A user would like to click on the down arrow to the left of an event and leave a comment. I think I have seen this demoed in ESS. Is there a simple way to implement it?
I don't know anything about the ESS app myself, but I think you may find the following discussions helpful:
A possible "hack" for annotating transactions (used in combination with the methods described in the above links):
... | transaction your-txn-options mvlist="splunk_server,index,_cd" | eval splunk_server=mvindex(splunk_server,0) | eval index=mvindex(index,0) | eval _cd=mvindex(_cd,0) | lookup mylookup splunk_server index _cd OUTPUT my_txn_note
This trick will only work if your transaction
command is guaranteed to always have the exact same first event.
I don't know anything about the ESS app myself, but I think you may find the following discussions helpful:
A possible "hack" for annotating transactions (used in combination with the methods described in the above links):
... | transaction your-txn-options mvlist="splunk_server,index,_cd" | eval splunk_server=mvindex(splunk_server,0) | eval index=mvindex(index,0) | eval _cd=mvindex(_cd,0) | lookup mylookup splunk_server index _cd OUTPUT my_txn_note
This trick will only work if your transaction
command is guaranteed to always have the exact same first event.
You could use a concatencation of the _cd values as your key if you must, and split it to get your items back. It should be available via eval f=mvjoin(_cd,";")
for example.
Yeah. It sounds like the ability to annotate events (or transactions, in your specific case) is on the radar, but making splunk aware of your specific use case with an ER is certainly good idea. In the mean time, if your transaction events always start with the same event, you could do some filtering to make sure you always just select the first _cd
value. It's kind of a hack, but the whole thing is a hack anyways...
Thanks for the links Lowell, unfortunately I don't think they will work for me since I'm using the "transaction" operator (which will have multiple _cd values).
What I'm doing is running a search that looks at all the commands logged by a user on a networking device and puts them into a single transaction. The user then needs to put an explanation and a ticket number to go along with the transaction. I'll open an enhancement request.