When I type this search query in splunk search head:
index=main sourcetype=mySrcType | top fieldA fieldB
Splunk automatically adds count column to the resulting table. Now, what is this count? is it a simple sum of each field count?
The count is showing you the number of times thatt field value pair show up in the time range and query you ran. If you want to exclude it, you can add
| fields - count
Top counts the most common 10 values of each of the fields you list after it's command
You can read more about it on its documentation page
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top
Related
I am trying to figure out how to limit the number of times an ID can be selected.
I have a list of mentors, some who can be selected 1 time and others who can be selected 2 times. I am using a button that performs a Set Field script. When the button is clicked the ID value is copied to another list. It remains in the original list but also is shown in another. I want to say something like:
If field "mentor count" = 2 then You can select 2 times, else you can select 1 time.
I have no idea how to go about it.
Do you have any suggestions please?
There are a total of 3 lists. One is mentors, 1 is students and the other is both. The user selects a mentor and student to match up. Each row in this table is a new match.
I tried conditional action which failed. I am thinking I will need a script.
In the Microsoft SSAS, I have a dimension column that contains multiple values separated by the special character | in a single row as below.
Example value of a row: Image|Video|Audio|
Requirement:
So, I need to count the number of values present in the dimension column using the special character.
In this case, I need to get the count of | using the MDX query and my expected answer is 3.
Could someone help me with this? In short, Is there an MDX function that counts the number of times a particular character appears in a string?
Similar question for SQL: Number of times a particular character appears in a string
I have 4 columns:
URL | keywords | Volume (of keyword) | Position (of Keyword)
is there a way I can pull the max(volume) for the URL? I also want to pull in keyword and position column, but I have multiple values per URL, so when I add the other columns I get back more data than I want.
Not clear on the question ,if you mean that you need maximum volume for a given url while retaining the other columns ,here is the code :
Select url,keywords,position,(select max(volume) from your_table t1 where t1.url=t.url)
From your_table t
I have a list of 1000 records, and I shown there 1000 records on page load using display tag.
I enabled sorting on some columns, and when I click on the table header to sort, display tag is making a database call and loading all 1000 records again.
How can we restrict to make database calls on sorting for display tag?
Because, we have loaded all the 1000 records, so could we make use of those list without loading the records again?
You are missing a fundamental: Pagination.
You should not load 1000 records at once; load 10 records at once instead (assuming 10 records is what you show in a page), and load the other 10 when changing page / sorting.
Filter them directly in the query (if you are using queries), for example, selecting page 3 (results from 21 to 30) in a query to a minimal "person table", ordered by name, would result it the following SQL:
Oracle
SELECT id, name, age
FROM ( SELECT id, name, age
FROM table_person
ORDER BY name )
WHERE ROWNUM BETWEEN 21 and 30
PostgreSQL
SELECT id, name, age
FROM table_person
ORDER BY name
LIMIT 10
OFFSET 20
and so on.
Be sure to read the documentation related to your database, and simply use query parameters to specify order by, starting row and ending row values.
you can use setFirstResults(), setMaxResults(),instead unnecessarily load all 1000 records.
divde per page max result shown 10 records only, and setFirstResult is restricted records first 5 from your records list.
Criteria cr= database_session.createCriteria(Records.class);
cr.addOrder(Order.desc("Recordsdate"));
cr.setFirstResult(5);
cr.setMaxResults(10);
all_records_list = (List<Records>) cr.list();
I am creating a report using MS Report Builder 3.0. For this report, I have a stored procedure built that filters down to the specific rows needed, and then I use a row group to group on a particular field (pass_no). The table that is displayed is 2 columns and 3 rows within the row group. The basic description of what I want to accomplish is instead of the rows running onto the next page, I want the rows to continue on the same page in a new set of 2 columns. Think of it like a newspaper where the text continues in a new column rather than running down onto the next page.
For the example I'm going to use here, there are 12 rows of data returned by the SP, and 8 unique values in the pass_no column which is what my row group is grouped on. So in the report I end up with 8 groups of 3 rows. I'm aiming to have the table display 6 pass_no values (so 6 groups of 3 rows) before, for lack of better terminology, starting a new table.
My first approach at this has been to create a column group and set the grouping expression to the following:
=Floor((RowNumber(Nothing) - 1) / 6)
While this works in creating a new set of 2 columns, the split for the new columns is based on the row number from the raw data returned by the SP rather than the number of rows sets created by the row group. So because there are 12 rows returned, and the 6th and 7th rows have the same pass_no value, the second set of columns duplicates that 1 set of data. Also, the top 6 rows of the second column set are blank with the second set of values appearing below the first set.
If I add an additional column group where it is also grouping by pass_no, then I don't get the duplicate values, but I do get a pair of columns for each pass_no as well (as would be expected). I've tried modifying the expression above a bit and changed Nothing to the row group name and have tried the table name, but neither of them have yielded the desired result.
I can't alter the SP to do the grouping there because there are other column values that are not identical and I pull that data into a cell value expression within the table using Join(LookupSet()).
I have also considered creating 2 tables and applying a filter to the table so the first table only displays the first 6 results and the second table displays the remaining results, but that also looks at the raw data rather than the groupings and TOP N can't be used on pass_no as it's a text value, not an integer. This would also cause problems if I need to go to 3 tables.
So long story short, is there a way to do a table break rather than a page break or to overflow columns onto the same page rather than onto a new page?
Here's the pertinent portions of the Dataset:
http://sqlfiddle.com/#!2/5082b/1
PASS_NO MASTERTRAN TRANS_NO DESCRIPTION IS_MOD
7913019000 4931019000 4931019000 General Admission Adult 0
7914019000 4932019000 4932019000 Sea Turtle Hosp Adult 0
7914019000 4932019000 4933019000 2:00 PM SEA TURTLE HOSP 1
7916019000 4934019000 4934019000 Sea Turtle Hosp Child 0
7916019000 4934019000 4935019000 2:00 PM SEA TURTLE HOSP 1
7917019000 4934019000 4934019000 Sea Turtle Hosp Child 0
7917019000 4934019000 4935019000 2:00 PM SEA TURTLE HOSP 1
7918019000 4934019000 4934019000 Sea Turtle Hosp Child 0
7918019000 4934019000 4935019000 2:00 PM SEA TURTLE HOSP 1
7922019000 4936019000 4936019000 General Admission Child 0
7923019000 4936019000 4936019000 General Admission Child 0
7924019000 4936019000 4936019000 General Admission Child 0
I think your data presents a bit of a problem.
As you've already figured out, typically for this sort of setup you'd set up a row group with an expression like:
=(RowNumber(Nothing) - 1) Mod 6
And a column group expression like:
=Ceiling(RowNumber(Nothing) / 6)
This would create a six row tablix that would grow horizontally as required.
See this SO question for a similar example.
However, you currently have the requirement of also grouping by another column - pass_no in your case. Normally you can approximate a group-level row number with an expression like:
=RunningValue(Fields!pass_no.Value, CountDistinct, "DataSet1")
Unfortunately, when you try to add this into one of the grouping expressions like:
=Ceiling(RunningValue(Fields!pass_no.Value, CountDistinct, "DataSet1") / 6)
You get the following error:
A group expression for the tablix 'Tablix1' includes the aggregate
function RunningValue. RunningValue cannot be used in group
expressions.
Based on all this, my recommendation is to try and get a Dataset that has one row per pass_no value and base the tablix on this, with the above row/column grouping expressions, i.e. no need to group on multiple pass_no rows. So in your example it would have eight rows. You could then have a separate Dataset with all the individual rows and use a lookupset function to concatenate the description, etc.
Your other option is to try and get everything on one Dataset only, including the aggregates as required. This might not be possible, but for description at least you can leverage any of the various techniques here to get a delimited list. Once you have this list you can replace the delimiter with vbCrLf to split it back over multiple rows.
All this is a very long-winded way of saying that I don't know if your requirement is possible with your data, but if you look at having at least one Dataset with one row per pass_no you should be able to make it work.