Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wangkevin1029
wangkevin1029
Communicator
Member since:
11-27-2021
04-04-2023
Community Statistics
| Posts | 113 |
| Solutions | 2 |
| Karma Given | 15 |
| Karma Received | 3 |
| Member Since | 11-27-2021 |
Activity Feed
- Got Karma for Re: drilldown AND conditions doesn't work. 04-04-2023 06:30 AM
- Posted Re: drilldown AND conditions doesn't work on Dashboards & Visualizations. 04-04-2023 05:56 AM
- Posted Why won't drilldown AND conditions work? on Dashboards & Visualizations. 04-03-2023 08:13 PM
- Posted Re: How to find out who is using my shared dashboard? on Dashboards & Visualizations. 03-27-2023 05:43 AM
- Posted How to find out who is using my shared dashboard? on Dashboards & Visualizations. 03-23-2023 10:46 AM
- Posted Re: Why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-20-2023 07:31 AM
- Karma Re: Why can I not increase multiselect field input area width? for bowesmana. 02-20-2023 07:31 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 03:08 PM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 11:14 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 07:53 AM
- Posted Re: why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 07:27 AM
- Posted Why can I not increase multiselect field input area width? on Dashboards & Visualizations. 02-17-2023 06:43 AM
- Posted Re: 3rd Token handler doesn't work with 1st and 2nd token handler together. on Splunk Search. 01-20-2023 11:14 AM
- Posted 3rd Token handler doesn't work with 1st and 2nd token handler together? on Splunk Search. 01-20-2023 10:04 AM
- Posted Re: chart drilldown earliest and latest time not working on Dashboards & Visualizations. 01-20-2023 05:41 AM
- Posted Re: chart drilldown earliest and latest time not working on Dashboards & Visualizations. 01-20-2023 05:38 AM
- Posted Why is chart drilldown earliest and latest time not working? on Dashboards & Visualizations. 01-19-2023 07:39 PM
- Got Karma for Re: How to click a timechart "count by" result as input to reopen the same dashboard?. 01-19-2023 07:24 AM
- Posted Re: How to click a timechart "count by" result as input to reopen the same dashboard? on Dashboards & Visualizations. 01-19-2023 06:49 AM
- Posted Re: How to click a timechart "count by" result as input to reopen the same dashboard? on Dashboards & Visualizations. 01-18-2023 06:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-04-2023
05:56 AM
1 Karma
it looks I used wrong token. after I changed $Gucid_token$ to $click.value2$, it works. Kevin
... View more
04-03-2023
08:13 PM
Hi， Splunkers,
I have a condition drilldown, when I only had one condition <condition match="$t_DrillDown$ = "*"">, it works, but when I added another condition len($Gucid_token$) = 20, and click some field, which passes $Gucid_token$ as input, my two dashboard included here are not opened, instead a basic splunk search is opened.
<condition match="$t_DrillDown$ = "*" AND len($Gucid_token$) = 20">
<link target="_blank">
<![CDATA[
/app/optum_gvp/pivr_search?form.i_callGUID=$click.value2$&form.i_time1.earliest=$row.StartDTM_epoch$&form.i_time1.latest=$row.EndDTM_epoch$
]]>
</link>
<link target="_blank">
<![CDATA[
/app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
]]>
</link>
</condition>
why added another condition len($Gucid_token$) = 20 caused drilldown not open two dashboards , but open a basic splunk query?
thx.
Kevin
... View more
Labels
- Labels:
-
drilldown
03-27-2023
05:43 AM
Thx, Richgalloway, Unfortunately, I was told I don't have access to index=_internal . but I will try it in my own env. thx. Kevin
... View more
03-23-2023
10:46 AM
Hi, SPlunkers, How to find out who is using my shared dashboard? thx. Kevin
... View more
Labels
- Labels:
-
dashboard
02-20-2023
07:31 AM
amazing, it works, multiselect works. thank you very much. Kevin
... View more
02-17-2023
03:08 PM
just tried, doesn't' work. pretty sure this css is been used , I changed the following 2nd part width, it works. #KeyWordID { width: 350px; } #KeyWordID div[data-component="splunk-core:/splunkjs/mvc/components/MultiSelect"] { width: 300px; !important; max-width: 340px; !important; } #KeyWordID { width: 350px; }
... View more
02-17-2023
11:14 AM
yes, 1st response, I did already try MultiDropdown, it didn't work. Kevin
... View more
02-17-2023
07:53 AM
splunk version is 9.0.4. component name ( ID) is correct, cause 2nd part 350px works as expected. Kevin
... View more
02-17-2023
07:27 AM
Hi, ITWhisperer, the input field type only has Dropdown, or Multiselect, no MultiDropdown. my input field type is MultiSelect. but I did change the type in css from Multiselect to MultiDropdown, it didn't work, though. Kevin
... View more
02-17-2023
06:43 AM
Hi, Splunkers,
I have my multiselect field ccs code as below:
2nd part, 350px works for entire area width, but 1st part looks not working as expected, input area width not as 300px, or 340 px.
#KeyWordID div[data-component="splunk-core:/splunkjs/mvc/components/MultiSelect"]
{
width: 300px; !important;
max-width: 340px; !important;
}
#KeyWordID {
width: 350px;
}
thx, in advance.
Kevin
... View more
Labels
- Labels:
-
CSS
01-20-2023
11:14 AM
thank you very much , ITWhisperer, your whisper always works great. Kevin
... View more
01-20-2023
10:04 AM
Hi, Splunkers,
I have the following token handler, if input "Gucid_token_with3handlers" is 2 digits number, it will return as token skillexpressionLength,
if it's not 2 digits number will return itself as token Gucid_token, which works fine.
now I want to add handler 3, if 1st 3 characters are VQ_, I want it to return itself as token Gucid_token_VQ, otherwise, it return as Gucid_token_VQ with value *
but it looks handler 3 is conflicting with handler 1.
so my question is how to define the 3rd token handler to have it work together 1st and 2nd token handlers without conflict?
the following is the input token definition with 3 token handlers.
<input type="text" token="Gucid_token_with3handlers" searchWhenChanged="true"> <label>Gucid/UUID/SID</label> <change> <eval token="Gucid_token"> if(match(value, "^[0-9][0-9]?$"),"", value)</eval> <eval token="skillexpressionLength">if(match(value, "^[0-9][0-9]?$"),value, 0)</eval> <eval token="Gucid_token_VQ">if(substr(value,1,3)=="VQ_"),value, *)</eval> </change> <default></default> </input>
then I used the following search clause with $Gucid_token_VQ$
| search VQ = $Gucid_token_VQ$
then this search panel showing : search is waiting for input.
thx in advance.
Kevin
... View more
Labels
- Labels:
-
other
01-20-2023
05:41 AM
bowesmana, I copied these earliest and latest time code from my table query, which works fine for table. the only difference is drilldown option, for table, value = row, for chart , value=all. Kevin
... View more
01-20-2023
05:38 AM
Hi, bowesmana, thx for your quick response. it's the same chart as the last case about chart input. you helped me fix that issue. still passed $click.name2$ as input. for earliest, and latest time, I tried all.StartDTM_epoch, row.StartDTM_epoch, and StartDTM_epoch without prefix. form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$ Kevin
... View more
01-19-2023
07:39 PM
Hi, Splunkers,
I have the following table drilldown earliest and latest time works properly.
but when I copied it to a chart drilldown, it stopped working.
I noticed table drilldown has the following drilldown option value= row.
<option name="drilldown">row</option>
and the link for passing earliest and latest time uses row.StartDTM_epoch, and row.EndDTM_epoch
form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
I noticed my chart drilldown has the following drilldown option value= all.
<option name="drilldown">all</option>
so, I changed it to form.field2.earliest=$all.StartDTM_epoch$&form.field2.latest=$all.EndDTM_epoch$
not sure if the all.StartDTM_epoch and all.EndDTM_epoch casusing the failure.
the following is the related working code for table drilldown to pass earliest and latest time.
| eval StartDTM_epoch = relative_time(_time,"-20m") | eval EndDTM_epoch = relative_time(_time,"+20m")
| eval TIME = strftime(_time, "%Y-%m-%d %H:%M:%S") | table _time,sid,Type,AgentName,DN,FAddress,Segment,Function,Client,Product,SubFunction,SubFDetail,MKTGCT,CCType,VQ,TLCnt,AFRoute,StateCD,TargetSelected,AFStatus,,CBOffered,CBRejected,AQT,EWT,EWTmin,PIQ,WT,LSInRange,LSPriority,LSRateS,PB,PCSS,PENT,PF,RONA,LANG,StartDTM_epoch,EndDTM_epoch</query> <earliest>$field2.earliest$</earliest> <latest>$field2.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <fields>["_time","sid","Type","AgentName","DN","FAddress","Segment","Function","Client","Product","SubFunction","SubFDetail","MKTGCT","CCType","VQ","TLCnt","AFRoute","StateCD","TargetSelected","AFStatus","CBOffered","CBRejected","AQT","EWT","EWTmin","PIQ","WT","LSInRange","LSPriority","LSRateS","PB","PCSS","PENT","PF","RONA","LANG"]</fields> <drilldown> <condition match="$t_DrillDown$ = "*""> <link target="_blank"> <![CDATA[ /app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$ ]]> </link>
thx in advance.
Kevin
... View more
Labels
- Labels:
-
timechart
01-19-2023
06:49 AM
1 Karma
Hi, bowesmana, it works, after I changed $click.value2$ to $click.name2$. t_drilldown is a different input as a condition to open different dashboard. Kevin
... View more
01-18-2023
06:25 AM
richgalloway/bowesmana, if I put all in charting.drilldown, "<option name="charting.drilldown">all</option>" ,"then "$click.value2$" itself shows in form.Gucid_token_with2handlers, not click.value2, but string itself ""$click.value2$"" shows in new opened dashboard. if I put $click.value2$ in charting.drilldown, """<option name="charting.drilldown">$click.value2$</option>, ,then drilldown doesn't open new target dashboard.. the following is my charting.drilldown option and drilldown code" <option name="charting.chart.stackMode">$t_StackType$</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">$click.value2$</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<condition match="$t_DrillDown$ = "*"">
<link target="_blank">
<![CDATA[
/app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
]]>
</link>
<link target="_blank">
<![CDATA[
/app/optum_gvp/pkvp_search_based_on_session_id?form.field1=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
]]>
</link>
</condition>
<condition match="$t_DrillDown$ = "PSID"">
<link target="_blank">
<![CDATA[
/app/optum_gvp/pkvp_search_based_on_session_id?form.field1=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
]]>
</link>
</condition>
<condition match="$t_DrillDown$ = "PW"">
<link target="_blank">
<![CDATA[
/app/optum_gvp/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$&form.field2.earliest=$row.StartDTM_epoch$&form.field2.latest=$row.EndDTM_epoch$
]]>
</link>
</condition>
</drilldown>
... View more
01-18-2023
05:49 AM
Bowesmana， I will try it,thx. Kevin
... View more
01-17-2023
09:39 AM
Hi, Splunkers,
I have a timechart in dashboard..
l timechart span=1h count by VQ,
then timechart returns a graph with VQ_A, VQ_B, VQ_C with their values.
I want to click these VQ_XXX as input to reopen the dashboard.
how to pass these "count by" result as input to my dashboard?
actually, in my timechart: l timechart span=1h count by VQ, this VQ comes from a token.
there is a chart option below :
<option name="charting. Drilldown">$t_countby$</option>,
if I put token t_countby here, then when I click VQ_A, or, VQ_B, VQ_C in my timechart, the value passed as input is VQ， which I selected from droplist with token t_countby, not VQ_A, or, VQ_B, VQ_C, which I expected to pass as input.
thx in advance.
Kevin
... View more
Labels
- Labels:
-
timechart
12-18-2022
10:51 AM
thx, it looks a little complicated for me. still not sure why my other timechart works as expected. I will do more research. thank you very much. Kevin
... View more
12-18-2022
09:48 AM
this is working one. this is not working one, total aggragation result is 22, max value is 100, which I didn't configure it.
... View more
12-18-2022
09:45 AM
sorry, i have that max value, but I don't want a fixed max value. Kevin
... View more
12-18-2022
09:44 AM
Vatsal, thx for your quick response. My splunk ver doesn't have this configuration. however I don't want a fixed max value. I need an automatic adjust max value here. and it works in my other splunk, I compared all visualization configuration, they are same. not sure why other one works. for the working one, if the largest value is 7, then max scale is 10, if the largest value is 7500, then max scale is 10000. Kevin
... View more
12-18-2022
08:01 AM
Hi，Splunkers,
I have a timechart, which have value for count by VQ less than 10, but default y axis scale is 100, which causes I can't see any column in my timechart.
how to change the y Axis scale to adjust automatically to my maximum value,
for example, if max value is less than 10, than default scale should be 10.
thx in advance. kevin
... View more
Labels
- Labels:
-
timechart
12-13-2022
08:56 PM
SanjayReddy, I tried | table _time， column， column2, column3 | stats count by VQ | timechart span=1h count by VQ or | table _time， column， column2, column3 | timechart span=1h count by VQ, both has statistics tab 0. but when I run | table _time， column， column2, column3 | stats count by VQ, it has correct return. Kevin
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-04-2023
09:46 AM
|
Karma given to
