Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About gyslainlatsa
gyslainlatsa
Motivator
Member since:
12-11-2014
06-05-2020
Community Statistics
| Posts | 258 |
| Solutions | 26 |
| Karma Given | 1 |
| Karma Received | 94 |
| Member Since | 12-11-2014 |
Activity Feed
- Got Karma for Re: How to display dashboard panels dynamically?. 07-21-2025 10:44 AM
- Got Karma for Re: What is the best way to search for blank (null) fields in a search?. 05-21-2024 06:11 AM
- Got Karma for Re: How to display dashboard panels dynamically?. 08-16-2023 07:59 PM
- Got Karma for Re: Multiple stats counts in string, need to divide one count by 2. 02-06-2022 06:08 PM
- Got Karma for Re: Is it possible to renew a 30 day Splunk Enterprise license?. 11-02-2021 09:56 AM
- Got Karma for Re: What is the best way to search for blank (null) fields in a search?. 07-21-2021 07:39 AM
- Got Karma for Re: What is the best way to search for blank (null) fields in a search?. 09-23-2020 06:37 AM
- Got Karma for Re: Using the Splunk Enterprise Trial, why is localhost:8000 not getting loaded?. 06-05-2020 12:48 AM
- Got Karma for Re: How to add a form for user input on a dashboard to only run panel searches for data from certain hosts?. 06-05-2020 12:48 AM
- Got Karma for Re: Display phone number value without commas?. 06-05-2020 12:48 AM
- Got Karma for Re: simple xml - setting global not form variables. 06-05-2020 12:48 AM
- Got Karma for Re: Using the Splunk Enterprise Trial, why is localhost:8000 not getting loaded?. 06-05-2020 12:48 AM
- Got Karma for Re: Using the Splunk Enterprise Trial, why is localhost:8000 not getting loaded?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How do I get each unique value for a field to appear in a drop-down list?. 06-05-2020 12:48 AM
- Got Karma for Re: How to add a form for user input on a dashboard to only run panel searches for data from certain hosts?. 06-05-2020 12:48 AM
- Got Karma for Re: How to edit my Simple XML to create a drilldown for clicking on any row of a table to open a new dashboard?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-29-2016
12:09 AM
sorry I had made a mistake in the code but I corrected.
copy the new code and try again
... View more
02-28-2016
03:57 PM
2 Karma
hi,
try with this example
<form>
<label>-------------------------------</label>
<description>----------------------------------------</description>
<fieldset autoRun="true" submitButton="false">
<input type="time" token="tm" searchWhenChanged="true">
<label>Select a time:</label>
<default>Last 24 hours</default>
</input>
<input type="text" token="host_name" searchWhenChanged="true">
<label>Enter a host:</label>
<default>pr*-*</default>
</input>
</fieldset>
<row>
<chart>
<title>Panel1</title>
<search>
<query>index=prod* source=prodLog host=$host_name$ "timeout" OR "error" OR "timed-out" OR "exception" AND NOT "step*time"
| timechart count as timeout span=1h</query>
</search>
<earliestTime>$tm.earliestTime$</earliestTime>
<latestTime>$tm.latestTime$</latestTime>
<option name="charting.chart">column</option>
</chart>
<table>
<title>Panel2</title>
<search>
<query>index=aws-production source=prodLog host=$host_name$" green" OR "blue" OR "red" AND NOT "white"
| timechart count as Colorstatus span=1h</query>
</search>
<earliestTime>$tm.earliestTime$</earliestTime>
<latestTime>$tm.latestTime$</latestTime>
<option name="wrap">true</option>
<option name="displayRowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">5</option>
</table>
</row>
</form>
... View more
02-28-2016
03:15 PM
you want to add a box to allow the user to enter the name of the host it wants and select the timerange he wants?
... View more
02-28-2016
02:31 PM
hi,
Yes it's possible,
displays your code I try to help you
... View more
02-26-2016
01:10 PM
3 Karma
hi,
splunkd not yet started
go to CLI , write $SPLUNK_HOME/bin/splunk start or $SPLUNK_HOME/bin/splunkd start or use restart to replace start`.
if splunkd already already running? write $SPLUNK_HOME/bin/splunk restart
after go http://localhost:8000/en-US/app/launcher/home
it's going to work
... View more
02-25-2016
04:09 AM
find the regular expression that returns the events of the index main I call regex1 .
next try like this:
1-props.conf
Add this stanza to $SPLUNK_HOME/etc/system/local/props.conf:
[Event_By_Index]
TRANSFORMS-index = override-index-by-host
2-transform.conf
Add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf:
[override-index-by-host]
SOURCE_KEY = MetaData:Host
REGEX = regex1 // regular expression that returns the events
FORMAT = name_index // name of the index that will receive data
DEST_KEY = _MetaData:Index
... View more
02-24-2016
01:36 PM
hi,
follow this link:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Capacity/Accommodatemanysimultaneoussearches
... View more
02-24-2016
11:42 AM
hi mahesh_ravji,
This examples routes events of windows_snare_log source type to the appropriate index based on their log types. "Application" logs will go to an alternate index, while all other log types, such as "Security" , will go to the default index.
To make this determination, it uses props.conf to direct events of windows_snare_log source type through the transforms.conf stanza named "AppRedirect" , where a regex then looks for the log type, "Application" . Any event with a match on "Application" in the appropriate location is routed to the alternate index, "applogindex" . All other events go to the default index.
Edit props.conf
Add this stanza to $SPLUNK_HOME/etc/system/local/props.conf:
[windows_snare_syslog]
TRANSFORMS-index = AppRedirect
This directs events of windows_snare_syslog sourcetype to the AppRedirect stanza in transforms.conf
Edit transforms.conf
Add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf:
[AppRedirect]
REGEX = MSWinEventLog\s+\d+\s+Application
DEST_KEY = _MetaData:Index
FORMAT = applogindex
This stanza processes the events directed here by props.conf . Events that match the regex (because they contain the string "Application" in the specified location) get routed to the alternate index, "applogindex" . All other events route as usual to the default index.
try to use this example.
For more informations, follow this link:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Setupmultipleindexes
and read paragraph **Route specific events to a different index **
... View more
02-24-2016
11:01 AM
thanks, don't forget to vote
... View more
02-23-2016
01:24 PM
1 Karma
hi kamal_jagga,
try like this:
<form>
<label>Display Dynamic Panel</label>
<row>
<panel>
<input type="dropdown" token="" searchWhenChanged="true">
<choice value="1">Panel1</choice>
<choice value="2">Panel2</choice>
<choice value="3">Panel3</choice>
<choice value="4">Panel4</choice>
<choice value="5">Panel5</choice>
<choice value="6">Panel6</choice>
<choice value="7">Panel7</choice>
<choice value="8">Panel8</choice>
<choice value="9">Panel9</choice>
<choice value="10">Panel10</choice>
<default></default>
<change>
<condition value="1">
<set token="new_search"> Search1</set>
</condition>
<condition value="2">
<set token="new_search"> Search2 </set>
</condition>
<condition value="3">
<set token="new_search">Search3 </set>
</condition>
<condition value="4">
<set token="new_search"> search4 </set>
</condition>
<condition value="5">
<set token="new_search">Search5 </set>
</condition>
----------------------------------------
-----------------------------------------
----------------------------------------
<condition value="10">
<set token="new_search"> Search10 </set>
</condition>
</change>
</input>
<chart>
<search>
<query>$new_search$</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</form>
... View more
02-23-2016
11:24 AM
2 Karma
hi karmal_jagga,
try like this:
<form>
<label>Display Dynamic Panel</label>
<row>
<panel>
<input type="dropdown" token="" searchWhenChanged="true">
<choice value="1">Panel1</choice>
<choice value="2">Panel2</choice>
<choice value="3">Panel3</choice>
<default></default>
<change>
<condition value="1">
<set token="new_search"> index=_internal |stats count by source </set>
</condition>
<condition value="2">
<set token="new_search"> index=_internal |stats count by sourcetype </set>
</condition>
<condition value="3">
<set token="new_search"> index=_internal |stats count by name </set>
</condition>
</change>
</input>
<chart>
<search>
<query>$new_search$</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</form>
... View more
02-23-2016
11:23 AM
hi kamal_jagga,
yes, it's possible
... View more
02-23-2016
02:02 AM
hi,
using CLI and are you positioned in the bin directory of splunk .
for windows, try like this:
C:\Program Files\Splunk\bin>splunk -version
and get this result:
... View more
02-22-2016
12:41 PM
thanks, don't forget to vote
... View more
02-22-2016
12:21 PM
NOT dv_install status = "*" will find all the events wherethe value of the field dv_install_status is empty or zero.
try and see the results because I have already used this option
... View more
02-22-2016
12:05 PM
"In use" is a value of *
just write NOT dv_install_status="*"
... View more
02-22-2016
11:47 AM
9 Karma
hi hastrike,
use NOT field="*"
for more informations, follow this link:
https://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields.html
... View more
02-22-2016
03:15 AM
hi,
follow this link for more informations:
http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchTutorial/GetthetutorialdataintoSplunk
... View more
02-22-2016
01:19 AM
1 Karma
hi,
this option display the difference in days
eval days_since = (now() - last_seen) / 86400
try like this
index=_audit action=edit_user operation=edit OR operation=create
| rename object as user
| stats max(timestamp) as "created" by user
| eval createddate=strptime(created, "%m-%d-%Y %H:%M:%S")
| eval testtime=now()
| eval days_since = (testtime - createddate) / 86400
| eval diff = tostring((testtime - createddate), "duration")
|eval u = diff / 86400
| fields createddate testtime diff u days_since
... View more
02-21-2016
11:55 AM
hi gsumner,
The `_indextime` field contains the time that an event was indexed, expressed in Unix time. You might use this field to focus on or filter out events that were indexed within a specific range of time.
... View more
02-19-2016
01:22 AM
try like this:
| rest /services/authentication/users splunk_server=local
| fields title
| rename title as user
| join user [search index=_audit action=edit_user (operation=create OR operation=edit)
| rename object as user
| stats list(timestamp) as "created" by user]
... View more
02-18-2016
03:53 PM
hi,
par example, To make the Search app the default landing app for a user:
1. Create a file called user-prefs.conf in the user's local directory:
etc/users/<user>/user-prefs/local/user-prefs.conf
· For the admin user the file would be in:
etc/users/admin/user-prefs/local/user-prefs.conf
· For the test user, it would be in:
etc/users/test/user-prefs/local/user-prefs.conf
2. Put the following line in the user-prefs.conf file:
default_namespace = search
or following this link:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Admin/ConfigureSplunktoopeninanapp
... View more
02-18-2016
03:49 PM
hi,
try follow this link:
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG
... View more
02-18-2016
03:46 PM
hi adtetech,
Also, you can find on SplunkBase the Splunk License Usage Apps.
In addition to the daily license usage, this Splunk Apps provides a dashboard of your Splunk license usage total over the past 24 hours as well as usage by host, source, and sourcetype. It contains timecharts to help you understand usage over time and see usage spikes as well as pie charts to help you to figure out which log files, sourcetypes, and hosts Splunk is indexing the most data from.
for more informations, follow this link:
https://answers.splunk.com/answers/4897/how-to-determine-daily-license-usage-in-gb.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
