: 1px solid #333333;
border-bottom: 1px solid #333333;
border-left: 1px solid #CCCCCC;
position:auto;
}
#dropdown{
border-radius: 6px;
font-size: 12px;
font-family:"Roboto","Droid","Helvetica Neue",Helvetica,Arial,sans-serif;
text-decoration: none;
background-color: #ea0a8e;
color: #ea0a8e;
padding: 6px 8px 6px 8px;
border-top: 1px solid #CCCCCC;
border-right: 1px solid #333333;
border-bottom: 1px solid #333333;
border-left: 1px solid #CCCCCC;
margin:auto;
position:auto;
width:800px;
top:0px;
bottom:0px;
margin-left:-400px;
}
#table1 .splunk-table .splunk-paginator{
position: absolute !important;
top: -2px !important;
padding-left: 45% !important;
#table2 .splunk-table .splunk-paginator{
position: absolute !important;
top: -2px !important;
padding-left: 45% !important;
</style>
</html>
</panel>
<panel id="ticketStatusPanel">
<title>HDP INFRA ALERTS CHART</title>
<chart>
<title>ALERTS SEVERITY</title>
<search>
<query> $tokEnvironment$ | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE|timechart span=5m count(compound_exp) BY SEVERITY </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"CRITICAL":0xFF0000,"MINOR":0xFF8000, "MAJOR":0xFF8000}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
<set token="clicked_group">$click.name2$</set>
</drilldown>
</chart>
</panel>
<panel id="countTicketPanel">
<title>TICKET STATUS CHART</title>
<chart>
<title>Ticket status</title>
<search>
<query> $tokEnvironment$ | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE |timechart span=4m count(compound_exp) BY TICKET_STATUS</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"Assigned":0xF17BF1,"Working":0xFF8000,"Resolved":0xB3E680}</option>
<option name="charting.legend.placement">bottom</option>
<option name="refresh.display">preview</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<drilldown>
<set token="clicked_earliest">$earliest$</set>
<set token="clicked_latest">$latest$</set>
<set token="clicked_group">$click.name2$</set>
</drilldown>
</chart>
</panel>
</row>
<row id="row2">
<panel depends="$alwaysHideCSS$">
<html>
<style>
#t1{
width:40% !important;
}
#t2{
width:60% !important;
}
</style>
</html>
</panel>
<panel id="t2">
<title>Important alerts by severity ($resultcount$)</title>
<table id="table2">
<search>
<query>$tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE | rename TTID as Ticket | table Ticket,MANAGER_NAME,SEVERITY,DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE | dedup Ticket | sort - SEVERITY desc</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<done>
<eval token="resultcount">$job.resultCount$</eval>
</done>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<format type="color" field="SEVERITY">
<colorPalette type="map">{"CRITICAL":#DC4E41,"MINOR":#F8BE34,"MAJOR":0xFF8000}</colorPalette>
</format>
</table>
</panel>
<panel id="t1">
<title>OPEN TICKET STATUS ($resultcount1$)</title>
<table id="table1">
<search>
<done>
<eval token="resultcount1">$job.resultCount$</eval>
</done>
<query> $tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | rename TTID as Ticket | eval ot = strptime(CREATED_DATE, "%Y-%m-%d %H:%M:%S")
| eval ud = strptime(UPDATE_DATE, "%Y-%m-%d %H:%M:%S")
| eval nowstring=strftime(now(), "%Y-%m-%d %H:%M:%S")
| eval open_status(hr)=tostring((now() - ot), "duration" ) | eval lastactionON(hr)=tostring((now() - ud), "duration" )
| table Ticket,TICKET_STATUS,UPDATE_DATE, open_status(hr), lastactionON(hr) | where TICKET_STATUS!= "Resolved" | dedup Ticket</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="TICKET_STATUS">
<colorPalette type="map">{"Assigned":#DC4E41,"Working":#F8BE34 }</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel>
<single>
<title>Ticket Solved</title>
<search>
<query> $tokEnvironment$ AND TICKET_STATUS!="Closed" AND TICKET_STATUS!= "Resolved" | dedup TTID | table TICKET_STATUS | where TICKET_STATUS = "Resolved" | stats count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="rangeColors">["0x53a051","0xdc4e41"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
</form>![alt text][1]
... View more
10-28-2019
04:22 PM
Hi,
I'm in the same scenario, but trying to get the difference from CREATED_DATE and current timestamp . For that, it is not working.
base_search
| eval it = strptime(CREATED_DATE, "%Y-%m-%d %H:%M:%S")
| eval nowstring=strptime(now(), "%Y-%m-%d %H:%M:%S")
| eval ticket_duration=tostring((now() - it), "duration" )
| table DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE, ticket_duration
base_search
| convert timeformat='%Y-%m-%dT%H:%M:%S' mktime(CREATED_DATE) mktime(now() AS _now)
| eval duration=(_now-CREATED_DATE)/86400
|table TTID,MANAGER_NAME,SEVERITY,DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE, duration
In both ways I'm getting null value, ticket_duration=null
Can you please suggest any?
Thanks,
... View more
10-28-2019
02:03 PM
Hi,
when I trying to insert CSS panel it throwing below error,
Warning on line 3: Node is not allowed here
and here is the panel
test
<html>
<style>
#ticketStatusPanel{
width:25% !important;
}
#countTicketPanel{
width:75% !important;
}
</style>
</html>
... View more
10-28-2019
01:34 PM
Hi,
I'm trying to achieve same functionality but it throwing some exception like below,
Warning on line 3: Node is not allowed here
and here is the panel
`
test
<html>
<style>
#ticketStatusPanel{
width:25% !important;
}
#countTicketPanel{
width:75% !important;
}
</style>
</html>
`
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-27-2020
06:06 PM
|
