About hc_joycechen

hc_joycechen · ‎12-13-2020

Please refer to this URL. https://community.splunk.com/t5/Dashboards-Visualizations/Change-chart-bar-color-based-on-data-value/m-p/56685 try: <row> <panel> <chart> <search> <query>index = _internal earliest=-h@h latest=@h | stats count by sourcetype | where sourcetype=="splunkd" OR sourcetype=="splunkd_access" OR sourcetype=="splunkd_remote_searches" | eval splunkdCount = if(sourcetype=="splunkd",count,0) | eval splunkd_accessCount = if(sourcetype=="splunkd_access",count,0) | eval splunkd_remote_searches = if(sourcetype=="splunkd_remote_searches",count,0) | fields - count</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <sampleRatio>1</sampleRatio> <refresh>10m</refresh> <refreshType>delay</refreshType> </search> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"splunkdCount": #AF575A, "splunkd_accessCount": #EC9960, "splunkd_remote_searches":006D9C}</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.placement">bottom</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row>

hc_joycechen · ‎10-26-2020

I don't quite understand your question. Can you give sample information?

hc_joycechen · ‎10-21-2020

hot_locations: | makeresults | eval _raw="Temperature=82.4, Location=xxx.165.152.17, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=84.2, Location=xxx.165.152.48, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=82.4, Location=xxx.165.154.21, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=82.4, Location=xxx.165.162.22, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=77.0, Location=xxx.165.164.17, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=75.2, Location=xxx.165.170.17, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=77.0, Location=xxx.165.208.12, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=73.4, Location=xxx.165.48.20, Time=Wed Sep 16 07:43:01 PDT 2020, Type=UPS; Temperature=75.3, Location=xxx.165.52.13, Time=Wed Sep 16 07:47:01 PDT 2020, Type=TempSensor; Temperature=77.9, Location=xxx.165.52.14, Time=Wed Sep 16 07:47:01 PDT 2020, Type=TempSensor; Temperature=76.3, Location=xxx.165.54.24, Time=Wed Sep 16 07:47:01 PDT 2020, Type=TempSensor; Temperature=83.8, Location=xxx.165.48.20, Time=Wed Sep 16 07:47:01 PDT 2020, Type=TempSensor; Temperature=73.8, Location=xxx.165.36.21, Time=Wed Sep 16 07:47:01 PDT 2020, Type=TempSensor;" | eval x=split(_raw,";") | mvexpand x | rename x as _raw | extract | fields - _raw | stats max(Temperature) as max_Temperature by Type, Location | sort Type, - max_Temperature | stats first(Location) as Location by Type | fields Location | dedup Location

hc_joycechen · ‎10-21-2020

index=db_oracle sourcetype="oracle:audit:text" (OMEGACA OR OMEGA_CORE_AUDIT) | where like(ACTION, "%OMEGACA%") OR like(ACTION, "%OMEGA_CORE_AUDIT%")

hc_joycechen · ‎10-20-2020

app_lookup.csv OR App_lookup.csv ?? It's different. | inputlookup App_lookup.csv | join type=left App_Name [ search sourcetype="aduit" success NOT AUTHN_ATTEMPT | lookup App_lookup.csv Connection_ID as connectionid OUTPUT App_Name | stats count(App_Name) as "Number of Successful Logins" by App_Name ] | where isnull("Number of Successful Logins")

hc_joycechen · ‎10-20-2020

Try: | inputlookup app_lookup.csv | join type=left App_Name [ search sourcetype="aduit" success NOT AUTHN_ATTEMPT | lookup app_lookup.csv Connection_ID as connectionid OUTPUT App_Name | stats count(App_Name) as "Number of Successful Logins" by App_Name ] | where isnull("Number of Successful Logins")

hc_joycechen · ‎02-18-2020

1-First command create file? Where it will be atore? | makeresults | eval aa="1", bb="2", cc="3" | outputlookup nnn.csv file : /opt/splunk/etc/apps/your_app/lookups 2-load file on dashboard? Sample <panel> <table> <search> <query>| inputlookup nnn.csv</query> </search> <option name="count">30</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel>

hc_joycechen · ‎02-18-2020

Run SPL command : ....your spl ... | outputlookup nnn.csv dashboard: | inputlookup nnn.csv

Posts	8
Solutions	2
Karma Given	0
Karma Received	3
Member Since	‎02-18-2020

Online Status	Offline
Date Last Visited	‎12-16-2020 08:51 AM

Re: Different bar color based on condition

Re: Field search very slow compared to free text

Re: How to do compound query with where clause?

Re: Field search very slow compared to free text

Re: Search to display for list of applications to ...

Re: Search to display for list of applications to ...

Re: Run SPL command once and store result to acces...

Re: Run SPL command once and store result to acces...