Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kavyakanne
kavyakanne
Engager
Member since:
05-12-2020
12-15-2021
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 05-12-2020 |
Activity Feed
- Posted Re: Timechart Sort Asc/Desc on Splunk Enterprise. 12-14-2021 09:52 PM
- Posted Timechart Sort Asc/Desc on Splunk Enterprise. 12-14-2021 10:07 AM
- Posted Re: change index value based on the dropdown selection on Splunk SOAR (f.k.a. Phantom). 05-17-2020 01:38 AM
- Posted change index value based on the dropdown selection on Splunk SOAR (f.k.a. Phantom). 05-17-2020 01:36 AM
- Tagged change index value based on the dropdown selection on Splunk SOAR (f.k.a. Phantom). 05-17-2020 01:36 AM
- Posted Re: Dashboard with multiple panels with single user input on Dashboards & Visualizations. 05-17-2020 01:16 AM
- Posted Re: drilldown problem on Dashboards & Visualizations. 05-13-2020 08:48 AM
- Posted Re: drilldown problem on Dashboards & Visualizations. 05-13-2020 08:47 AM
- Posted Re: drilldown problem on Dashboards & Visualizations. 05-13-2020 08:42 AM
- Posted Re: drilldown problem on Dashboards & Visualizations. 05-13-2020 06:08 AM
- Posted Re: drilldown problem on Dashboards & Visualizations. 05-13-2020 01:22 AM
- Posted drilldown problem on Dashboards & Visualizations. 05-12-2020 11:00 AM
- Tagged drilldown problem on Dashboards & Visualizations. 05-12-2020 11:00 AM
- Posted Re: need help to write regex for the below events on Splunk Search. 05-12-2020 10:11 AM
- Posted need help to write regex for the below events on Splunk Search. 05-12-2020 07:16 AM
- Tagged need help to write regex for the below events on Splunk Search. 05-12-2020 07:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-14-2021
10:07 AM
After timechart can the columns be sorted either in Ascending/Descending order
... View more
Labels
- Labels:
-
other
-
using Splunk Enterprise
05-17-2020
01:38 AM
@gcusello
Could you assist me here!
Thanks in Advance!
... View more
05-17-2020
01:36 AM
So as per the Daily and Monthly selection index has to vary
Daily = index1 Monthly=index2
Thanks in Advance!
<fieldset>
<label>Report Type</label>
<choice value="Daily">Daily</choice>
<choice value="Monthly">Monthly</choice>
</fieldset>
... View more
- Tags:
- phantom
Labels
- Labels:
-
troubleshooting
05-17-2020
01:16 AM
@chetan1974
Hello Chetan
Were you able to solve abpove posted problem of yours?
Thanks in Advance!
... View more
05-13-2020
08:47 AM
This is my table view (with muliptle appends) this keeps changing with a dropdown selection (Datacentre)
Criteria Gold Silver Bronze NOT in CMDB No SLA Defined
Total CI 180 95 147
Total Backup 39 33 8 1 3
Not Backedup 154 63 138
Daily-Incremental-Backup 23 30 8 0 3
Daily-Full-Backup 3 2 0 0 0
Weekly-Full-Backup 5 0 0 0 0
Monthly-Full-Backup 8 0 0 1 0
Total Success 30 32 8 0 3
Total Failure 8 0 0 1 0
Total Running 1 1 0 0 0
Total Backup Size (GB) 4966 836 63 361 31
I've written 4 drilldown panels
(Total Backup
Not Backedup
Daily-Full-Backup Weekly-Full-Backup MonthlyFull-Backup Yearly-Full-Backup (one panel)
Total Success Total Failure Total Recovered Total Running
So my need is when I onclick on 39 number (i.e as per my logic token Criteria = (Total Backup) and token
Tier would be taking value "Gold" and lists all 30 hosts should be displayed (corresponding to respective drilldown panel)
============================
My problem is how hide the rest panels unable to unset them when i click on 39 all the rest 3 panels are listed 9obviously with no results found)
Need: on evry number respective to criteria respective drilldown panel nly should come with lists of hosts rest all 3 panels should be hidden (this is what 'm unable to achieve)
... View more
05-13-2020
08:42 AM
This is my table view (with muliptle appends) this keeps changing with a dropdown selection (Datacentre)
Criteria Gold Silver Bronze NOT in CMDB No SLA Defined
Total CI 180 95 147
Total Backup 39 33 8 1 3
Not Backedup 154 63 138
Daily-Incremental-Backup 23 30 8 0 3
Daily-Full-Backup 3 2 0 0 0
Weekly-Full-Backup 5 0 0 0 0
Monthly-Full-Backup 8 0 0 1 0
Total Success 30 32 8 0 3
Total Failure 8 0 0 1 0
Total Running 1 1 0 0 0
Total Backup Size (GB) 4966 836 63 361 31
I've written 4 drilldown panels
(Total Backup
Not Backedup
Daily-Full-Backup Weekly-Full-Backup MonthlyFull-Backup Yearly-Full-Backup (one panel)
Total Success Total Failure Total Recovered Total Running
So my need is when I onclick on 39 number (i.e as per my logic token Criteria = (Total Backup) and token
Tier would be taking value "Gold" and lists all 30 hosts should be displayed (corresponding to respective drilldown panel)
============================
My problem is how hide the rest panels unable to unset them when i click on 39 all the rest 3 panels are listed 9obviously with no results found)
Need: on evry number respective to criteria respective drilldown panel nly should come with lists of hosts rest all 3 panels should be hidden (this is what 'm unable to achieve)
... View more
05-13-2020
01:22 AM
@richgalloway
Hello Rich
Could you assist me here on-click on any value it re-driects and nun the drilldown panel (t1 only)
... View more
05-12-2020
11:00 AM
<form>
<label>Backup Report Dashboard Clone</label>
<fieldset submitButton="false">
<input type="dropdown" token="sour" searchWhenChanged="true">
<label>Datacentre</label>
<search>
<query>index="backup" sourcetype="csv"
| rex field=source "^(?<sour>[^_\.]*)\.csv"
|table sour
| dedup sour
| sort sour</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>sour</fieldForLabel>
<fieldForValue>sour</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
<suffix>.csv</suffix>
</input>
</fieldset>
<row>
<panel>
<html>
<style type="text/css">
#current .single-result {
font-size: 60px !important;
color: #00FF00;
}
</style>
</html>
</panel>
</row>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
.dashboard-panel h2{
background:#1E90FF !important;
color:white !important;
text-align: center !important;
font-weight: bold !important;
border-top-right-radius: 15px;
border-top-left-radius: 15px;
}
</style>
</html>
</panel>
</row>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
.dashboard-panel h2{
background:#1E90FF !important;
color:white !important;
text-align: center !important;
font-weight: bold !important;
border-top-right-radius: 15px;
border-top-left-radius: 15px;
}
</style>
</html>
</panel>
</row>
<row>
<panel depends="$alwaysHideCSS$">
<html>
<style>
#p1{
width:60% !important;
}
#p2{
width:40% !important;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<title>Criteria v/s Service</title>
<table>
<search>
<query>
index="backup" sourcetype="csv"
source ="$sour$"
|dedup extracted_Host
|eval BackupType=BackupType." "."Backup"
|eval Tier=if(Tier="null","NOT in CMDB",if(Tier="Not Supported","No SLA Defined",Tier))
|stats count as "Total Backup" by Tier
|chart values("Total Backup") over "Total Backup" by Tier
|fields - "Total Backup"
|eval BackupType = "Total Backup"
|stats values(*) as * by BackupType
]
|append [ search
index="backup" sourcetype="csv"
source ="$sour$"
|dedup extracted_Host
|eval BackupType=BackupType." "."Backup"
|eval Tier=if(Tier="null","NOT in CMDB",if(Tier="Not Supported","No SLA Defined",Tier))
|eval FinalJobStatus = if(FinalJobStatus="Completed (Exceptions)","Total Success",if(FinalJobStatus="Completed (Failed)","Total Failure",if(FinalJobStatus="Completed (Success)","Total Success",if(FinalJobStatus="Canceled","Total Canceled",if(FinalJobStatus="Running","Total Running","Total Recovered")))))
|chart count(FinalJobStatus) over FinalJobStatus by Tier
|sort FinalJobStatus
|rename FinalJobStatus as BackupType
]
| eval Rank=case(BackupType="Total CI","1",BackupType="Total Backup","2",BackupType="Total Success","9",BackupType="Total Failure","10",BackupType="Total Running","11",BackupType="Total Recovered","12",BackupType="Daily-Incremental-Backup","4",BackupType="Daily-Full-Backup","5",BackupType="Not Backedup","3",BackupType="Monthly-Full-Backup","7",BackupType="Weekly-Full-Backup","6",BackupType="Yearly-Full-Backup","8",BackupType="Total Backup Size (GB)","13")
| sort WHS, Rank
| fields - Rank
|rename BackupType as "Criteria"
|table Criteria Gold,Silver,Bronze,"NOT in CMDB","No SLA Defined"
===================
</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown target="_blank">
<condition field="Total">
<set token="t1">$click.value$</set>
<set token="t2">$click.value$</set>
<set token="t3">$click.value$</set>
<set token="t4">$click.value$</set>
</condition>
<condition field="*">
<set token="t1">$click.value$</set>
<set token="Tier">$click.name2$</set>
<set token="Criteria">$click.value$</set>
</condition>
<condition field="*">
<set token="t2">$click.value$</set>
<set token="Tier">$click.name2$</set>
<set token="TotalBackup">$click.value$</set>
</condition>
</drilldown>
</table>
==============
</panel>
</row>
<row>
<panel depends="$t1$">
<title>List of Hosts - $Tier$ - $Criteria$</title>
<table>
<search>
<query>index="backup" sourcetype="csv"
source ="$sour$"
|dedup extracted_Host
|eval BackupType=BackupType." "."Backup"
|eval Tier=if(Tier="null","NOT in CMDB",if(Tier="Not Supported","No SLA Defined",Tier))
|eval FinalJobStatus = if(FinalJobStatus="Completed (Exceptions)","Total Success",if(FinalJobStatus="Completed (Failed)","Total Failure",if(FinalJobStatus="Completed (Success)","Total Success",if(FinalJobStatus="Canceled","Total Canceled",if(FinalJobStatus="Running","Total Running","Total Recovered")))))
|search Tier="$Tier$"
|search FinalJobStatus="$Criteria$"
|rename "extracted_Host" as Hosts
|table Hosts</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">6</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="link.exportResults.visible">1</option>
<option name="link.inspectSearch.visible">1</option>
<option name="link.openPivot.visible">0</option>
<option name="link.openSearch.visible">1</option>
<option name="link.visible">0</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<drilldown target="_blank">
<unset token="TypeBackup"></unset>
<unset token="TotalBackup"></unset>
<unset token="NotBackedup"></unset>
<unset token="t2"></unset>
<unset token="t3"></unset>
<unset token="t4"></unset>
</drilldown>
</table>
</panel>
</row>
<row>
<panel depends="$t2$">
<title>List of Hosts - $Tier$ - $Criteria$</title>
<table>
<search>
<query>index="backup" sourcetype="csv"
source ="$sour$"
|dedup extracted_Host
|eval BackupType=BackupType." "."Backup"
|eval BackupType = "Total Backup"
|eval Tier=if(Tier="null","NOT in CMDB",if(Tier="Not Supported","No SLA Defined",Tier))
|search Tier="$Tier$"
|search BackupType="$Criteria$"
|rename "extracted_Host" as Hosts
|table Hosts</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">6</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="link.exportResults.visible">1</option>
<option name="link.inspectSearch.visible">1</option>
<option name="link.openPivot.visible">0</option>
<option name="link.openSearch.visible">1</option>
<option name="link.visible">0</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<drilldown target="_blank">
<unset token="Criteria"></unset>
<unset token="TypeBackup"></unset>
<unset token="NotBackedup"></unset>
<unset token="t1"></unset>
<unset token="t3"></unset>
<unset token="t4"></unset>
</drilldown>
</table>
</panel>
</row>
</form>
================================
when on-click on d values form main search query the panels are changing but a single query is only being run but not choosing accordingly to click.value and always below query os only being run
<query>index="backup" sourcetype="csv"
source ="$sour$"
|dedup extracted_Host
|eval BackupType=BackupType." "."Backup"
|eval Tier=if(Tier="null","NOT in CMDB",if(Tier="Not Supported","No SLA Defined",Tier))
|eval FinalJobStatus = if(FinalJobStatus="Completed (Exceptions)","Total Success",if(FinalJobStatus="Completed (Failed)","Total Failure",if(FinalJobStatus="Completed (Success)","Total Success",if(FinalJobStatus="Canceled","Total Canceled",if(FinalJobStatus="Running","Total Running","Total Recovered")))))
|search Tier="$Tier$"
|search FinalJobStatus="$Criteria$"
|rename "extracted_Host" as Hosts
|table Hosts</query>
... View more
- Tags:
- drilldown
Labels
- Labels:
-
drilldown
05-12-2020
10:11 AM
Thanks a ton! 🙂
... View more
05-12-2020
07:16 AM
Attached are my events I want rex to extract the highlighted text from the events and the events are logged under the field name JobName
========================================================
krwesx05.krw.app.com-IDPD3VPSEC01-Daily-Incremental-Backup-to-Disk
krwesx06.krw.app.com-krwbe3-Daily-Incremental-Backup-to-Disk
IDPD2VPIVC01-Application-02-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Web-Server-01-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Mail-Server-01-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-File-Servers-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Mail-Server-01-Daily-Incremental-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-KRWHR1-Backup-Daily-Incremental-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Application-03-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Application-01-Daily-Incremental-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC02-Application-03-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Application-02-Daily-Incremental-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Active-Directory-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Application-01-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC02-Active-Directory-Weekly-Full-Backup-to-StoreOnce-Catalyst
IDPD2VPIVC01-Mail-Server-02-KRWLN3-Daily-Incremental-Backup-to-StoreOnce-Catalyst
idwikppads01.app.com-Daily-Incremental-Backup-to-VTL
APP_Gold_VM_Image_Backup_01-Daily-Incremental-Backup-to-VTL
APP_Global_AD-Daily-Incremental-Backup-to-VTL
SRPWEB9-Daily-Incremental-Backup-to-VTL
Post rex I would want results like
Daily-Incremental-Backup
Weekly-Full-Backup
... View more
- Tags:
- rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-15-2021
02:42 AM
|
