All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Don't use wildcards or at least not for the -1 -2 -3 part - currently in your screenshot all the names are fixed
Thanks for responding but the solution given there is different use case. The query and tokens mentioned in the XML code are very confusing to understand. 
I tried creating a default app.conf file with the stanza: [install] state = disabled but it didn't disable the app. Then I removed the app from etc/apps altogether, but it came back. We run s... See more...
I tried creating a default app.conf file with the stanza: [install] state = disabled but it didn't disable the app. Then I removed the app from etc/apps altogether, but it came back. We run splunk as user "splunk" so then I removed the app and created a directory etc/apps/learned owned by root with permissions 500 (r-x------) so splunk couldn't recreate it.  That worked.
Hi @ITWhisperer  As CurrentWeek* is calculated dynamically , how can i put that field in the table command.  If i use the below table command , it shows me the result in the same order.  How can i... See more...
Hi @ITWhisperer  As CurrentWeek* is calculated dynamically , how can i put that field in the table command.  If i use the below table command , it shows me the result in the same order.  How can i reverse the order of the CurrentWeek columns ???  | table A B C DAY_OF_WEEK Start_Time CurrentWeek* Deviation  
Hi.   Thank you for your effort, I hope you find something.   Kind regards
Hello Team We have a usecase where we want to integrate cloudwatch metrics to AppDynamics. What could be the best suggested way here to proceed? Regards Gaurav
Based on this solution Solved: How do I add a textbox value to a multiselect inpu... - Splunk Community please try following xml: <form version="1.1"> <label>IP List dynamically added to multiselec... See more...
Based on this solution Solved: How do I add a textbox value to a multiselect inpu... - Splunk Community please try following xml: <form version="1.1"> <label>IP List dynamically added to multiselect based on textbox input</label> <fieldset submitButton="false" autoRun="true"> <input type="text" token="tkn_ip"> <label>Enter a IP (range)</label> </input> <input type="multiselect" token="iplist"> <label>IP List</label> <valuePrefix>clientip</valuePrefix> <delimiter> OR </delimiter> <fieldForLabel>field3</fieldForLabel> <fieldForValue>field3</fieldForValue> <search> <query>| makeresults | eval previplist="$form.iplist$" | eval newiplist="$tkn_ip$" | makemv delim="," previplist | makemv delim=" " newiplist | eval field3=mvappend(previplist,newiplist) | eval valcount= mvcount(field3) | eval field3=if(valcount&gt;1,mvfilter(NOT match(field3,"all")),field3) </query> <done> <condition match="$job.resultCount$&gt;0"> <eval token="form.iplist">case(isnotnull($result.field3$),$result.field3$)</eval> </condition> </done> <finalized> <condition match="$job.resultCount$&gt;0"> <unset token="tkn_ip"></unset> </condition> </finalized> </search> <choice value="=*">All</choice> <change> <eval token="form.iplist">if(mvcount('form.iplist')=0,"=*",if(mvcount('form.iplist')!=1,mvfilter('form.iplist'!="=*"),'form.iplist'))</eval> <unset token="form.tkn_ip"></unset> </change> <default>=*</default> <initialValue>=*</initialValue> </input> </fieldset> <row> <panel> <event> <search> <query>index=_internal $iplist$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>  
You could try changing the order of the text field and the check boxes. Alternatively, you might be able to apply some CSS to modify the width of the check box panel (although this might get a bit me... See more...
You could try changing the order of the text field and the check boxes. Alternatively, you might be able to apply some CSS to modify the width of the check box panel (although this might get a bit messy as Splunk Classic Dashboards have a habit of modifying the width of panels to optimise screen real-estate).
Thanks, i tried that it  works .    However,  it ends up looking this because as we are using 2 separate input types so there is a huge gap between the radiobox input and the Text box where user ente... See more...
Thanks, i tried that it  works .    However,  it ends up looking this because as we are using 2 separate input types so there is a huge gap between the radiobox input and the Text box where user enters the IP.  The classic dashboard doesn't let me shrink the size of these boxes .  Is there any way to merge/ bring them closer under one Title / Header - "Destination IP"  ?   Below is my code   <form version="1.1" theme="light"> <label>test</label> <fieldset submitButton="false"></fieldset> <row> <panel> <title>Destination IP</title> <input type="radio" token="condition" searchWhenChanged="true"> <label></label> <choice value="=">EQUAL</choice> <choice value="!=">NOT EQUAL</choice> <search> <query/> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>=</default> <initialValue>=</initialValue> </input> <input type="text" token="dest_ip" searchWhenChanged="true"> <label>dest_ip</label> <default></default> </input> <table> <title>dest_ip_graph</title> <search> <query>index=aws_vpc_flow_logs aws_account_id="*60036" dest_ip$condition$$dest_ip$ | stats count(vpcflow_action) as flowCount sum(packets) as pktCount sum(bytes) as sumBytes by aws_account_id instance_id src_ip src_port dest_ip dest_port action flow_direction interface_id vpc_id | eval pkt(million)=round((pktCount)/10000) | eval bytes(GB)=round((sumBytes)/1024/1024/1024) | iplocation src_ip | table aws_account_id instance_id src_ip src_port dest_ip dest_port action flow_direction interface_id vpc_id City Country flowCount pkt(million) bytes(GB) | sort - bytes(GB)</query> <earliest>-15m@m</earliest> <latest>now</latest> </search> </table> </panel> </row> </form>    
After a rolling restart of peer nodes one index is not fully searchable . It seems fixup status is pending  looks like buckets is not properly sync  .   need help to sort it out 
Keep your original text boxes so that the user can enter the ip address (range) but also have either a checkbox for the equal/not equal decision or a pair of radio buttons and use the token from this... See more...
Keep your original text boxes so that the user can enter the ip address (range) but also have either a checkbox for the equal/not equal decision or a pair of radio buttons and use the token from this choice to modify your search.
Another possibility is to use the sed mode of the rex command to replace the id part with a fixed value. This would rely on the id being formatted in an identifiable pattern. You may need to work wit... See more...
Another possibility is to use the sed mode of the rex command to replace the id part with a fixed value. This would rely on the id being formatted in an identifiable pattern. You may need to work with your application designers to ensure that all ids follow a particular pattern or patterns otherwise you may end up having more rex commands to replace different formats of ids.
Hi New to Splunk On-Call , I have setup a new Team with 3 members, and I've created a rotation and shift with all three as members. I'm stuck with the best way to setup the Escalation Policy, I wan... See more...
Hi New to Splunk On-Call , I have setup a new Team with 3 members, and I've created a rotation and shift with all three as members. I'm stuck with the best way to setup the Escalation Policy, I want it to call the initial person on call and then contact the other two in turn if they don't respond e.g. Contact Member 1 Wait 10mins Contact Member 2 Wait 10mins Contact Member 3   They way I have it at the moment is having three steps in the Escalation Policy: Step 1 - Immediate - Notify the On-Duty user(s) in rotation Step 2 - Wait 10 mins - Notify the next user(s) in the current on-duty shift Step 2 - Wait 20 mins - Notify the next user(s) in the current on-duty shift   Is this the best way to do it, the text "Notify the On-Duty user(s) in rotation" has confused me as it suggests that it should call multiple members in a rotation, but I can't find anything that describes how it calls more then the initial on-call person?
@ITWhisperer  Based on the response i changed my query to below. index=stuff "kubernetes.labels.app"="some-stuff" | search "log.msg"="Response" "log.level"=30 "log.response.statusCode"=200 | spath ... See more...
@ITWhisperer  Based on the response i changed my query to below. index=stuff "kubernetes.labels.app"="some-stuff" | search "log.msg"="Response" "log.level"=30 "log.response.statusCode"=200 | spath "log.request.path"| rename "log.request.path" as url| eval url=if(mvindex(split(url,"/"),4)="namespace","/attribute/namespace/{id}",url) | eval url=if(mvindex(split(url,"/"),2)="schema","/spec-api/schema/{id}",url)| convert timeformat="%Y/%m/%d" ctime(_time) as date | stats min("log.context.duration") as RT_fastest max("log.context.duration") as RT_slowest p95("log.context.duration") as RT_p95 p99("log.context.duration") as RT_p99 avg("log.context.duration") as RT_avg count(url) as Total_Req by url | sort Total_Req desc   If you see, i had to write the eval twice for two different end points. But as my application grows, there may come different API's(endpoints) with the same patterns. And i would have to write the eval for each one of them.  So, I was thinking is there a more generic way to group these types of API's into one rather than writing the eval again and again. I was looking into the "cluster" query, but was not able to get anything out of it. 
Just append a table command listing the fields in the order you want them
@ITWhisperer  : Thanks It worked. You are best Just a small correction related to the order of columns. Is it possible to have currentweek-4 column first, then currentweek-3 , then currentweek... See more...
@ITWhisperer  : Thanks It worked. You are best Just a small correction related to the order of columns. Is it possible to have currentweek-4 column first, then currentweek-3 , then currentweek-2  , then currentweek-1 and , currentweek in the end before Deviation.     
Hi ,   I want to ask community how you do health check of servers after patching? Is there any automation you have build in order to identify if server health check is good after patching activity ... See more...
Hi ,   I want to ask community how you do health check of servers after patching? Is there any automation you have build in order to identify if server health check is good after patching activity for multiple server in one shot? Using any tool to identify or any query build up or  any dashboard to enter the server details and get stats?
| stats count as Total by field1 field2 field3 Day Time Week | eventstats max(Week) as ThisWeek | eval Week=if(Week=ThisWeek,"CurrentWeek","CurrentWeek".(Week-ThisWeek)) | eval {Week} = Total | stats... See more...
| stats count as Total by field1 field2 field3 Day Time Week | eventstats max(Week) as ThisWeek | eval Week=if(Week=ThisWeek,"CurrentWeek","CurrentWeek".(Week-ThisWeek)) | eval {Week} = Total | stats values(Current*) as Current* by field1 field2 field3 Day Time | fillnull value=0 | eval Deviation=2*CurrentWeek/('CurrentWeek-2'+'CurrentWeek-1')
Hi Oscar Wanted to check if this "Health Rule Name:  ${event.healthRule.name}" works with HTTP template also?
Hi @ITWhisperer  Can you please let me how can I correct the below stats command to re-evaluate Week after the stats command to be current week, current week -1 and current week -2.  | stats coun... See more...
Hi @ITWhisperer  Can you please let me how can I correct the below stats command to re-evaluate Week after the stats command to be current week, current week -1 and current week -2.  | stats count as Total by field1 field2 field3 Day Time Week | eval Week_{Week} = Total | stats values(Week_*) as Week_* by field1 field2 field3 Day Time | fillnull value=0 | eval Deviation=2*Week_41/(Week_39+Week_40)