About itnewbie

itnewbie · ‎09-08-2023

@ITWhisperer Thanks for the reply. Given I use $product_brand$ in the conditional panel now, I still need to set the condition of displaying the panel. At the <condition> tag, how can I set it to accept multiple values? As the above method only accepts a single value at one time, I want it to be if $procut_brand$ IN ANY of product brand ["A", "B", "C"], set the display panel to true and if not in those 3, just don't display. Any nudge in the right direction? Many thanks.

itnewbie · ‎09-07-2023

I have "Product Brand" multiselect filter in a Splunk dashboard. It is a dynamic filter rather than static. I also have a panel displaying all product brands. Now, I want another conditional panel to display further information of 3 of the brands in the product brand list if user selects any of these 3. I know I have to set a <change> and <condition> tag in XML to toggle between the display of panel and store the selected values. I now write three condition tags with set token like this: <change> <condition match="A"> <set token="show_product_panel">true</set> <set token="show_product">$value$</set> </condition> <condition value="B"> <set token="show_product_panel">true</set> <set token="show_product">$value$</set> </condition> <condition value="C"> <set token="show_product_panel">true</set> <set token="show_product">$value$</set> </condition> <condition> <unset token="show_product_panel"></unset> <unset token="show_product"></unset> </condition> </change> However, I want the $show_product$ to hold multiple values instead of one, as it is a multiselect filter. How should I do so? I have tried something in each of the condition like but won't work. How can I "append" the values into $show_product$? Thanks. <eval token="show_product">if(isnull($show_product$), $value$, $show_product$.", ".$value$)</eval> FYI: the $show_product$ will be passed into the conditional panel like this <row depends="$show_product_panel$"> <panel> <chart> <search> <query>index IN ("A_a", "A_b") | where match(index, "A_" + $subsidiary$) | dedup id sortby _time | eval "Product Brand" = coalesce('someFieldA', 'someFieldB') | search "Product Brand" IN ($show_product$) | timechart span=1mon count by "Product Brand"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> FYI: Product Brand XML code snippet: <input type="multiselect" token="product_brand" searchWhenChanged="true"> <label>Product Brand</label> <fieldForLabel>brand_combine</fieldForLabel> <fieldForValue>brand_combine</fieldForValue> <search> <query>index IN ("A","B") | eval brand_combine = coalesce('someFieldA','someFieldB') | search brand_combine != null | where match(index, "zendesk_ticket_" + $subsidiary$) | dedup brand_combine | fields brand_combine</query> <earliest>0</earliest> <latest></latest> </search> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <delimiter>,</delimiter> <change> <condition match="A"> <set token="show_product_panel">true</set> <set token="show_product">$value$</set> </condition> <condition value="B"> <set token="show_product_panel">true</set> <set token="show_product">$value$</set> </condition> <condition value="C"> <set token="show_product_panel">true</set> <set token="show_product">$value$</set> </condition> <condition> <unset token="show_product_panel"></unset> <unset token="show_product"></unset> </condition> </change> </input>

itnewbie · ‎08-15-2023

Hi I have a dashboard with multiple filters. I have a "customer" and "subsidiary" filter. I want the "customer" filter to display corresponding companies depending on the selection of "subsidiary" filter. My query for the "customer" filter is as follow, currently it is showing all companies index IN ("organization_a_company", "organization_b_company") | dedup name | fields name For the "subsidiary" filter, it has a static input with Name - Value ============ All - * OrgA - OrgA OrgB - OrgB However, since the value of "subsidiary" is different from the actual index name. I need to perform eval case to map to corresponding indexes name. I tried something dynamic in "customer" filter like: index IN ("organization_a", "organization_b") | eval $sub$ = "OrgA" <- the $sub$ token should come from the "subsidiary" filter, I am just testing here | eval filteredIndex = case($sub$ == "OrgA", "organization_a", $sub$ == "OrgB", "organization_b", 1=1, "organization_*") | search index IN ($filteredIndex$) | dedup name | fields name but it didn't give any results. I tried follow the example here by using $$ but still no luck. And I don't think I can put the eval before the search right? but how can I make the index dynamic then. Thanks

itnewbie · ‎08-14-2023

I have a JSON event like this: { ...otherfields..., "fields": { "id1": 123, "id2": 456, "id3": 789, ... }, ...otherfields... } I want to extract some key-value pairs from the "fields" object, i.e., I want to see the extracted fields in the "interesting fields" section. For example, if I only want to extract id1 and id3, I should use eval new_id1 = mvindex(fields.id1, 0) eval new_id3 = mvindex(fields.id3, 0) , right? Or is there another efficient way but not to use Foreach? I am new to the Splunk syntax so would appreciate any help.

itnewbie · ‎08-10-2023

I have a "Severity Level" field in both index A and index B. Their structure is like: ==index A=== Severity Level 1 2 3 4 ===index B=== Severity Level critical high medium low Now I want to combine the two indexes in a search and display the Severity Level using | timechart count by "Severity Level" where the combined "Severity Level" values only contain 1,2,3,4 So, I need an eval = case() to map them. My syntax for for that is eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null) By this, the result gives incorrect result, i.e., only showing incorrect counts on 4. I think the problem is in the single and double quote, but I am not sure which is which. It is a bit urgent so I need help. Thanks.

itnewbie · ‎08-09-2023

I have another question, right now, I have an "organization_id" field in this index, it can be referenced as the "id" field to another index B, index B also has a "name" field representing the organization name. If I want to filter my result of index A by the organization name as well, how may I do so? The event of index B like this: { "otherField: "", "id" 123, "name": "ABC Company" } And splunk already extracts the "id" and the "name" field in the interesting field section of index B. I am thinking about using join: index=A (current index) | rename organization_id as id | dedup id | join id [ | search index=B ...how to retrieve the list of organization names?... ] My current base search is like this: index="A" | foreach 0 1 [ eval f=mvindex('fields{}.id', <<FIELD>>), f=case(f="123","Product Brand", f="456", "Severity Level", 1==1,f), {f}=mvindex('fields{}.value', <<FIELD>>) | fields - f] | ...additional organization name extratcion logic here... | search Organization IN (*) <- a dynamic filter in the dashboard | timechart count by "Severity Level" usenull=f

itnewbie · ‎08-09-2023

Thanks for the reply. Let me try to explain. I want it like: I extract the id "123" and rename it as "Product Name", when I click the "Product Name" in the interesting field, it should "map" and give it the "value" (ABC) of all the "Product Name" value in the index

itnewbie · ‎08-08-2023

I have an index, where each event is a JSON object, the structure is as follows: { "otherFields": "otherValue", "fields": [ { "id": 123, "value": "ABC" }, { "id": 456, "value": "DEF" } ] } Now, I want to extract the "id" value and rename it with meaningful names, such that the renamed field can be seen at the "interesting field" section in the search app and I can use it in timechart command to filter for the value. I have tried something like: | mvexpand fields{}.id | search feilds{}.id=123 | rename fields{}.id AS "Product Name" And in the interesting field section, it gave me something like: Current ouput But I want it to look like the id with the corresponding value: My desired output Not only I want to rename one but multiple ids, how may I do so?

itnewbie · ‎07-20-2023

Thank you. It worked.

itnewbie · ‎07-20-2023

thanks for the reply. It worked. But what if I put it in chart overlay, like this: (index="A" OR index="B") | eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction) | eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction) | chart count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f | appendcols [ | search (index="A" OR index="B") | chart count(Level) over _time span=1mon by Level usenull=f useother=f ] where Level is from index A and Satisfaction is from index B. The chart like this: I tried to wrap your suggestions in the appendcols cause this is column chart part where I want to reverse the order but it seemed won't work.

itnewbie · ‎07-20-2023

Hi, I am new to Splunk. I have a stacked column chart after issuing this query: (index="A" OR index="B") | chart count(Level) over _time span=1mon by Level usenull=f useother=f where Level has four values: 1,2,3,4 The chart is like this: As you can see the stack order is now 2 > 3 > 4 (from top to bottom), what if I want to reverse it to display like 4 > 3 > 2 (from top to bottom). I have seen similar questions here using transpose or reverse, I tried follow but still have no luck. Could anyone help?

Posts	12
Solutions	0
Karma Given	19
Karma Received	0
Member Since	‎07-20-2023

Online Status	Offline
Date Last Visited	‎09-13-2023 12:04 AM

How to store multiple values in one token and pass...

How to create Dependent Multiselect filter in Splu...

How to extract key-value pair from json object?

Correct syntax of eval string case

How to extract and rename field from JSON

Reverse Stacked Order of Column Chart

Re: How to store multiple values in one token and ...