All Topics

elizabethl_splu · ‎01-28-2022

Looking to get started with Dashboard Studio? Learn more with these great resources: Demo - See an example of the power of Dashboard Studio! Tech Talk - Watch this to get a great 20 minute intro...

Looking to get started with Dashboard Studio? Learn more with these great resources: Demo - See an example of the power of Dashboard Studio! Tech Talk - Watch this to get a great 20 minute introduction Blogs - Read more about our newest features Conf21 Breakout Session - Learn how you can reimagine your data visualizations Conf22 Breakout Session - Learn how to level up your dashboards with interactivity Conf23 Breakout Session - Learn how to rebuild Classic (SimpleXML) dashboards in Dashboard Studio Documentation - Find more details! EDU Courses - Two courses are available for learning the basics, as well as more advanced editing Tutorial - Try it out yourself with this step-by-step guide to create this dashboard: Dashboard Studio tutorial dashboard See more examples in the in-product Examples Hub!

SRI247 · ‎01-28-2022

Hi I'm a huge noob with respect to SPLUNK I have to create a update, create, delete and get details of saved searches. create - post with this url is working with name= abc https://<host>:<mPort...

Hi I'm a huge noob with respect to SPLUNK I have to create a update, create, delete and get details of saved searches. create - post with this url is working with name= abc https://<host>:<mPort>/services/saved/searches get detais - with this url is working with name= abc https://<host>:<mPort>/services/saved/searches/{name} update - not working: getting an error as "<msg type="ERROR">Could not find object id=abc</msg>" https://<host>:<mPort>/services/saved/searches/{name} delete- not working: getting an error as "<msg type="ERROR">Could not find object id=abc</msg>" https://<host>:<mPort>/services/saved/searches/{name}

pwu_splunk · ‎01-28-2022

I'm trying to address the new "check_for_vulnerable_javascript_library_usage" check in AppInspect as it's required for apps to run in Splunk Cloud after February. However, I get results like: 3rd p...

I'm trying to address the new "check_for_vulnerable_javascript_library_usage" check in AppInspect as it's required for apps to run in Splunk Cloud after February. However, I get results like: 3rd party CORS request may execute parseHTML() executes scripts in event handlers jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Regex in its jQuery.htmlPrefilter sometimes may introduce XSS Regex in its jQuery.htmlPrefilter sometimes may introduce XSS which doesn't really tell me how to proceed. Is there a way I can figure out what's actually causing these errors?

Vin · ‎01-28-2022

I need to write a Splunk alert to check number of connections on a server. Using below Linux command I can get the results on the server. But help me out in creating an alert on Splunk with the comma...

I need to write a Splunk alert to check number of connections on a server. Using below Linux command I can get the results on the server. But help me out in creating an alert on Splunk with the command. ps -ef | grep '[s]shd' | grep -v ^root | grep -i file* | wc -l

sohailmohammed · ‎01-28-2022

Hello there, I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 30...

Hello there, I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?

bmer · ‎01-28-2022

Hi, Iam a newbie and have just started exploring the power of splunk. My below query works fine except that I need the output ONLY for a specific time period ie 2pm and 4pm with a span of 15m and no...

Hi, Iam a newbie and have just started exploring the power of splunk. My below query works fine except that I need the output ONLY for a specific time period ie 2pm and 4pm with a span of 15m and not for entire day index=xxxx pod=xxxx CASE(xxxxx) `logRecordType(xxxx)` logName="xxxxxx" earliest=-3d@d latest=@d|timechart span=30m count|timewrap d So basically my output only list me 4 rows with "2days_before","1day_before" and "latest_day".A Thanks, Bhaggs

jamieflowers198 · ‎01-28-2022

I have 3 CSV files. The 1st holds one item/column of data I need. The 2nd holds several items related to the 1st and I only need that column related to file #1. The 3rd goes deeper and needs to be re...

I have 3 CSV files. The 1st holds one item/column of data I need. The 2nd holds several items related to the 1st and I only need that column related to file #1. The 3rd goes deeper and needs to be related to each item in file #2. IE: Data1 Data2 Data3 Data3 Data2 Data3 Data3 Data3 Anyone have any ideas? If I can't find a way to do this with a search I'll be stuck with a lot of copy/paste manual work.

tzacha123 · ‎01-28-2022

Hello, Trying to align a checkbox input to the top by removing the label on top. Even if i leave the label tag empty, it takes up space (&nbsp). This css does not seem to work. Would appre...

Hello, Trying to align a checkbox input to the top by removing the label on top. Even if i leave the label tag empty, it takes up space (&nbsp). This css does not seem to work. Would appreciate any suggestions. div[id^="showSummary"] >label { display:none !important; } Below is the complete xml source. <form hideChrome="true" hideSplunkBar="true" hideAppBar="true" hideEdit="false" hideTitle="false" theme="dark"> <label>Checkbox test</label> <fieldset submitButton="false" autoRun="true"></fieldset> <row> <panel id="viewDetail"> <input type="checkbox" id="showSummary" token="show_summary" searchWhenChanged="true"> <label>x</label> <choice value="summary">Summary</choice> </input> </panel> </row> <row depends="$alwaysHideCSSStyle$"> <panel> <html> <style> div[id^="showSummary"] >label { display:none !important; } </style> </html> </panel> </row> </form>

BrendanCO · ‎01-28-2022

Hi all! I've always had a pretty straight forward approach to bringing in my Palo logs straight to an on-prem Search Head / Indexer just via port 514 / syslog. That's a pretty straight forward setup....

Hi all! I've always had a pretty straight forward approach to bringing in my Palo logs straight to an on-prem Search Head / Indexer just via port 514 / syslog. That's a pretty straight forward setup. I'm trying to set up the more recommended way, now that my Splunk Search Head / Indexer is hosted at AWS. SO, I set up a Universal Forwarder on an Ubuntu Server on the same network as my Panorama instance and am sending the Panorama syslog feed to the UF - running syslog-ng. I see those log files coming in and saving to /var/log/udp514.log. I set up the UF to connect as a forwarder to the Splunk instance on port 9997 and have added /var/log/514.log to be monitored via "./splunk/add monitor /var/log/udp514.log". I see that logging on the UF and then coming in to Splunk, but it is all logging to the main index. Logically I know that either on the UF or on the Splunk indexer I need to use the PA app to tell it to log to my paloalto index, but I don't know where. I can't seem to add a data input to also listen on 9997. That seems to be a conflict and my normal method of looking for logs on port 514 doesn't apply anymore... So how do I tell my Splunk indexer to look at the stream coming in on 9997 and move the logs associated with Palo Alto over where the app is looking for it (index=paloalto)? I'll also be logging much more to the UF soon as well...

Daniel_Barbeir1 · ‎01-28-2022

Hi, This is not quite an unusual issue: I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-ho...

Hi, This is not quite an unusual issue: I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-hours. The idea would be to have that query run so I could ADQL query metrics for (for example) end-user response time for 8 am to 8 pm every day for the past week. I've tried where "timestamp between ", but that requires a full date to be set (including the day). How can I do this?

yshen · ‎01-28-2022

As follows if <condition-based-on-token-value> then query_1 else query_2where query_1 and query_2 may be a series of statements producing different sets of data. Given a search query can be em...

As follows if <condition-based-on-token-value> then query_1 else query_2where query_1 and query_2 may be a series of statements producing different sets of data. Given a search query can be embedded in a panel, it might achieve the equivalent results, if there were a way to have conditional panel selection: if <condition-based-on-token-value> then panel_with_query_1 else panel_with_query_2 (The above idea is inspired by @mmccul) but I don't know if it's possible to have such panel selection mechanism with Simple XML of Splunk?Or alternatively, if I could control the visibility of a panel based token value, then I might also achieve the panel selection mechanism: define two panels with visibility control by the token value the controls are mutually exclusive, so that only one panel will be shown I'd appreciate some pointers or examples. (edited)

KayBeesKnees83 · ‎01-28-2022

I am running Splunk 8.2.4 on Linux. I recently uploaded our new term license and I noticed the following status: FROM_THE_FUTURE How can I change this to show valid? Thank you.

KayBeesKnees83 · ‎01-28-2022

Greetings, I recently uploaded my new term license. However, I noticed the following message: * 1 cle_pool_over_quota message reported by 1 indexer - correct by midnight to avoid warning Howe...

Greetings, I recently uploaded my new term license. However, I noticed the following message: * 1 cle_pool_over_quota message reported by 1 indexer - correct by midnight to avoid warning However, my company purchased a sizable term license. Is this message safe to ignore? I cannot provide a screenshot because I am operating on an airgapped network. Furthermore, is there a way to mitigate this alert to prevent receiving a warning? Again, we have a very large license and are quota is nowhere near our volume limit. Is it somehow related to updating my license? As a I mentioned, I recently updated the new term license to replace the license that is set to expire. Or should I delete the pool from the previous license and create a new one associated with the new term license? Thank you.

SamHTexas · ‎01-28-2022

I work in a large environment, Splunk Ent + ES ( SH & Indexer clustered). I need to see what network servers are viewed / contained / monitored in any of indexes. Any help / SPLs are much appreciated.

Dahara · ‎01-28-2022

Hello! I would like to have timechart span configurable from the dashboard UI (e.g. via using dropdown field values), but I am not sure, how to set it up. Any help would be much appreciated!

npavlidis · ‎01-28-2022

I have some data that their event field is sometimes... lengthy (not always) so when I try to tag the events of interest, I am not allowed (presented with the error 'Parameter "name" must be less tha...

I have some data that their event field is sometimes... lengthy (not always) so when I try to tag the events of interest, I am not allowed (presented with the error 'Parameter "name" must be less than 1024 characters.'). Is there a workaround or a better way of tagging those events?

Gokul_Krishnan · ‎01-28-2022

Hello, I am stuck and need assistance regarding below topic. I have a dashboard with multiselect filter. When a click on drilldown view, the URL is not converting "%20" to "&". This is the result ...

Hello, I am stuck and need assistance regarding below topic. I have a dashboard with multiselect filter. When a click on drilldown view, the URL is not converting "%20" to "&". This is the result URL when I click the drilldown view. https://.....&form.token1=value1%26form.TPC_1%3Dvalue2 This same code and logic is working for tables and stats. I have used the same code there and it is working fine. But in this dashboard I have used Chart and here it is not working. The correct result what I should get is https://.....&form.token1=value1&form.TPC_1=value2 I am not sure why %26 is not converted to "&" and %3D to "=" And in filter, we can see this is converted to & and = but not in URL. Due to copyright issue, I have replaced the original value to Value1 and token as field1 Below mentioned is the code used for drilldown link. <condition> <eval token="trans_field1">replace("".$form.field1$,",","&form.field1="</eval> <link target="_blank">$details_dashboard$?form.field1=$trans_field1$</link> </condition> Any work around?

teamdruva · ‎01-28-2022

Hi Experts, We performed "check_for_vulnerable_javascript_library_usage" check for our add-on app. As per report we need to upgrade jquery version. We have one common.js file which is minified js...

Hi Experts, We performed "check_for_vulnerable_javascript_library_usage" check for our add-on app. As per report we need to upgrade jquery version. We have one common.js file which is minified js and located in following directory - appserver/static/js/build/common.js Could you please suggest how can we upgrade the jquery version in this minified js file? I went through article - https://dev.splunk.com/enterprise/docs/developapps/visualizedata/updatejquery/?_ga=2.112247757.872217667.1643345201-285550.1643345200 but the steps mentioned here aren't applicable in my case. I am add-on app's tgz file and need to update the jquery version. Appreciate any inputs on this. Best regards, Saurabh

chrisdev · ‎01-28-2022

Hi all, Im attempting to create a graph that plots total number of events over time. I have tried various usages of timechart, which does not have the desired effect. sourcetype=* index=* | tim...

Hi all, Im attempting to create a graph that plots total number of events over time. I have tried various usages of timechart, which does not have the desired effect. sourcetype=* index=* | timechart span=1h count This yields the following result: The total number of events in this example is 16, however the data points on the graph correspond to imports and go from 0 -> 13 -> 3. Is there any way I can plot the total number of events over time (so the 3 data point actually becomes 16)? Thanks in advance for any assistance.

andynewsoncap · ‎01-28-2022

Platform has been live for close to two year. Firewall ports are still open. MTU is still 1500 has not been changed. No error in the OS logs. 3 of my nine clusters started doing this. In fact 7 ...

Platform has been live for close to two year. Firewall ports are still open. MTU is still 1500 has not been changed. No error in the OS logs. 3 of my nine clusters started doing this. In fact 7 our of 9 have search factor not meet errors. Which where fixed by putting CM into main. manual rolling restart of the Indexer and restarting CM and taking it out of Main mode. But I ma left with three with 1000's of bucket fix ups and this error now.

All Topics

All Topics

New to Dashboard Studio? Check out these resources!

Problem with deleting and updating a saved search but no problem in creating or getting details of it

How do I address "check_for_vulnerable_javascript_library_usage" errors in AppInspect?

I'm new to splunk queries and how to create an alert using Linux commands on Splunk?

Different results for same search on same search head for rest call or save search.

Timewrap with specific time range

Searching specific related fields from multiple CSV files.

Simple xml dashboard hide label from checkbox

Setup assistance - Panorama to UF with syslog-ng to Splunk Enterprise at AWS

ADQL query for work hours only

Is it possible to have query/panel with conditional alternative queries/panels?

License Status - FROM_THE_FUTURE

Is this warning related to updating my license: 1 cle_pool_over_quota message reported by 1 Indexer?

Need help with an SPL to check an Index to see list of servers it contains. Thx a million

How to set timechart span from Splunk dashboard UI?

Creating tags error: Parameter "name" must be less than 1024 characters.

Drilldown view to child dashboard with selected filters

Suggestions on how we can upgrade the jquery version in this minified js file?

Graph total events over time

Too many bucket replication errors to target peer

All Topics

Are you a member of the Splunk Community?

All Topics