About bhavlik

bhavlik · ‎08-18-2023

Thank you! I was able to work this out and have gotten the results I was looking for. I did change up the order of my search per your suggestion and thank you for explaining the why. I've been working with Splunk for about 3 years now but I'm mostly self taught so additional info is always welcome. I was eager to try your different way of writing this search but I've stayed with using the selfjoin to join the two sources. The line |stats values(*) as * by propertyId wouldn't maintain a direct relationship with the TotalEventTypes and eventDate which is crucial to this dashboard. Also when I ran the line |eval {eventDate}=coalesce(TotalEventTypes,0), it left all the dates as one column when I want to display each date as it's own separate column so we can see very specific dates when the data isn't being returned. The addtotals was the perfect solution! However I couldn't use 0 as a criteria because a site could be sending data for the first 6 days and then stop on the 7th (which is what we are trying to catch). However the index was built using another event we have that reports back from the site how many individual events we should have for each event type even if that count is 0 so I know I should expect a minimum of 21 of those every day so instead I used Total<147. Thank you again for your help. Once again Splunk community has been a life saver! P.S. I noticed you used "fields" in the places where I used "table". Is there a general rule I should consider when deciding which to use? Is there a benefit to using fields over table?

bhavlik · ‎08-16-2023

I am working on creating a monitoring dashboard that will alert us when one of our customers databases stop sending event data that we need for reporting. However, I am struggling to filter my results down to those customers that are not sending data. Here's my search: | inputlookup HealthcareMasterList.csv | search ITV=1 AND ITV_INSTALLED>1 AND MarinaVersion IN (15*,16*,17*,18*) | table propertyId FullHospitalName MarinaVersion | append [ search index=hceventmonitoring [| inputlookup HealthcareMasterList.csv | search ITV=1 AND ITV_INSTALLED>1 AND MarinaVersion IN (15*,16*,17*,18*) | table propertyId | format] | dedup _raw | stats dc(monitorEventName) as TotalEventTypes by eventDate propertyId | eval {eventDate}=TotalEventTypes | fields - eventDate TotalEventTypes | stats values(*) as * by propertyId] | selfjoin keepsingle=t max=0 propertyId The first part of the search is establishing a list of which customers I should be receiving event data from so they show up on the results even if there is no event data in Splunk. The second part is determining how my distinct event types a customer is sending each day. Below is a screenshot of a portion of my results: What I need to have happen next is to filter down to any rows with NULL in any of the displayed dates. I tried to use | where isnull(2023*) but then found out you can't have wildcards in field names. If I filter down to the nulls before doing |eval {date}=TotalEventTypes then I don't have any dates to work with as that field is blank for those rows (since they aren't sending event data, I don't have any dates from the event data to display). I've seen other posts that suggest using foreach but I struggle to see how I could use that here since my field names are changing each day and I need the actual date to display as the field name when I view this in the dashboard. If I filter out the nulls first is there a way to dynamically create a field with the dates of the last 7 days and then I can add the |eval {date}=TotalEventTypes and then have those dates as field names? Any thoughts or suggestions are highly appreciated! I've been racking my brain for almost two days trying to figure this out. LOL.

bhavlik · ‎12-22-2022

I did not. I ended up adding a separate panel at the top of the dashboard to display the dates for the report. In my opinion it adds in a lot of white space in the PDF that isn't the most eye pleasing but it gets the job done.

bhavlik · ‎12-07-2020

Thank you! This looks great!

bhavlik · ‎12-02-2020

I have created a dashboard that is monitoring the number of events received at corporate to the number of events reported on a client's database. This way we can be alerted when we have not received all events and can log into the client's database and manually pull that file. Here's a partial screenshot of the current dashboard: Here is the search that produces the above dashboard: | makeresults | fields - _time | eval eventName="CustCkIn,CustCkOut,EduAssigned,EduView,FTGChannelOff,NavHdiInteractive,PatientInfo,SncChromecastState,StayIdCrossReference,SurveyResponse,SysConfigRoomInfo," | makemv delim="," eventName | mvexpand eventName | append [| inputlookup EventValidationMonitoring.csv | addinfo | eval _time=strptime(date,"%Y-%m-%d") | where _time>=info_min_time AND _time<relative_time('info_min_time',"+604800") AND propertyId=0123456 | eval ValidationData=mvappend("nVerify=".nVerifyEvents,"nProperty=".nPropertyEvents,"nReceived=".nReceivedEvents,"Missing=".Missing) | table date eventName ValidationData | eval {date}=ValidationData | fields - date ValidationData ] | stats values(*) as * by eventName | fillnull value="Missing=Undetermined, nProperty=NA, nReceived=0, nVerify=0" Is there a way I can format the fillnull string so that it has the same format as the other cells?

bhavlik · ‎11-23-2020

Thank you!

bhavlik · ‎11-19-2020

I have a time picker in one of my dashboards and want the time picker to only display "Date Range". I have been successful in writing HTML code to remove all the other ones but cannot figure out how to get "Date & Time Range" to be removed as well. Here is the code I have currently: <html> <style> div[data-test-panel-id="presets"] { display: none; } div[data-test-panel-id="relative"] { display: none; } div[data-test-panel-id="dateandtimerange"] { display: none; } div[data-test-panel-id="realTime"] { display: none; } div[data-test-panel-id="advanced"] { display: none; } </style> </html> I am assuming my name for "Date & Time Range" is incorrect but no clue as to how it should be written. Does anyone know what the panel id for that is?

bhavlik · ‎11-03-2020

Sorry for the delay in response, I had to focus on another project for a couple days. LOL. But I did incorporate part a) and I really like the way the output looks. This will allow me to display a larger time range. I haven't had time to go through your suggestion in part b) but have saved in for future exploration.

bhavlik · ‎10-29-2020

Wow! That was so much easier than I thought! Thanks kind stranger.

bhavlik · ‎10-28-2020

I have a table within a dashboard that is displaying information comparing event counts from a customer site to the event counts back here at corporate. The goal is to easily identify if corporate is missing any event data from the customer site. Here is a screenshot of the table: I want to highlight any cells where "Missing=Yes" so it visually pops out to anyone viewing the dashboard. I found this post How-do-you-change-the-cell-color-based-on-partial-value but that solution is for columns whose name remain the same. In my table, the column names will change each day as the column names are the dates being displayed. Is there a way to color a cell based on a condition when the column names are dynamic? I also want to offer up that I am a beginner in Splunk and have no experience with using JavaScript or anything else besides Simple XML. Thanks in advance for any suggestions.

bhavlik · ‎10-28-2020

I ended up using an eval statement to combine the columns that would be under each date into a single column and then using other commands to get only one row each of the Event Names. Here's the part of my query that I used to change the table to my desired look: | eval ValidationData="nVerify="+nVerifyEvents+", "+"nProperty="+nPropertyEvents+", "+"nReceived="+nReceivedEvents+", "+"Missing="+Missing | table date eventName ValidationData | eval {date}=ValidationData | fields - date ValidationData | stats values(*) as * by eventName | fillnull value="Events Not Received" Here's a screenshot of the final result: Not sure if this is the best way to do this but it works.

bhavlik · ‎10-26-2020

I am trying to create a "monitoring" dashboard that compares the data count in a clients database to the count in our corporate database. For each Event Name (sourcetype) I have the following metrics: nVerifyEvents, nPropertyEvents, nReceivedEvents. I want to display all 3 metrics per Event Name per date for the last 7 days. Here is a screenshot of what I have so far. Is there anyway to create a chart so it displays like this: If this isn't possible, do any of you have some suggestions on a way to display this information on a dashboard? Should I do each date as a separate chart and put them on the same row in the dashboard? In my opinion it would be overkill to have the Event Name listed for each date but if that's the only way to go then it will have to work. I will also need to set up notifications if nReceivedEvents < nPropertyEvents so that we can address any missing data right away. Thanks for any help or suggestions you send my way.

bhavlik · ‎06-15-2020

Background: I'm trying to create a monthly report that tracks how many terminals we Add and how many terminals we Remove at a property. We have two separate events that track these: RoomTerminalAdd and RoomTerminalRemove. Sometimes we have field reps that need to troubleshoot these terminals and end up with multiples of these events that don't actually indicate a full Add or Remove. I would like to "pair up" these events and evaluate the time differences based on the property, room number, and terminal address. If the time difference is below 15 minutes then I want to removed them from the final monthly count. Here's a visual to help explain what I'm trying to do: After removing these "pairs" that fit the <15 min time difference, I want to then get a total count of each event type separately. TerminalsAdded=## TerminalsRemoved=## I have used the command transaction in the past but won't work here as it removes any events that don't have a pair and I need to keep those for my overall count. My next option would be streamstats but I don't have any experience with using that command and not sure how to bring in the time difference for evaluating what to keep and what to remove from search. Anyone out there have any advice or tips on how to reach my end goal?

bhavlik · ‎02-21-2020

Here's what I use for the html text panel </row> <panel> <title>Total Successful Meal Orders - Customer Name</title> <html> <b>Service Not Activated at Site(s)</b><br/> </html> </panel> </row>

bhavlik · ‎02-21-2020

Here's my work around in case others are trying to do something similar. I added a html text panel below each of my "service" search panels and currently have them hidden. Once I clone my template to adjust information to the next customer, if they don't have a particular service, I will un-hide the html text panel and hide the corresponding search panel. Its still some manual work but having the text panel hidden in the template allows me to quickly switch which panel will be shown in the dashboard and scheduled pdf.

bhavlik · ‎02-21-2020

That doesn't display a custom text for me. All it does is add a 7th month onto the x-axis and rename the label on top as "count". I would add a pic but doesn't give me the option here in comments.

bhavlik · ‎02-21-2020

@niketnilay I have several timecharts in this dashboard. Around 10 different timecharts to create 15+ panels. What I have been doing up to this point is adding a Title to the panel with "Service Not Active at Site" and leaving the No Results found. Since I will be cloning this dashboard to many, many other customers, I was looking for an automated way so I didn't have to go in an manually adjust certain panels for each customer.

bhavlik · ‎02-21-2020

Unfortunately I cannot use any tokens as this dashboard will be a scheduled pdf. From everything I've been able to find, tokens do not display on a scheduled pdf.

bhavlik · ‎02-20-2020

I have created a template dashboard that I will be using to create dashboards for a many customers. This dashboard is set up to display all services we provide, regardless if that particular customer has that service installed. So if the customer doesn't have that service, the search displays a "No Results Found" message on that panel. Rather than have a customer view the report and freak out that we might not be getting data from them (some end users don't know what services their site has installed and what they don't), I want to display a custom message that tells them it could either be no data points or could be that they don't have the service. I have tried just about every suggestion I could find on other similar posts but I am not getting the success that others did. I'm hoping someone out there has another suggestion to help me reach a solution. Here is my search query: index=indexname sourcetype=sourcename [| inputlookup MasterList.csv | search CustomerName="*CustomerName*" | table propertyId | format] | lookup MasterList.csv propertyId | timechart span=1mon count by CustomerName | fields _time *customerOne | appendpipe [ stats count | eval NoResults="There is no data for this time period. This could possibly be to the service not being available" | where count=0 | table NoResults] However, this is the what the panel looks like in the dashboard: Some one else suggesting adding _time=now() to the append but then I get this: | appendpipe [ stats count | eval NoResults="There is no data for this time period. This could possibly be to the service not being available", _time=now() | where count=0 | fields - count] Is there anyway to have the timechart NOT displayed and just have the custom NoResult text?

bhavlik · ‎02-10-2020

I have a scheduled PDF that I need to display the dates the report was run for. Unfortunately, I just learned that the tokens will not display in the Scheduled PDF as they do when I open the dashboard and then export PDF. My other option is then to display the dates the report was run for in the email message. I went through the Splunk documentation and several other posts but cannot figure out why my results token is still coming across as blank when email gets sent out. Here is the search I have created to establish the start and end date for the report. It is the first search and only returns one row of results. I removed using |table due to other posts suggestions and am using |fields instead. I even tried by removing |fields all together and still have no results in my email message. <search> <query>| makeresults | eval start = strftime(relative_time(now(), "-1w@w0"),"%m-%d-%Y") | eval end = strftime(relative_time(now(),"@w6"),"%m-%d-%Y") | eval message="Report was generated from "+start+" through "+end | fields message</query> <progress> <set token="message">$result.message$</set> </progress> </search> This search is not contained in a panel. It was set up to be outside any panels and then use a token to display as a title for a html panel for text. In the PDF schedule under Message, I simply put in $result.message$ but is completely blank when emailed. I even tried $message$ since it was set up as the token name but of course that didn't work either. Anyone have any ideas of why this isn't working or another way to get the dates to display on my scheduled PDF?

bhavlik · ‎11-27-2019

This is great. Thanks! I definitely need to read up on a couple commands you used, specifically untable and the eval { }.

bhavlik · ‎11-26-2019

I was able to get the desired results with the following: | loadjob savedsearch="Monitoring" | search propertyId=123456789 | fields - propertyId FullHospitalName date phi* *_avg | rename billing_yest as Billing ftg_yest as FTG main_yest as Main nav_yest as Nav | transpose column_name=Index | rename "row 1" as DailyCount | join type=left Index [| loadjob savedsearch="Monitoring" | search propertyId=123456789 | fields - propertyId FullHospitalName date phi* *_yest | rename billing_avg as Billing ftg_avg as FTG main_avg as Main nav_avg as Nav | transpose column_name=Index | rename "row 1" as Avg30] | eval Status=case(DailyCount=0,"No Events",DailyCount<Avg30*.8,"Warning",true(),"Good") Is there a better way to do this?

bhavlik · ‎11-26-2019

I am setting up a dashboard that monitors count of events on a daily basis and a previous 30 day average by customer. I have the search built and each customer has a row of data. For the dashboard, I want to display each customer in its own table. But I am struggling on how to convert the row of data in to the table format I'd like to display. Here is the row of data after I query a customer from the saved search: Here's what I'd like it to look like: Any thoughts on how to achieve this?

bhavlik · ‎11-15-2019

With a few suggestions from a coworker, I was able to figure this one out. Here's how I accomplished this for anyone who may be looking to do some similar. |dbquery query="select site_id from table" connection="Warehouse" |rename site_id as propertyId |search NOT propertyId IN ( [|inputlookup MasterList.csv |fields propertyId |mvcombine delim="," propertyId |eval propertyId=mvjoin(propertyId, ",") |return $propertyId]) |sendemail to="myemail@companyABC.com" subject="Added" sendresults=true I decided to leave this as a separate report and have it run 2 hours prior to the report that creates/updates the overall MasterList.

bhavlik · ‎10-29-2019

I have a lookup file that is a Master List of all sites I might need to create reports for in Splunk. This list includes data such as site name, account manager, etc that is not indexed in Splunk. This list is created by a dbxquery to our warehouse tables. I have it run once a week to recreate the list in case new sites were added that week. What I am looking to do is have an email sent to me when new sites are added. I cannot just append the new sites since previous sites might have information updated such as account manager or software version. Below is my start and thoughts on the logic of how to achieve this but I'm struggling to work out the details. Hoping one of you can help me out. |dbxquery query="select site_id from table" connection="Warehouse" |rename site_id as propertyId NOT propertyId IN ([|inputlookup MasterList.csv |table propertyId |format]) |sendemail (of new propertyIds) |dbxquery query="FULL QUERY OF ALL NEEDED FIELDS" |rename........ |outputlookup MasterList.csv My first issue is that I can't get the NOT to work after the dbxquery since its not searching the index in Splunk. So how do I compare the new query to the lookup file? I think I can figure out the sendemail once I have some results. Then can I have the full query re-run to include all fields I want in the lookup file and recreate the MasterList? Is there a better way to achieve what I want to do? Let me know if you need more explanation of what I'm trying to do and thanks for any help.

Posts	25
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎10-29-2019

Online Status	Offline
Date Last Visited	‎08-18-2023 06:40 PM

How to search for null values in fields when the f...

Is there a way to format a string when it's used t...

How to remove "Date & Time Range" from time picker...

How to color a cell on dashboard based on conditio...

Is there a way to create a chart where each date ...

How to use streamstats to evaluate events from dif...

How to display Custom Text instead of "No Results ...

How to display result token in email message?

Any way to break this row into two columns?

How to compare results of dbxquery to lookup file,...

Re: How to search for null values in fields when t...

How to search for null values in fields when the f...

Re: Result Token not displaying in email message

Re: Is there a way to format a string when it's us...

Is there a way to format a string when it's used t...

Re: How to remove "Date & Time Range" from time pi...

How to remove "Date & Time Range" from time picker...

Re: Is there a way to create a chart where each d...

Re: How to color a cell on dashboard based on cond...

How to color a cell on dashboard based on conditio...

Re: Is there a way to create a chart where each d...

Is there a way to create a chart where each date ...

How to use streamstats to evaluate events from dif...

Re: How to display Custom Text instead of "No Resu...

Re: How to display Custom Text instead of "No Resu...

Re: How to display Custom Text instead of "No Resu...

Re: How to display Custom Text instead of "No Resu...

Re: How to display Custom Text instead of "No Resu...

How to display Custom Text instead of "No Results ...

How to display result token in email message?

Re: Any way to break this row into two columns?

Re: Any way to break this row into two columns?

Any way to break this row into two columns?

Re: How to compare results of dbxquery to lookup f...

How to compare results of dbxquery to lookup file,...