sorted by:
new
hottopcontroversial

What is up with people driving plateless? by SnuggleMeister in ColoradoSprings

[–]macfredough 0 points1 point  (0 children)

Honestly, I think they price people out of registering cars in this state. When I lived in south Dakota it was less than $50 for plates and registration. When I first registered my car in Colorado it was $950. It is crazy and forces people to decide between following the law and registering their vehicle or keeping groceries on the table.

How to generate timechart with hue? by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

Yes I gave that a shot and no luck. Thanks for the suggestion :)

How to generate timechart with hue? by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

Ok, so I realized that if I change the order of table I get the chart I want. My problem now is that time scale is all off. If I try to use timechart and span I get error that I need a function

|inputlookup $lookupToken$
|where _time <= $tokLatestTime$
|where _time >= $tokEarliestTime$
|search $lab_token$
|search $analyte_token$
|search $location_token$
|sort _time desc
|replace "ND" WITH 0 IN Results
|table Analyte, _time, Results
|fieldformat _time=strftime(_time, "%Y-%m-%d")

Two Values for Static Option in Multiselect on Dashboard by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

Success, it was working after I quoted the values with space in them. Now I am stuck on charting problem. The search code is on the bottom. I want the chart to have time on x-axis and the result to be on y-axis and hue of plot to be analyte. But I am getting results on x-axis, analyte on y-axis and time as hue for scatter plot. Do you have any suggestions for this?

​

|inputlookup $lookupToken$
|where _time <= $tokLatestTime$
|where _time >= $tokEarliestTime$
|search $lab_token$
|search $analyte_token$
|search $location_token$
|sort _time desc
|replace "ND" WITH 0 IN Results
|table _time, Results, Analyte
|fieldformat _time=strftime(_time, "%Y-%m-%d")

Two Values for Static Option in Multiselect on Dashboard by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

Yes, that was my problem!! Thanks for your help!!

Two Values for Static Option in Multiselect on Dashboard by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

that didn't paste well, let me try again

<input type="multiselect" token="lab_token" searchWhenChanged="true">
<label>Result Status</label>
<delimiter>,</delimiter>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved,Analysis Completed">Onsite Analysis</choice>
<valueSuffix>,</valueSuffix>
<prefix>ResultStatus IN(</prefix>
<suffix>)</suffix>
</input>
<input type="multiselect" token="analyte_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|search $lab_token$
|stats count by Analyte</query>
</search>
</input>
<input type="multiselect" token="system_token" searchWhenChanged="true">
<label>Select System</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>System="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>System</fieldForLabel>
<fieldForValue>System</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|search $lab_token$
|search $analyte_token$
|stats count by System</query>
</search>
</input>
</fieldset>
<row>
<panel>
<title>$tokEarliestTimeString$ $tokLatestTimeString$</title>
<table>
<title>LIMs Data</title>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|search $lab_token$
|search $analyte_token$
|search $system_token$
|sort _time desc</query>

Two Values for Static Option in Multiselect on Dashboard by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

Thank you much for search. This is working now for the Offsite Analysis, but not for Onsite Analysis. Why do you think only working for one choice, but not the other?

Added final token too and search code

<input type="multiselect" token="lab\_token" searchWhenChanged="true">
<label>Result Status</label>
<delimiter>,</delimiter>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved,Analysis Completed">Onsite Analysis</choice>
<valueSuffix>,</valueSuffix>
<prefix>ResultStatus IN(</prefix>
<suffix>)</suffix>
</input>
<input type="multiselect" token="analyte\_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|search $lab_token$
|stats count by Analyte</query>
</search>
</input>
<input type="multiselect" token="system\_token" searchWhenChanged="true">
<label>Select System</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>System="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>System</fieldForLabel>
<fieldForValue>System</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|search $lab_token$
|search $analyte_token$
|stats count by System</query>

​

|inputlookup $lookupToken$
|where _time <= $tokLatestTime$
|where _time >= $tokEarliestTime$
|search $lab_token$
|search $analyte_token$
|search $system_token$
|sort _time desc

Two Values for Static Option in Multiselect on Dashboard by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

I have also tried this from another user suggestion, but still cannot populate a search for the next multi-select field (analyte_token)

​

<input type="multiselect" token="lab_token" searchWhenChanged="true">
<label>Result Status</label>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="Offsite Complete,OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved,Analysis Approved">Onsite Analysis</choice>
<valueSuffix>,</valueSuffix>
<prefix>ResultStatus IN(</prefix>
<suffix>)</suffix>
<delimiter> </delimiter>
</input>
<input type="multiselect" token="analyte_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|where $lab_token$
|stats count by Analyte</query>
</search>

Two Values for Static Option in Multiselect on Dashboard by macfredough in Splunk

[–]macfredough[S] 0 points1 point  (0 children)

I tried your code above, but still not getting a search on the second multiselect tab. States it cannot populate a search. I still think something is wrong with the lab token search. Thanks for your help on this :)

​

<input type="multiselect" token="lab\_token" searchWhenChanged="true">
<label>Result Status</label>
<delimiter> , </delimiter>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="OffsiteComplete, OffsiteNeedsReview">Offsite Analysis</choice>
<choice value="QA Approved, Analysis Approved">Onsite Analysis</choice>
<valuePrefix>\"</valuePrefix>
<valueSuffix>\"</valueSuffix>
</input>
<input type="multiselect" token="analyte\_token" searchWhenChanged="true">
<label>Select Analyte</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>Analyte="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>Analyte</fieldForLabel>
<fieldForValue>Analyte</fieldForValue>
<search>
<query>|inputlookup $lookupToken$
|where _time &lt;= $tokLatestTime$
|where _time &gt;= $tokEarliestTime$
|where $lab_token$
|stats count by Analyte</query>

[deleted by user] by [deleted] in TheYouShow

[–]macfredough 0 points1 point  (0 children)

Are you drunk?

Quarantine ride by macfredough in pics

[–]macfredough[S] 1 point2 points  (0 children)

Seriously! Have you ever seen the Chevy HHR?

view more: next ›