About sdhiaeddine

sdhiaeddine · ‎02-22-2023

Hi, I'm filtering a search to get a result for a specific values by checking it manually this way: .... | stats sum(val) as vals by value | where value="v1" OR value="v2" OR value="v3" I'm wondering if it is possible to do the same by checking if the value exists in a list coming from another index: (something like this) .... | append [search index=another_index | stats values(remote_value) as values_list] | stats sum(val) as vals by value | where (value in values_list)

sdhiaeddine · ‎02-06-2023

Hi @gcusello, Actually I run this to extract the data from a json like this: { "list_element": [ { "Address": "3 st xxxxx", "Age": "22", "Name": "Jane" }, { "Address": "2 st xxxxx", "Age": "21", "Name": "Elisabeth" }, { "Address": "1 st xxxxx", "Age": "21", "Name": "Mark" } ] } index=* | stats values(list_element) as list_element by database | spath input=list_element | table Name Age Address I guess, I need to set a condition after the "spath"?

sdhiaeddine · ‎02-06-2023

Hi, I have this table of data: Name Age Address Mark 21 1 st xxxxx Elisabeth 21 2 st xxxxx Jane 22 3 st xxxxx Bryan 24 4 st xxxxx I want to list only the elements having a specific age. Exp: list of person with Age=21 Name Age Address Mark 21 1 st xxxxx Elisabeth 21 2 st xxxxx Thanks for your help.

sdhiaeddine · ‎01-26-2023

This is the actual event format {event_disabled: false internal_event_id: 124578_1245 name: ELEMENT_EVENT element_list: {"list_element":[{"element": "{\"var1\":\"1.1.8.8:443\",\"var2\":\"1188\"}"},{"element": "{\"var1\":\"8.8.1.1:443\",\"var2\":\"8811\"}"},{"element": "{\"var1\":\"1.2.3.4:443\",\"var2\":\"1234\"}"}]} phone_number: 123456789 }

sdhiaeddine · ‎01-26-2023

Thank you @ITWhisperer for your help. I get the correct number of rows (Events(3)) but with empty values.

sdhiaeddine · ‎01-25-2023

Hi, Please could you help with parsing this json data to table { "list_element": [ { "element": "{\"var1\":\"1.1.8.8:443\",\"var2\":\"1188\"}" }, { "element": "{\"var1\":\"8.8.1.1:443\",\"var2\":\"8811\"}" }, { "element": "{\"var1\":\"1.2.3.4:443\",\"var2\":\"1234\"}" } ] } The result should look like: var1 var2 1.1.8.8:443 1188 8.8.1.1:443 8811 1.2.3.4:443 1234

sdhiaeddine · ‎03-08-2022

@kamlesh_vaghelaThank you, it works now

sdhiaeddine · ‎03-03-2022

This is the xml part <form script="script.js" > <label>App</label> <row> <panel> <html depends="$hide$"> <style> #submit_button{ width:80px !important; } #submit_button div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ width:80px !important; } #submit_button button{ padding: 6px 15px !important; border-radius: 3px !important; font-weight: 500 !important; background-color: #5cc05c !important; border: transparent !important; color: #fff !important; } #submit_button button:hover{ background-color: #40a540 !important; border-color: transparent !important; } </style> </html> .... <input type="link" id="submit_button"> <label></label> <choice value="submit">Submit</choice> </input> </panel> </row> <row> <panel id="panel_id"> <table> <search> <query>index=* | stats latest(element) by value</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

sdhiaeddine · ‎03-03-2022

Hi @kamlesh_vaghela Did not work for me ☹️ My code is as below: $("#submit_button").click(function($){ if(typeof submittedTokens.get("element") === 'undefined'){ mvc.Components.get("panel_id").startSearch(); } });

sdhiaeddine · ‎03-03-2022

Hi @sandyBDF Could you please share the solution, if you got one? Thxs

sdhiaeddine · ‎03-01-2022

Hi @ITWhisperer Have you already ingested the "remote" file or made it available through a KV store? Not yet, I'm still looking on how to do it How often does the remote file change? About once a month I update the json file

sdhiaeddine · ‎03-01-2022

Hi, I need to filter my query for a specific field_value. The working query is as follow: index=_index (field_value="value1" OR field_value="value4" OR field_value="value14") | ..... Now, I would like to retrieve those field values from a remote json file and pass it to search condition this way: index=_index (field_value in listOfFieldValuesFromRemoteJson) | ..... Could you please help me make it work? The json file : [{"field_value": "value1"},{"field_value": "value4"},{"field_value": "value14"}] Best regards, Dhiaeddine

Posts	12
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-01-2022

Online Status	Offline
Date Last Visited	‎10-05-2023 06:23 PM

How to check if a value exists in a list of values...

How to list element by a specific value?

How to parse this json data?

Retrieve values from json file

How to check if a value exists in a list of values...

Re: List element by a specific value

How to list element by a specific value?

Re: Help with parsing this json data

Re: Help with parsing this json data

How to parse this json data?

Re: How to reload a single panel with javascript

Re: How to reload a single panel with javascript

Re: How to reload a single panel with javascript

Re: refresh specific panel with javascript buton

Re: Retrieve values from json file

Retrieve values from json file