Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Simple Form Dropdown Menu

$
0
0
Hi, I wonder whether someone could help me please. I'm trying to put together a dashboard which is set out as follows: - Timepicker - List of usernames which is filtered by the timepicker Then when the user selects the timepicker and the username I would like this to extract the relevant data in the dashboard panel. This is the 'simple XML' for this part of the dashboard:
-24h@hnow*All|rest /services/search/jobs earliest=$timerange.earliest$ latest=$timerange.latest$ |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" |stats count by authorauthorauthorauthor=""
Splunk Searches Performed - Results for $author$|rest /services/search/jobs author="$author$" |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" |addtotals fieldname=duration *duration_secs |eval groupduration=case(duration<=300, "Less Than 5 Minutes", duration>300 AND duration<=600, "Between 5 and 10 Minutes", duration>600 AND duration<=1200, "Between 10 and 20 Minutes", duration>1200 AND duration<=1800, "Between 20 and 30 Minutes", duration>1800, "Greater than 30 Minutes") |convert rmunit(duration) as numSecs |eval stringSecs=tostring(duration,"duration") |eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s") |rex field=stringSecs "\.(?\d{2})" |rex field=stringSecs "(?.+)s\." |eval stringSecs=myRest. "s " .ms. "ms" |eval NoOfDays=floor((searchLatestTime-searchEarliestTime)/(3600*24)) |eval earliestTime=strptime(earliestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(earliestTime) |eval latestTime=strptime(latestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(latestTime) |eval daterange= "From: ".earliestTime.", To: ".latestTime |makemv delim=", " daterange |table author eai:acl.app title daterange NoOfDays stringSecs groupduration |rename author as "Search Author", eai:acl.app as "App Used", title as "Query", daterange as "Query Date Range", NoOfDays as "Query Date Range (Days)", stringSecs as "Query Runtime", groupduration as "Run Time Category"0
The problem I have is that I cannot filter the results in the dashboard panel. Irrespective of what user I select in the drop down menu, the panel displays the results for all users. I've been through the various example online but I still can't get this to work. I just wondered whether someone may be able to look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>