About bloodseaker

bloodseaker · ‎06-26-2021

Thanks for the response. Hopenit'll be coping soon, as I find it a great option together with alerts. 😉

bloodseaker · ‎06-21-2021

Hi In the old classic dashboards, we could create a url that prefills some filters, like the environment, by passing in a querystring parameter, like ?form.ddlEnvironment=dev In a dashboard, created via the dashboard studio, this no longer seem to work. Is there another way to achieve this?

bloodseaker · ‎06-21-2021

Hi, Just had another look and noticed something (which btw is annoying in that Dashboard Studio). I gave my data source a name, and used that name in the datasource section above. But, Splunk generates it own unique ID everything and that should be used instead of course. But there is no way of 'seeing that id' unless you scroll in the code. With that adjustment, everything seems to work now.

bloodseaker · ‎06-19-2021

Hi, Thanks for your response. The query itself, ds_applications is returning a table of application names. So just a 1 column table, nothing Else. It returns about 32 results, so not huge number either and runs below a second so efficiënt as well. No syntax errors in code are shown and I also tried with leaving the defaultValue in there, but it did not matter to the result Maybe useful as well, we are running on Splunk Cloud, Version 8.2.2104.1

bloodseaker · ‎06-17-2021

Hi, In the old dashboard scenario, we could easily, for a dropdown input field, enter the query that populates choices. In dashboard studio, there isn't any documentation on it, so I tried an example I found, but it isn't working, and the properties used are also not found in the docs. Idea behind is, that I want to select the application I want to see the dashboard for, but don't want to manually add a new application, rather have it found via a query from the logs. Is this something that just can't be done? I would think it is a default thing you want for input dropdowns { "options": { "items": [], "token": "ddlApplication" }, "dataSources": { "primary": "ds_applications" }, "encoding": { "label": "primary[0]", "value": "primary[0]" }, "title": "Application", "type": "input.dropdown" }

bloodseaker · ‎09-13-2020

Ok After playing around like hell... I got it to work. | mstats avg(_value) as "Avg" WHERE host=VWININTAPI1D AND metric_name="Memory.Available_Bytes" span=5s | eval mem_gb = Avg / 1024 / 1024 / 1024 | timechart max("mem_gb") AS "GB Free" span=5m

bloodseaker · ‎09-13-2020

Hi, Sorry for my late response. I tried several scenario's, as well the one you suggested. In your first suggestion, using avg(_value) in the eval, it gives the error that avg is not supported in eval The second suggestion also fails (with the as _value). It doesn't give an error, but the statistics are just empty without data of graph shown. (removing it, shows me the data again, so it must be incorrect). The third solution is what I am doing now, but it will show in the graph something like 6.5b where b stands for billion and not bytes. Which is confusing, as the graph will say 'free memory in bytes' and one could mistakenly interpret is as 6.5 bytes... I don't think this is a nice solution. You're still showing values in bytes and looks weird. I'd just want to convert it to a 1 or 2-decimal GB value and have the graph show 6.5Gb instead (Gigabytes) Via the Analytics tab is a lot easier to work with the data and get it in the graph, but also that lacks the ability of calculations or rounding

bloodseaker · ‎09-09-2020

Hi I have following query to show a graph of the free memory on the server. This working nicely. However, the numbers are in bytes, making it hard to understand. When doing this with a regular stats command, I could add eval to calculate this, but with mstats this fails Working query without conversion | mstats avg(_value) prestats=t WHERE index=em_metrics AND metric_name="Memory.Available_Bytes" span=30s by metric_name | timechart avg(_value) as "Avg" span=1m by metric_name failing query with eval | mstats avg(_value) prestats=t WHERE index=em_metrics AND metric_name="Memory.Available_Bytes" span=30s by metric_name | eval FreeMem = ((_value/1024)/1024) | timechart avg(FreeMem) as "Avg" span=1m by metric_name Any ideas how this can be achieved, I can't seem to find an example for mstats for this, only questions with stats

bloodseaker · ‎04-09-2020

Having the same issue. Bar charts are displayed correctly for example. And I don't think it is relating to timing of the search, as my bar charts are taking longer then the pie charts. And even narrowing the search window to 15 minutes, which is nothing in relation to search time, it is not working

Posts	9
Solutions	2
Karma Given	0
Karma Received	4
Member Since	‎04-09-2020

Online Status	Offline
Date Last Visited	‎09-24-2021 04:58 AM

Dashboard Studio: querystring filter

Dashboard Studio: populate dropdown via datasource

mstats and eval - How to get free memory in GB ins...

Re: Dashboard Studio: querystring filter

Dashboard Studio: querystring filter

Re: Dashboard Studio: populate dropdown via dataso...

Re: Dashboard Studio: populate dropdown via dataso...

Dashboard Studio: populate dropdown via datasource

Re: mstats and eval - getting free memory in GB in...

Re: mstats and eval - getting free memory in GB in...

mstats and eval - How to get free memory in GB ins...

Re: Splunk Mobile- Supported Visualizations not vi...