Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gyslainlatsa
gyslainlatsa
Motivator
Member since:
12-11-2014
06-05-2020
Community Statistics
| Posts | 258 |
| Solutions | 26 |
| Karma Given | 1 |
| Karma Received | 94 |
| Member Since | 12-11-2014 |
Activity Feed
- Got Karma for Re: How to display dashboard panels dynamically?. 07-21-2025 10:44 AM
- Got Karma for Re: What is the best way to search for blank (null) fields in a search?. 05-21-2024 06:11 AM
- Got Karma for Re: How to display dashboard panels dynamically?. 08-16-2023 07:59 PM
- Got Karma for Re: Multiple stats counts in string, need to divide one count by 2. 02-06-2022 06:08 PM
- Got Karma for Re: Is it possible to renew a 30 day Splunk Enterprise license?. 11-02-2021 09:56 AM
- Got Karma for Re: What is the best way to search for blank (null) fields in a search?. 07-21-2021 07:39 AM
- Got Karma for Re: What is the best way to search for blank (null) fields in a search?. 09-23-2020 06:37 AM
- Got Karma for Re: Using the Splunk Enterprise Trial, why is localhost:8000 not getting loaded?. 06-05-2020 12:48 AM
- Got Karma for Re: How to add a form for user input on a dashboard to only run panel searches for data from certain hosts?. 06-05-2020 12:48 AM
- Got Karma for Re: Display phone number value without commas?. 06-05-2020 12:48 AM
- Got Karma for Re: simple xml - setting global not form variables. 06-05-2020 12:48 AM
- Got Karma for Re: Using the Splunk Enterprise Trial, why is localhost:8000 not getting loaded?. 06-05-2020 12:48 AM
- Got Karma for Re: Using the Splunk Enterprise Trial, why is localhost:8000 not getting loaded?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass a multiselect parameter to a search?. 06-05-2020 12:48 AM
- Got Karma for Re: How do I get each unique value for a field to appear in a drop-down list?. 06-05-2020 12:48 AM
- Got Karma for Re: How to add a form for user input on a dashboard to only run panel searches for data from certain hosts?. 06-05-2020 12:48 AM
- Got Karma for Re: How to edit my Simple XML to create a drilldown for clicking on any row of a table to open a new dashboard?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-20-2016
10:37 PM
Hi gmahe,
We opened a support ticket for this and encountered something strange while doing a remote session: The dashboard actually works when used via a Remote Desktop Connection. I opened a RDP connection to my workstation, refreshed the dashboard which has already been loaded by the browser and everything worked as expected. I disconnected and tried using the dashboard directly on the workstation and the faulted behavior could be observed again.
No that we've upgraded to 6.4.3 we can't observe the faulty behavior anymore.
... View more
02-10-2016
01:24 AM
Hi,
As I have resolved this issue with following conclusions.
The email configurations should be defined in alert_actions.conf at app level or system level.
In my case, email configurations are defined in alert_actions.conf of "search" app. So my savedsearch working proper in "search" app.
Then after I have moved (deleting and creating) savessearch from search app to new app "myapp". "myapp" and System level has no any email configurations in alert_actions.conf. So savedsearch executed properly but not sending any emails.
As a solution I have defined system level email configurations in alert_actions.conf. Now It's working as per expected.
Thanks
... View more
03-16-2016
03:13 AM
1 Karma
I have marked this as accepted, as it comes most closely to what I needed to achieve.
We have built a dashboard on the group=thruput name=index_thruput metrics, and did some averaging to get reasonable results.
Thanks!
... View more
04-11-2016
11:35 AM
I downvoted this post because this doesn't apply, this is the answer to another question posted about dbconnect
... View more
02-09-2016
02:28 PM
I don't think this is the same setting. Sunil's running into a limit at 50,000, and the default for dispatch.max_count is already higher at 500,000.
... View more
01-27-2016
02:19 PM
hi rck,
that is the example using timewrap :
source="Perfmon:CPU Load" counter="% Processor Time" host="SERVER01" earliest=-1d@d latest=-0d@d
| timechart avg(Value) span=1h
| timewrap w
| where strftime(_time, "%A") == " day of the week"
For more informations, try following this link:
https://answers.splunk.com/answers/60295/comparing-time-ranges-one-report.html
... View more
01-27-2016
05:12 AM
So, this query completes successfully
| dbquery "TQOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM TQSTDBO.CPUBYVM where "Virtual_Machine" BETWEEN 'vW7NTXMCSOMA001' AND 'vW7NTXMCSOMA025'"
This query completes with no results found
| dbquery "TQOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM TQSTDBO.CPUBYVM where "Virtual_Machine" BETWEEN 'vW7NTXMCSOMA001' AND 'vW7NTXMCSOMA025'" | search Time>strptime("01/26/16 09:25:00","%m/%d/%y %H:%M:%S") AND Time<strptime("01/26/16 09:55:00","%m/%d/%y %H:%M:%S")
... View more
01-26-2016
04:05 AM
Ok I got it working, I had to use the rex command before running the transaction.
Thanks!
... View more
01-25-2016
08:17 AM
1 Karma
If you've access to the Search head's file system, an easy option will be make this change in the file system. The app level access permission is stored in $SPLUNK_HOME/etc/apps/APP_NAME/metadata/ folder in the default.meta OR local.meta. The default entry would say this
# Application-level permissions
[]
access = read : [ * ], write : [ admin, power]
Change this to
# Application-level permissions
[]
access = read : [ YourRoleForApp ], write : [ YourRoleForApp ]
Remember to restart Splunk instance for changes to take place. Since it's just 10 file update, should be easier/faster.
... View more
01-19-2016
03:23 PM
I'd recommend you check the known issues for the latest release and decide whether any of these would affect you, given your current use of Splunk.
... View more
04-05-2016
07:02 AM
Hi Antony, thanks for this, it sounds like we have the same problem. I haven't found any solution that gives me what I'm after. Have you?
... View more
01-12-2016
02:25 PM
Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu on the stanza max_searches_per_cpu. If that is true then would the manual specification trump the actual number of cpus on the machine?,Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu. If that is true then would that trump the number of cpus on the machine?
... View more
05-27-2016
08:09 AM
So it seems I would need to create a different role that included the additional 'admin_all_objects' capability and enable that on only the relevant app.
... View more
01-04-2016
01:01 PM
hi sreelesh_n,
try to write like this: replace "Java *" WITH "*" IN ProcessContext_ProjectName
if that does not work, please me you post your entire code and then I can look at the problem.
... View more
12-10-2015
05:16 AM
Hi everybody,
i could find the solution and thank you to all those who have tried to do so. my solution is:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
<label>Application_Domain</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="ServerSideInclude" layoutPanel="panel_row1_col1">
<param name="src">/applications.html</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="false">
<module name="SearchSelectLister" layoutPanel="panel_row2_col1">
<param name="settingToCreate">domain_setting</param>
<param name="label">Select Domain</param>
<param name="search">index=websphere |rex field=_raw "\[(?<Domain>\S+)\]\[\S+\]\[\S+\]\[\S+\]" |stats count by Domain
</param>
<param name="staticFieldsToDisplay">
<list>
<param name="value">*</param>
<param name="label">ALL DOMAINS (*)</param>
</list>
</param>
<param name="searchFieldsToDisplay">
<list>
<param name="value">Domain</param>
<param name="label">Domain</param>
</list>
</param>
<param name="searchWhenChanged">False</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="arg">
<param name="Domain">
<param name="default">ALL DOMAINS (*)</param>
<param name="value">$target$</param>
<param name="fillOnEmpty">True</param>
</param>
</param>
<param name="name">stringreplace</param>
</param>
<param name="settingToConvert">domain_setting</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<param name="visible">True</param>
<param name="label">Search</param>
<param name="updatePermalink">True</param>
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Applications" autoRun="False">
<param name="groupLabel">Applications</param>
<param name="search">
index=websphere |rex field=_raw "\[(?<Domain>\S+)\]\[\S+\]\[\S+\]\[\S+\]" |search Domain="$Domain$" | timechart count
</param>
<module name="ViewstateAdapter">
<param name="suppressionList">
<item>charting.chart</item>
</param>
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.chart">column</param>
<module name="JSChart">
<param name="width">100%</param>
<module name="Gimp"/>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>
... View more
01-06-2016
11:46 AM
1 Karma
hi,
this is an example of code that does the same job
<dashboard script="custom_layout_width.js">
<label>Layout Customization: Panel Width</label>
<row>
<single>
<searchString>index=_internal sourcetype=splunkd | stats count</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<option name="underLabel">splunkd events</option>
<option name="linkView">search</option>
<option name="drilldown">none</option>
</single>
<single>
<searchString>index=_internal sourcetype=*access | stats count</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<option name="underLabel">access events</option>
</single>
<chart>
<searchString>index=_internal | timechart count</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</chart>
</row>
<row>
<table>
<searchString>index=_internal | stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</table>
</row>
</dashboard>
next you add the custom_layout_width.js
require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) {
// Grab the DOM for the first dashboard row
var firstRow = $('.dashboard-row').first();
// Get the dashboard cells (which are the parent elements of the actual panels and define the panel size)
var panelCells = $(firstRow).children('.dashboard-cell');
// Adjust the cells' width
$(panelCells[0]).css('width', '20%');
$(panelCells[1]).css('width', '20%');
$(panelCells[2]).css('width', '60%');
});
... View more
05-31-2017
12:24 PM
You need to pick a subset of the spreadsheet that is straight tabular data with no formulas, strip out everything else, "Save As CSV" and then it will work. The resulting file should have a set of fields separated by commas that is consistent from top to bottom with a field header as the top row. Your stuff is NOTHING like that.
... View more
06-12-2019
06:29 PM
@nbdesale29 for the community to assist you better please post more details on what you are trying to do where is the drilldown and what does not seem to work? What do you mean by stopped responding? Share sample code and data (mock/anonymize any sensitive information).
Also rather than commenting on a 5 year old thread post a new question with all the relevant details so that it gets appropriate attention from community members.
... View more
06-24-2015
06:11 AM
1 Karma
hi DavidHourani,
Here the correlation table in html
or following this link:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/OverviewofSimplifiedXML#Special_characters_in_XML_files
... View more
06-18-2015
03:10 AM
hi fdi01 , I dont see any mention CPU utlization in the query that you have provided above . Please note that i need to see all other event types + the ones where CPU is higher than 50%
The table should look like this
machine1 - disk failure
machine2 - virus failure
machine4 0- cpu utlization 80
machine5 - ram crash
shellnight · 17 hours ago
I am afraid you are not understanding the request.
I need the list of all problems in machine but exclude the occurences for cpu utlization less than 50
... View more
02-21-2016
09:30 PM
I downvoted this post because really?
... View more
06-16-2015
02:27 AM
hi,
checked if your code default.xml in navigations menus looks like this:
<nav>
<a href="/dj/D3_project1_2010_10_06/sunburst">Sunburst</a>
<a href="/dj/D3_project1_2010_10_06/calendar_view_of_count_by_Host">Calendar view of count by Host</a>
</nav>
if your code default.xml have redirector as this:
<a href="/dj/redirector/D3_project1_2010_10_06/sunburst">Sunburst</a>
remove this redirector.
test and let me know
... View more
06-08-2015
03:40 PM
Yes, it is in every record. I tried your suggestion, but the duplicates are not filtered out, the complete set is returned.
Frustrating!
... View more
05-21-2015
05:50 AM
Hi,
I managed to get this working by adding
| fields SANS3 just before the | range
thanks!
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
