Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About helge
helge
Builder
Member since:
11-20-2012
07-05-2023
Community Statistics
| Posts | 193 |
| Solutions | 14 |
| Karma Given | 277 |
| Karma Received | 65 |
| Member Since | 11-20-2012 |
Activity Feed
- Got Karma for Re: Why is KV Store certificate renewal not working?. 03-12-2025 02:38 PM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 01-23-2025 01:16 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 11-16-2024 04:59 PM
- Got Karma for Re: Some events missing from data model - only if accelerated. 02-15-2024 08:23 AM
- Got Karma for Some events missing from data model - only if accelerated. 02-15-2024 08:21 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 02-02-2024 11:35 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 07-07-2023 08:04 AM
- Got Karma for Re: Why is KV Store certificate renewal not working?. 01-06-2023 10:30 AM
- Posted Re: Why is KV Store certificate renewal not working? on Knowledge Management. 11-01-2022 01:27 PM
- Tagged Re: Why is KV Store certificate renewal not working? on Knowledge Management. 11-01-2022 01:27 PM
- Karma Re: Renewing server.pem certificate for vishaltaneja070. 11-01-2022 11:11 AM
- Got Karma for How to escape equal signs (=) in key value data?. 09-29-2022 11:35 PM
- Posted Re: Accelerated data model 100% complete even though most populating searches are skipped on Other Usage. 01-19-2022 06:10 AM
- Karma Re: SimpleXML: text size of single value element ignores height with version="1.1" for vagrawal. 09-23-2021 12:37 PM
- Posted Re: SimpleXML: text size of single value element ignores height with version="1.1" on Splunk Dev. 09-23-2021 09:12 AM
- Karma Re: SimpleXML: text size of single value element ignores height with version="1.1" for thellmann. 09-23-2021 09:02 AM
- Posted SimpleXML: text size of single value element ignores height with version="1.1" on Splunk Dev. 07-29-2021 02:52 PM
- Posted Re: SimpleXML dashboard version=1.1 backwards compatibility on Splunk Dev. 07-29-2021 02:37 PM
- Posted Re: SSL Error preventing upgrade to Splunk 8 on Security. 07-29-2021 11:53 AM
- Karma SSL Error preventing upgrade to Splunk 8 for csyvenky. 07-29-2021 11:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 |
08-17-2015
02:17 PM
Yes, I am managing some of the dashboard's searches from JavaScript. Here are two typical examples:
// Provoke a new data model field search
var searchFilterField = mvc.Components.getInstance("Search_FilterField");
searchFilterField.startSearch();
// Update search manager
var searchPanel31 = mvc.Components.getInstance("Search_Panel31Chart");
searchPanel31.settings.unset("search");
searchPanel31.settings.set("search", mvc.tokenSafe(searchString));
... View more
08-17-2015
01:09 PM
No, I am happy to share my dashboard source code. It is a bit lengthy, but I added it to the question.
Please not that some logic is happening in JavaScript.
... View more
08-17-2015
12:22 PM
Thanks for your answer. Unfortunately that does not seem to have been the cause.
I had used earliestTime and latestTime in my app only for input type="time" , the time range selector. With the individual charts I had already used earliest and latest .
I replaced the instances of earliestTime and latestTime with earliest and latest , respectively and even restarted Splunk - just to be on the safe side - but the errors did not go away.
... View more
08-17-2015
09:46 AM
2 Karma
When I open the dashboard Pan and Zoom Chart Controls (simple_chart_range_selection) from the app Splunk 6.x Dashboard Examples, I get the following error in the console of Chrome developer tools:
POST http://srv1:8000/en-US/splunkd/__raw/servicesNS/helge/simple_xml_examples/search/jobs?output_mode=json 400 (Bad Request) mvc.js:6
[SPLUNKD] Invalid earliest_time. mvc.js:6
I am using the pan and zoom technique demonstrated on that dashboard in my app, where I get the same errors. This happens with Splunk 6.2.4 as well as Splunk 6.3 preview.
Is there some way to get rid of this error?
Update:
I monitored the failing searches with Fiddler and noticed, that earliest_time is set to the literal string $start$. This surely must be a bug!
Following is the full source code of my dashboard that causes the same errors (typically 6-7 identical errors when opening the dashboard):
<?xml version='1.0' encoding='utf-8'?>
<form script="main.js, analyze_timechart.js" stylesheet="main.css, analyze_timechart.css">
<label>Analyze data over time</label>
<description>This dashboard lets you interactively analyze any filtered subset of your data over time.</description>
<fieldset autoRun="true">
<input type="time" searchWhenChanged="true">
<label>Time range:</label>
<default>
<earliest>-1h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="FilterDatamodel" id="Input_FilterDatamodel">
<choice value="Application_BrowserPerformanceChrome">Browser: Chrome</choice>
<choice value="Application_BrowserPerformanceIE">Browser: IE</choice>
<choice value="System_GpuUsage">Machine GPU</choice>
<choice value="System_SystemPerformanceSummary">Machine performance</choice>
<choice value="Process_NetworkTargetPerformance">Network performance</choice>
<choice value="Application_OutlookPluginLoad">Outlook Plugin Load Performance</choice>
<choice value="Process_ProcessDetail">Process Detail</choice>
<choice value="Process_ProcessStartup">Process Startup</choice>
<choice value="Session_SessionDetail_Session0">Session 0</choice>
<choice value="Session_SessionDetail_Users">User Sessions</choice>
<label>Data model:</label>
</input>
<input type="dropdown" token="FilterField" id="Input_FilterField">
<label>Filter field:</label>
</input>
<input type="dropdown" token="FilterOperator" id="Input_FilterOperator">
<choice value="is">is</choice>
<choice value="isNot">is not</choice>
<default>is</default>
<label>Filter operator:</label>
<prefix></prefix>
<suffix></suffix>
</input>
<input type="text" token="FilterExpression" id="Input_FilterExpression">
<label>Filter expression (e.g. "*name*"):</label>
<default>*</default>
</input>
</fieldset>
<search id="Search_Single">
<query>
</query>
</search>
<!-- Row 0 -->
<row depends="$Single01Title$">
<panel>
<single depends="$Single01Title$">
<title>$Single01Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single01Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single02Title$">
<title>$Single02Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single02Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single03Title$">
<title>$Single03Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single03Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single04Title$">
<title>$Single04Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single04Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single05Title$">
<title>$Single05Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single05Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<html depends="$SingleRow2Header$">
<h2 class="AboveSingle">$SingleRow2Header$</h2>
</html>
<single depends="$Single06Title$">
<title>$Single06Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single06Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single07Title$">
<title>$Single07Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single07Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single08Title$">
<title>$Single08Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single08Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single09Title$">
<title>$Single09Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single09Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single10Title$">
<title>$Single10Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single10Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single11Title$">
<title>$Single11Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single11Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
<single depends="$Single12Title$">
<title>$Single12Title$</title>
<search base="Search_Single">
</search>
<option name="field">$Single12Field$</option>
<option name="refresh.time.visible">false</option>
<option name="height">50</option></single>
</panel>
</row>
<!-- Row 1 -->
<row>
<panel>
<title>Event and originating host count (try zooming in!)</title>
<description>Zoom here to modify the time range for the chart below</description>
<chart>
<search>
<query>
| pivot uberAgent $FilterDatamodel$
count($FilterDatamodel$) as Eventcount
dc(host) as Hostcount
splitrow
_time
period minute
filter $FilterField$ $FilterOperator$ "$FilterExpressionInternal$"
| timechart
sum(Eventcount) as "Event count"
sum(Hostcount) as "Host count"
`dynamic_span`
</query>
</search>
<option name="height">150px</option>
<option name="charting.chart">column</option>
<option name="charting.legend.placement">none</option>
<option name="charting.legend.masterLegend">null</option>
<option name="charting.chart.overlayFields">"Host count"</option>
<option name="charting.axisY2.enabled">true</option>
<option name="charting.axisY2.fields">"Host count"</option>
<option name="charting.axisY.includeZero">true</option>
<option name="charting.axisY2.includeZero">true</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.text">Events</option>
<option name="charting.axisTitleY2.text">Hosts</option>
<option name="charting.seriesColors">[0x324969, 0xFAC61D]</option>
<selection>
<set token="selection.earliest">$start$</set>
<set token="selection.latest">$end$</set>
</selection>
</chart>
</panel>
</row>
<search id="Search_FilterField">
<query>
| tstats
dc("$FilterDatamodelRoot$.*")
from
datamodel=uberAgent.$FilterDatamodelRoot$
where
(nodename = $FilterDatamodelRoot$)
prestats=true
earliest=-15m latest=now
| stats
dedup_splitvals=t
dc("$FilterDatamodelRoot$.*") as *
| transpose
| where column != "*"
</query>
</search>
<!-- Row 2 -->
<row depends="$selection.earliest$, $selection.latest$, $FilterDatamodelRoot$, $FilterLevel2$">
<panel>
<title>Compare two metrics over time</title>
<input type="dropdown" token="Panel11Function1" id="Input_Panel11Function1">
<choice value="avg">average</choice>
<choice value="count">count</choice>
<choice value="max">maximum</choice>
<choice value="median">median</choice>
<choice value="min">minimum</choice>
<choice value="stdev">standard deviation</choice>
<choice value="sum">sum</choice>
<default>avg</default>
<label>Function 1:</label>
</input>
<input type="dropdown" token="Panel11Field1" id="Input_Panel11Field1">
<search base="Search_FilterField"></search>
<fieldForLabel>column</fieldForLabel>
<fieldForValue>column</fieldForValue>
<label>Field 1:</label>
</input>
<input type="dropdown" token="Panel11Function2" id="Input_Panel11Function2">
<choice value="avg">average</choice>
<choice value="count">count</choice>
<choice value="max">maximum</choice>
<choice value="median">median</choice>
<choice value="min">minimum</choice>
<choice value="stdev">standard deviation</choice>
<choice value="sum">sum</choice>
<default>avg</default>
<label>Function 2:</label>
</input>
<input type="dropdown" token="Panel11Field2" id="Input_Panel11Field2">
<search base="Search_FilterField"></search>
<fieldForLabel>column</fieldForLabel>
<fieldForValue>column</fieldForValue>
<label>Field 2:</label>
</input>
<chart depends="$selection.earliest$, $selection.latest$">
<search>
<query>
| pivot uberAgent $FilterDatamodel$
$Panel11Function1$($Panel11Field1$) as "$Panel11Function1$($Panel11Field1$)"
$Panel11Function2$($Panel11Field2$) as "$Panel11Function2$($Panel11Field2$)"
splitrow
_time
$FilterLevel2$
filter $FilterField$ $FilterOperator$ "$FilterExpressionInternal$"
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="height">350px</option>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart.overlayFields">$Panel11Function2$($Panel11Field2$)</option>
<option name="charting.axisY2.enabled">true</option>
<option name="charting.axisY2.fields">$Panel11Function2$($Panel11Field2$)</option>
<option name="charting.axisY.includeZero">true</option>
<option name="charting.axisY2.includeZero">true</option>
</chart>
</panel>
</row>
<!-- Row 3 -->
<row depends="$selection.earliest$, $selection.latest$">
<panel id="Panel_31" depends="$Panel31Title$">
<title>$Panel31Title$</title>
<chart id="Chart_Panel31" depends="$selection.earliest$, $selection.latest$">
<search id="Search_Panel31Chart">
<query>
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="height">250px</option>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisY.includeZero">true</option>
</chart>
</panel>
</row>
<!-- Row 4 -->
<row depends="$selection.earliest$, $selection.latest$">
<panel id="Panel_41" depends="$Panel41Title$">
<title>$Panel41Title$</title>
<chart id="Chart_Panel41" depends="$selection.earliest$, $selection.latest$">
<search id="Search_Panel41Chart">
<query>
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="height">250px</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">$Panel41ChartStackMode$</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisY.includeZero">true</option>
</chart>
</panel>
</row>
<!-- Row 5 -->
<row depends="$selection.earliest$, $selection.latest$">
<panel id="Panel_51" depends="$Panel51Title$">
<title>$Panel51Title$</title>
<chart id="Chart_Panel51" depends="$selection.earliest$, $selection.latest$">
<search id="Search_Panel51Chart">
<query>
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="height">250px</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">$Panel51ChartStackMode$</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisY.includeZero">true</option>
</chart>
</panel>
</row>
<!-- Row 6 -->
<row depends="$selection.earliest$, $selection.latest$">
<panel id="Panel_61" depends="$Panel61Title$">
<title>$Panel61Title$</title>
<chart id="Chart_Panel61" depends="$selection.earliest$, $selection.latest$">
<search id="Search_Panel61Chart">
<query>
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="height">250px</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisY.includeZero">true</option>
</chart>
</panel>
</row>
<!-- Row 7 -->
<row depends="$selection.earliest$, $selection.latest$">
<panel id="Panel_71" depends="$Panel71Title$">
<title>$Panel71Title$</title>
<chart id="Chart_Panel71" depends="$selection.earliest$, $selection.latest$">
<search id="Search_Panel71Chart">
<query>
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="height">250px</option>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisY.includeZero">true</option>
</chart>
</panel>
</row>
<!-- Row 8 -->
<row depends="$selection.earliest$, $selection.latest$">
<panel id="Panel_81" depends="$Panel81Title$">
<title>$Panel81Title$</title>
<table id="Table_Panel81" depends="$selection.earliest$, $selection.latest$">
<search id="Search_Panel81Table">
<query>
</query>
<earliest>$selection.earliest$</earliest>
<latest>$selection.latest$</latest>
</search>
<option name="count">50</option>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
... View more
08-09-2015
03:35 PM
Exclude the datamodel_summary directories from backup.
If you restore an index, Splunk recreates the accelerated data model (that is what is stored in datamodel_summary ) automatically.
... View more
08-08-2015
06:01 PM
2 Karma
Splunk really needs to improve the documentation of which files to put where regarding apps in a distributed environment. I found the answer by searching this site and verified it in our lab.
A data model is defined on the search heads, not the indexers. The following files make up the data model definition and need to be part of the app that resides on the search heads:
datamodels.conf
data_model_name.json
... View more
06-10-2015
08:50 AM
1 Karma
The reason why this is happening is most likely the bug SPL-40332 described here. Apparently it only affects Splunk running on Windows. Unfortunately this is still not fixed in Splunk 6.2.3.
... View more
04-12-2015
04:47 AM
I take it you mean "you can" insteaf of "you can't"?!
... View more
04-07-2015
08:23 AM
The documentation for mvfilter seems to be incorrrect. I get the same error message as the original poster:
Error in 'eval' command: The arguments to the 'mvfilter' function are invalid.
when I use mvfilter like this:
| eval SessionEndTime = mvfilter (SessionEndTime != NULL)
Using null() instead of NULL does not work either; it gives me the error:
Error in 'eval' command: Typechecking failed. The '!=' operator received different types.
What does seem to work is putting NULL in quotes like this:
| eval SessionEndTime = mvfilter (SessionEndTime != "NULL")
... View more
04-06-2015
04:51 PM
Thanks, Simon, but that does not seem to work. The timechart command still does not generate output. I also tried variations with "eval strftime/strptime" without success.
... View more
04-06-2015
04:37 PM
If I am not mistaken the datamodel command is not accelerated even if the underlying data model is. That makes it irrelevant.
... View more
04-06-2015
04:28 PM
I am avoiding tstats because it does not support realtime searches.
... View more
04-06-2015
04:03 PM
I want to use timechart's ability to accept a dynamic span depending on time range searched by way of a macro. That is not possible with pivot.
My solution is to do a pivot with the minimum period of "minute" followed by a timechart with dynamic span. As you wrote, that fails as soon as a second splitrow is used.
... View more
04-06-2015
02:47 PM
I have exactly the same issue.
... View more
03-08-2015
03:49 PM
So the trick is to splitrow by _time and splitcol by what you want stacked. Thanks for shraring!
... View more
03-02-2015
07:51 AM
While uberAgent is certainly not free, it might enable you to reduce the total data volume compared to alternative solutions.
... View more
02-19-2015
01:58 PM
This seems to be broken. I can confirm that, contrary to what is stated in the documentation, a description element below panel is not displayed on Splunk 6.2.1.
... View more
02-15-2015
05:46 PM
2 Karma
I can but agree. Having the app name in the URL is ugly and calling for future errors that are difficult to diagnose. There should be better support for building custom modules using the mechanism chose by Splunk (RequireJS).
... View more
02-13-2015
05:11 PM
This works, but as you mentioned it is ugly. Especially since you need to make the search even longer by removing _sortfield or it will show up in the table:
| fields - _sortfield
... View more
02-13-2015
04:47 PM
1 Karma
This should really be possible out of the box without resorting to this ugly hack.
... View more
02-08-2015
04:08 PM
Would like to see that in Simple XML, too.
... View more
01-28-2015
08:34 AM
2 Karma
I have an app with an accelerated data model. The data model is defined in a JSON file while the acceleration is enabled in datamodels.conf .
Splunk's documentation explains that a persistently accelerated data model resides on the indexers, but it does not tell where to put which files in a distributed environment. My understanding is that, since the TSIDX files live on the indexers, both the data model's JSON file and datamodels.conf must be on the indexers, too.
That leads to my question: do the search heads need a copy of the data model JSON file, too? Or is it sufficient to have everything related to data models on the indexers?
... View more
01-27-2015
05:05 PM
This works in Splunk 6.2.1 only if you add an asterisk after the as, like so:
<your search> | stats dc() as * | transpose
... View more
01-27-2015
04:39 PM
2 Karma
I would like to call a JavaScript function defined in application.js when the user clicks a link in a Simple XML dashboard. I have the following code:
<html>
<p>Click on a row in the table to get more information.</p>
<p><a href="javascript:void(0);" onClick="toggleHidden('Explanation');">Explanation of the data in the table</a></p>
This does not work because the parameters of the a tag are stripped. Using Chrome Developer Tools I see that it looks like this when the page has been loaded:
<html>
<p>Click on a row in the table to get more information.</p>
<p><a href="">Explanation of the data in the table</a>
The same code works perfectly when included like this:
<html src="process_detail_explanation.html">
</html>
Is this a bug or by design? I could not find it documented anywhere.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-05-2023
07:16 AM
|
