About myoung54

myoung54 · ‎01-13-2020

Of course... Right when I ask the question I figure out the answer. For anyone else who runs into this, I used the below link to find my solution: https://answers.splunk.com/answers/751141/combine-add-rows-in-the-search-results-using-a-wid.html The line I added to my query was: | eval Total=case(like(lower(sentiment),"frown"),"Bad", like(lower(sentiment),"no"),"Bad", like(lower(sentiment),"smile"),"Good", like(lower(sentiment),"yes"),"Good", like(lower(sentiment),"meh"),"Meh"),1=1,Total) | stats count by Total

myoung54 · ‎01-13-2020

Hello all, I feel kind of dumb even asking this question, but I've been up and down these forums looking for an answer and I just can't seem to figure this out. I have a stats count query that it showing results, and I'm trying to combine two of the results. So in the picture above you can see "frown" has a count value, but in my case "no" is the same thing as "frown" and "smile" is also the same thing as "yes" so I'm trying to combine those values so the results look like this: Sentiment Count Bad 497 Good 7 Meh 26 I know I'll probably have to do some eval statement to combine the two but I just can't seem to figure it out! Any help would be very appreciated!

myoung54 · ‎01-09-2020

Hey all, So I'm kind of scratching my head on this, and any kind of guidance would be extremely helpful! Alright, so I have a dashboard with a stoplight visualization that looks at volume of a particular thing. Volume high=Good, Volume low=Outage, and anything in-between = Degraded. I have it working perfectly fine now, but my company is 24/7 and volume is not at the same levels at night as it is during the day, so what's happening is that at night volume drops and the dashboard shows "outage" but there really isn't an outage, volume is simply lower because it's night time. Is there anyway I can add something to the query to factor in the time of day? Or should I be going about this a completely different way? index=aries* sourcetype=aries-main RealtimeAccessLobby host=dtlprdart* OR host="aglprdart*" md=10 ty=* | eval error=coalesce(ei, ec, stccode, aaacode, " Success") | eval er=case(et="HIPAA", ".Reject", error!=" Success", "Fail") | eval Status=coalesce(er, error) | eval cnt=1 | table _time, Status, cnt | append [search index=oracle | eval Status=".Reject" | eval cnt=0 | head 1 | table _time, Status, cnt] | timechart span=1m sum(cnt) by Status | addtotals labelfield=Total | eval TotalRate=(Total/100) | fillnull TotalRate value=0 | eval Warning=case(TotalRate<10,"Outage", TotalRate>10 AND TotalRate<27,"Degraded", TotalRate>27,"Good") | eval Status= case(TotalRate<10,"times-circle", TotalRate>10 AND TotalRate<27,"exclamation-triangle", TotalRate>27,"check-circle") | eval color=case(TotalRate<10,"#FF0000", TotalRate>10 AND TotalRate<27,"#ffff00", TotalRate>27,"#65a637")

myoung54 · ‎12-09-2019

Wow, this was incredibly helpful! Thank you so much!!

myoung54 · ‎12-06-2019

Hey all, So I have a dashboard I created with the status of multiple different processes. Each panel shows a check-circle and then changes color based on the status (Good=Green, Degraded=Yellow, Outage=Red). Everything is working well, but the next thing I would like to add is a panel at the top of the page (that is also centered in the middle of the screen) that shows the overall status of all the panels. So for an example, if I have 5 panels, and 4 of them are showing "Outage", then at the top of the page you would see something like "Status" and it would be the color red. Or if I have 5 panels and 5 of them were showing "Good", then at the top of the page you would see "Status" but it would be the color green. Is something like this possible? <form> <label>At-a-Glance/SPOG Dashboard Test</label> <fieldset submitButton="false"> <input type="time" token="time"> <label></label> <default> <earliest>-1m@m</earliest> <latest>@m</latest> </default> </input> <input type="dropdown" token="span" searchWhenChanged="true"> <label>Span</label> <choice value="1s">1s</choice> <choice value="5s">5s</choice> <choice value="10s">10s</choice> <choice value="15s">15s</choice> <choice value="1m">1m</choice> <choice value="5m">5m</choice> <choice value="10m">10m</choice> <choice value="15m">15m</choice> <default>1m</default> <initialValue>1m</initialValue> </input> </fieldset> <row> <panel id="mode10aag"> <title>Mode 10</title> <html depends="$alwaysHideCSS$"> <style> #mode10aag{ width:230px !important; } </style> </html> <viz type="status_indicator_app.status_indicator"> <search> <query> | eval Warning=case(TotalRate<10,"Outage", TotalRate>10 AND TotalRate<27,"Degraded", TotalRate>27,"Good") | eval Status= case(TotalRate<10,"check-circle", TotalRate>10 AND TotalRate<27,"check-circle", TotalRate>27,"check-circle") | eval color=case(TotalRate<10,"#FF0000", TotalRate>10 AND TotalRate<27,"#ffff00", TotalRate>27,"#65a637") | table icon Status color Warning TotalRate _time</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="height">119</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">text</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">2</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> <panel id="logintimesaag"> <title>Login Times</title> <html depends="$alwaysHideCSS$"> <style> #logintimesaag{ width:230px !important; } </style> </html> <viz type="status_indicator_app.status_indicator"> <search> <query> | eval Warning=case(TotalRate>5,"Outage", TotalRate>1 AND TotalRate<5,"Degraded", TotalRate<1,"Good") | eval Status= case(TotalRate>5,"check-circle", TotalRate>1 AND TotalRate<5,"check-circle", TotalRate<1,"check-circle") | eval color=case(TotalRate>5,"#FF0000", TotalRate>1 AND TotalRate<5,"#ffff00", TotalRate<1,"#65a637") | table icon Status color Warning TotalRate _time</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="height">119</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">text</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">2</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </form>

myoung54 · ‎11-07-2019

This is exactly what I was looking for, thank you!!

myoung54 · ‎11-06-2019

Hello all, I searched around for quite a while and I couldn't find an answer to this, so I figured I'd just ask. My organization has dozens upon dozens of lookup tables, and I was wondering if there was a way to see what specific lookup tables a given dashboard is using? Being that my organization has so many lookup tables, it can be hard to know which one needs editing because you can't tell what's in use and what's a duplicate.

Posts	7
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎10-18-2019

Online Status	Offline
Date Last Visited	‎08-05-2020 02:20 PM

Combine stats count results

Visualization that takes into account time of day

Show status for multiple panels

Lookup table question

Re: Combine stats count results

Combine stats count results

Visualization that takes into account time of day

Re: Show status for multiple panels

Show status for multiple panels

Re: Lookup table question

Lookup table question