Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
02-01-2024
03:05 PM
Hi @ITWhisperer Sorry must have forgotten to ask the question lol Is there a way to make the dashboard react to the scenario below? I have 3 panels for dropdown menu. if A is selected p...
See more...
Hi @ITWhisperer Sorry must have forgotten to ask the question lol Is there a way to make the dashboard react to the scenario below? I have 3 panels for dropdown menu. if A is selected panel 1 shows Search A panel 2 shows Title and the link to URL panel 3 shows Another Search of its own (if "drop down" is selected A) if B is selected Panel 1 shows Search B Panel 2 Disappear Panel 3 Disappear if C is selected Panel 1 shows Search C Panel 2 Disappear Panel 3 Disappear if D is selected Panel 1 shows Search D Panel 2 Disappear Panel 3 Disappear This is what I have so far that doesn't seem to work as expected
<input type="dropdown" token="tokenSearchOption1" searchWhenChanged="true">
<label>Sources</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
<choice value="C">C</choice>
<choice value="D">D</choice>
<change>
<condition value="A">
<set token="tokenSearchQuery"> index= search query A</set>
</condition>
<condition value="B">
<set token="tokenSearchQuery">index= search query B</set>
</condition>
<condition value="C">
<set token="tokenSearchQuery">index=search query C</set>
</condition>
<condition value="D">
<set token="tokenSearchQuery">index= search query D</set>
</condition>
</change>
<initialValue>"A"</initialValue>
</input>
</panel>
</row>
<row>
<panel id="URL test">
<title>Title URL</title>
<html>
<!-- <style>
.dashboard-row Title .dashboard-panel h2.panel-title {
font-size: 40px !important;
text-align:left;
font-weight:bold;
}
</style>-->
<center> <style>.btn-primary { margin: 5px 10px 5px 0;font-size: 40px !important; }</style>
<a href="URL for a website" target="blank" class="btn btn-primary"> Click here </a>
</center>
</html>
</panel>
</row>
<row>
<panel depends=dropdown A>
<title>Magic</title>
<table>
<search>
<query>Index=Run this search when drop down A </query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="wrap">false</option>
</table>
</panel>
02-01-2024
02:58 PM
Is there a way to allow Splunk to refresh and review the new file everytime?
02-01-2024
02:48 PM
Get your list of unique hosts, append your list of unique hosts from the lookup file twice, use stats to count by host, where the count is only 1, the host is not in the lookup file, where it is 2 it...
See more...
Get your list of unique hosts, append your list of unique hosts from the lookup file twice, use stats to count by host, where the count is only 1, the host is not in the lookup file, where it is 2 it is only in the lookup file, where it is 3, it is in both the searched events and the lookup file.
02-01-2024
02:44 PM
Is there a question here?
02-01-2024
02:40 PM
1 Karma
Using addinfo gets the time from the time-picker i.e. the global time-picker in this instance, as a epoch time rather than what was selected, for example, if you chose last 5 minutes, the token would...
See more...
Using addinfo gets the time from the time-picker i.e. the global time-picker in this instance, as a epoch time rather than what was selected, for example, if you chose last 5 minutes, the token would have "now" as the value for $global.latest$ rather than the epoch time equivalent for the current time. If you want to use bold and other decorations, you might consider markup panels. and you might be able to use token values here.
02-01-2024
02:24 PM
The goal is to fire off an alert if there is a lag in metrics for a given index. I can calculate this for each "app" which is reporting metrics: | mstats latest_time(application_ready_time.value) as...
See more...
The goal is to fire off an alert if there is a lag in metrics for a given index. I can calculate this for each "app" which is reporting metrics: | mstats latest_time(application_ready_time.value) as latest_ts where index=my-metrics-index host=some-host by app.name | eval past_threshold=if(now() - latest_ts >= 30, "Y", "N") | eval latest=strftime(latest_ts, "%Y-%m-%d %H:%M:%S") | table app.name latest past_threshold x This works, but next I would like to limit the results to only certain values of `app.name`. For instance, only return a result where `in(app.name, "app1", "app2")` and where `past_threshold="Y"`. In that case, we've detected that the "important" apps have lagged in metric reporting and can trigger an alert. I assume I need to use a subsearch but I could not get it to work / I'm not sure on the proper formatting. Thank you.
02-01-2024
01:49 PM
I have 3 panels for dropdown menu. if A is selected panel 1 shows Search A panel 2 shows Title and the link to URL panel 3 shows Another Search of its own (if "drop down" is selected A) if ...
See more...
I have 3 panels for dropdown menu. if A is selected panel 1 shows Search A panel 2 shows Title and the link to URL panel 3 shows Another Search of its own (if "drop down" is selected A) if B is selected Panel 1 shows Search B Panel 2 Disappear Panel 3 Disappear if C is selected Panel 1 shows Search C Panel 2 Disappear Panel 3 Disappear if D is selected Panel 1 shows Search D Panel 2 Disappear Panel 3 Disappear <input type="dropdown" token="tokenSearchOption1" searchWhenChanged="true">
<label>Sources</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
<choice value="C">C</choice>
<choice value="D">D</choice>
<change>
<condition value="A">
<set token="tokenSearchQuery"> index= search query A</set>
</condition>
<condition value="B">
<set token="tokenSearchQuery">index= search query B</set>
</condition>
<condition value="C">
<set token="tokenSearchQuery">index=search query C</set>
</condition>
<condition value="D">
<set token="tokenSearchQuery">index= search query D</set>
</condition>
</change>
<initialValue>"A"</initialValue>
</input>
</panel>
</row>
<row>
<panel id="URL test">
<title>Title URL</title>
<html>
<!-- <style>
.dashboard-row Title .dashboard-panel h2.panel-title {
font-size: 40px !important;
text-align:left;
font-weight:bold;
}
</style>-->
<center> <style>.btn-primary { margin: 5px 10px 5px 0;font-size: 40px !important; }</style>
<a href="URL for a website" target="blank" class="btn btn-primary"> Click here </a>
</center>
</html>
</panel>
</row>
<row>
<panel depends=dropdown A>
<title>Magic</title>
<table>
<search>
<query>Index=Run this search when drop down A </query>
<earliest>$tokTime.earliest$</earliest>
<latest>$tokTime.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="wrap">false</option>
</table>
</panel>
Labels
- Labels:
-
panel
02-01-2024
01:44 PM
Hello, I changed the code to below to show "From and To" in the sample report below 1) Is there a way to change "From" and "To" as Bold font, and leave the rest as regular font 2) Is it possible...
See more...
Hello, I changed the code to below to show "From and To" in the sample report below 1) Is there a way to change "From" and "To" as Bold font, and leave the rest as regular font 2) Is it possible to just put the time token ($time.earliest) literally next to From in the dashboard? 3) Does addinfo obtain the data from makeresult, so I don't need to use index and have multiple rows of info_min_time? Thank you for your help | makeresults
| fields - _time
| addinfo
| rename info_min_time as earliest
| rename info_max_time as latest
| fieldformat earliest="From: " . strftime(earliest,"%b %d %Y %H:%M:%S")
| fieldformat latest="To: ". strftime(latest,"%b %d %Y %H:%M:%S")
| table earliest latest {
"visualizations": {
"viz_1putkd4H": {
"type": "splunk.table",
"options": {
"headerVisibility": "none",
"backgroundColor": "transparent",
"tableFormat": {
"rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",
"headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",
"rowColors": "> rowBackgroundColors | maxContrast(tableRowColorMaxContrast)",
"headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"
}
},
"dataSources": {
"primary": "ds_P8DuhImO"
}
},
"viz_JKbWkEG0": {
"type": "splunk.markdown",
"options": {
"markdown": ""
}
},
"viz_c9htuqvf": {
"type": "splunk.markdown",
"options": {
"markdown": "# Sample Report"
}
},
"viz_lxib04FT": {
"type": "splunk.rectangle"
},
"viz_Ba02NPRN": {
"type": "splunk.rectangle",
"options": {
"fillColor": "#ffffff"
}
}
},
"dataSources": {
"ds_P8DuhImO": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| fields - _time\n| addinfo\n| rename info_min_time as earliest\n| rename info_max_time as latest\n| fieldformat earliest=\"From: \" . strftime(earliest,\"%b %d %Y %H:%M:%S\")\n| fieldformat latest=\"To: \". strftime(latest,\"%b %d %Y %H:%M:%S\")\n| table earliest latest"
},
"name": "time_selected"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "absolute",
"options": {
"display": "auto-scale",
"height": 1200
},
"structure": [
{
"item": "viz_JKbWkEG0",
"type": "block",
"position": {
"x": 170,
"y": 110,
"w": 300,
"h": 300
}
},
{
"item": "viz_lxib04FT",
"type": "block",
"position": {
"x": 10,
"y": 0,
"w": 1190,
"h": 70
}
},
{
"item": "viz_c9htuqvf",
"type": "block",
"position": {
"x": 520,
"y": 20,
"w": 290,
"h": 50
}
},
{
"item": "viz_Ba02NPRN",
"type": "block",
"position": {
"x": 10,
"y": 70,
"w": 1190,
"h": 40
}
},
{
"item": "viz_1putkd4H",
"type": "block",
"position": {
"x": 320,
"y": 70,
"w": 620,
"h": 60
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "",
"title": "studio times"
}
02-01-2024
01:35 PM
I am installing a new Splunk server on Windows using the trial subscription for now, which may be changed to the free license later. I have data from another Splunk for Windows server that I would...
See more...
I am installing a new Splunk server on Windows using the trial subscription for now, which may be changed to the free license later. I have data from another Splunk for Windows server that I would like to restore to the new instance. What is the process for doing that? Thanks, Leo
Labels
- Labels:
-
Windows
02-01-2024
01:22 PM
Hi All,
I am trying to get ratings and reviews information of an app in Google play store into splunk using website input app. Unlike in apple playstore, I am unable to identify the CSS selec...
See more...
Hi All,
I am trying to get ratings and reviews information of an app in Google play store into splunk using website input app. Unlike in apple playstore, I am unable to identify the CSS selector for the values of reviews and ratings.
Could someone please help. TIA
Nithin
02-01-2024
12:50 PM
I need to find new added hosts using lookup files. The solutions in blog didn't work for me. I will create a lookup file with all my hosts. ( I did) If any new host will be added , it will be disp...
See more...
I need to find new added hosts using lookup files. The solutions in blog didn't work for me. I will create a lookup file with all my hosts. ( I did) If any new host will be added , it will be displayed. Any help will be appreciated.
Labels
- Labels:
-
lookup
02-01-2024
11:51 AM
Hi @Richfez Yes, I have tried using the '-dedup' option with the value set to 'true' in the fill_summary_index.py script. I've been using the following command for the fill_summary_index.py scri...
See more...
Hi @Richfez Yes, I have tried using the '-dedup' option with the value set to 'true' in the fill_summary_index.py script. I've been using the following command for the fill_summary_index.py script: ./splunk cmd python fill_summary_index.py -app search -name "test report" -et -24h@h -lt now -index raindex -dedup true -auth admin:password I carefully reviewed the documentation and the script before testing, but I couldn't find a solution. If there are any specific parameters or configurations that I might be missing, please guide me on how to use them effectively for preventing duplicate data injection. Your assistance is much appreciated.
02-01-2024
11:25 AM
Thank you.
02-01-2024
11:16 AM
1 Karma
No. Splunk distribution does not include redis. Just as it doesn't include Apache httpd. Just because there are several processes on your box running with the same user that is used to run Splunk doe...
See more...
No. Splunk distribution does not include redis. Just as it doesn't include Apache httpd. Just because there are several processes on your box running with the same user that is used to run Splunk doesn't necessarily mean they are one software package. Your listing shows that indeed splunk user is used to run several pieces of software but they are independent of Splunk and you should rather ask the person who deployed your server what is going on there (typically you don't use other stuff as splun user so it's a relatively unusual situation).
02-01-2024
11:12 AM
Ok, now I think I understand. (I had 5 consecutive nights of less than 4 hours of sleep so I'm not my best self :)). Honestly, your main problem is that you have structured data and try to approach ...
See more...
Ok, now I think I understand. (I had 5 consecutive nights of less than 4 hours of sleep so I'm not my best self :)). Honestly, your main problem is that you have structured data and try to approach it with simple text extractions. What will happen if you get a quote inside one of those fields? I'd do a completely different thing - mvexpand the mvfield, throw spath on it, then collect the resulting fields into a new field and be done with it (if needed, recombine the results back to mvfields). But if you insist on doing the regexes, don't do it all in one pass. Do one mvmap with replace to "clean up" your data, then extract the fields to your cpe record in another mvmap pass. BTW, why don't you use normal symbols, but those escape codes? It's confusing
02-01-2024
10:49 AM
It’s not restarting Splunkd, it just reload deployment server DS related configurations. For that reason it’s much faster than restarting splunkd.
OK, the Total_Delivered is defined via labelfield added to addtotalcols command. So if we run | appendpipe [| stats sum(File_Count) by Total_Delivered] without addtotalcols labelfield, then st...
See more...
OK, the Total_Delivered is defined via labelfield added to addtotalcols command. So if we run | appendpipe [| stats sum(File_Count) by Total_Delivered] without addtotalcols labelfield, then stats by from the above will not make any difference. And if I run it as |addcoltotals labelfield="Total_Delivered"|appendpipe [| stats sum(File_Count) as TFC by Total_Delivered] the output is as below Files | Files_Count | Total_Delivered | TFC| Total_Delivered F1 | 3 | | | F2 | 5 | | | F3 | 3 | | |Total | 11 | Total | 11| Total Are we expecting the above output please, altho' the view is NOT great, we can use TFC as token in subject to state the value I believe?
02-01-2024
10:15 AM
When you run the search manually, does it detect any Critical events? If not, then the alert won't trigger. Debug the query one pipe at a time to see where it fails to detect the desired events. D...
See more...
When you run the search manually, does it detect any Critical events? If not, then the alert won't trigger. Debug the query one pipe at a time to see where it fails to detect the desired events. Does the alert write to the Triggering Alerts dashboard? If so, are you seeing anything there? Is it possible all of the detected events have an ID that were previously reported and are now throttled?
02-01-2024
10:08 AM
I'm assuming the redis is packaged with your product. Here is the process we run. The splunk id could've been anything. However, the team that manages splunk platform in VZW also uses id splunk to id...
See more...
I'm assuming the redis is packaged with your product. Here is the process we run. The splunk id could've been anything. However, the team that manages splunk platform in VZW also uses id splunk to identity original source software. I talked to the splunk team in VZW and he directed me to here. 1. Do you have redis included in one of the splunk products. If yes, please show us how to set the password in one of the clients that connects to redis. splunk 3839 1 0 Dec05 ? 00:31:12 splunkd -p 8089 start
splunk 3845 3839 0 Dec05 ? 00:00:00 [splunkd pid=3839] splunkd -p 8089 start [process-runner]
splunk 24625 24266 0 Dec06 pts/5 00:00:26 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 24631 24266 0 Dec06 pts/5 00:08:20 php k2_serverDaemon.php
splunk 24637 24266 0 Dec06 pts/5 00:04:48 php k2_serverMonitor.php
splunk 24643 24266 0 Dec06 pts/5 00:28:43 redis-server *:6379
splunk 24666 24625 0 Dec06 pts/5 00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 24667 24625 0 Dec06 pts/5 00:00:02 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 24668 24625 0 Dec06 pts/5 00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 24669 24625 0 Dec06 pts/5 00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 24670 24625 0 Dec06 pts/5 00:00:02 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 26301 24625 0 Dec07 pts/5 00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 26825 24625 0 Dec07 pts/5 00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 46601 24625 0 Dec07 pts/5 00:00:02 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk 52124 24625 0 Dec07 pts/5 00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
02-01-2024
09:57 AM
1 Karma
Having issues with fetching investigations in incident review. Investigation is added for the alert but when accessing the alert I get the error "There was an error fetching related investigations...
See more...
Having issues with fetching investigations in incident review. Investigation is added for the alert but when accessing the alert I get the error "There was an error fetching related investigations" under related investigations. My assumption is that it is a permissions issue since admins are able to view it with no problems. However it appears that all the permissions that are needed are in place. Any help is greatly appreciated. Follow up question - Is there a way to auto add notables to investigations that share the same artifacts?
Labels
