Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About asimagu
asimagu
Builder
Member since:
12-03-2012
06-05-2020
Community Statistics
| Posts | 250 |
| Solutions | 27 |
| Karma Given | 53 |
| Karma Received | 50 |
| Member Since | 12-03-2012 |
Activity Feed
- Got Karma for disk usage from the monitoring console does NOT match the reality. 01-07-2021 12:57 PM
- Karma Re: In a Splunk dashboard, how do you make the cell coloring range different for each row? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a Splunk dashboard, how do you make the cell coloring range different for each row? for niketn. 06-05-2020 12:50 AM
- Got Karma for Re: In a Splunk dashboard, how do you make the cell coloring range different for each row?. 06-05-2020 12:50 AM
- Karma Has anyone Splunked Trello data? for David. 06-05-2020 12:48 AM
- Karma Re: Threat list download failed - palevo_ip_blocklist download failed after multiple retries for MuS. 06-05-2020 12:48 AM
- Karma Re: How to set loading order for panels? for woodcock. 06-05-2020 12:48 AM
- Karma Cisco eStreamer for Splunk: How to troubleshoot error in which eStreamer logs are not displayed in Splunk? for mohammed7860. 06-05-2020 12:48 AM
- Karma How to deal with datamodel retention period as summary range is not working for thambisetty_bal. 06-05-2020 12:48 AM
- Karma Re: How to deal with datamodel retention period as summary range is not working for thambisetty_bal. 06-05-2020 12:48 AM
- Karma Re: Why is geostats not showing data for all expected countries when the search finishes? for marina_rovira. 06-05-2020 12:48 AM
- Karma Re: Why is geostats not showing data for all expected countries when the search finishes? for marina_rovira. 06-05-2020 12:48 AM
- Got Karma for is it possible to create a new threat intelligence source with json format in Enterprise Security ?. 06-05-2020 12:48 AM
- Got Karma for Re: How to refer to JSON array object in a Splunk search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to break events as Every Line. 06-05-2020 12:48 AM
- Got Karma for Re: How to break events as Every Line. 06-05-2020 12:48 AM
- Got Karma for Enterprise Security script exited abnormally status="exited with code 3". 06-05-2020 12:48 AM
- Got Karma for Enterprise Security script exited abnormally status="exited with code 3". 06-05-2020 12:48 AM
- Got Karma for Re: Why is the wrong value being extracted when using this regular expression?. 06-05-2020 12:48 AM
- Got Karma for Re: Why is the wrong value being extracted when using this regular expression?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
12-09-2013
06:54 PM
1 Karma
you probably want to use | stats count(clientip) as Total dc(clientip) as "unique users"
... View more
12-09-2013
06:47 PM
can you provide the code? have you tried it on another browser?
... View more
11-06-2013
11:27 AM
Hi
There are a couple of options that you can use for this regex. Both of them worked for me:
[replicationBlacklist]
sample1 = ...appname1...
sample2 = .appname2.
That would blacklist the whole lot of files from those apps, you could also only blacklist specific files from inside an app by including the whole path to the file
... View more
09-19-2013
07:37 PM
this may help you
http://answers.splunk.com/answers/684/after-fixing-propsconf-how-to-re-index-the-same-files-using-the-new-settings
... View more
09-19-2013
07:28 PM
You could use javascript like the following in your application.js:
$("input").attr("maxlength", 4)
Here is a demo: http://jsfiddle.net/TmsXG/13/
... View more
08-05-2013
09:21 PM
1 Karma
if you edit your javascript that fires while loading the page you can add your own title
document.title = "My title";
... View more
07-30-2013
08:39 PM
hi guys, I have tried replicating this same config and filename on Splunk 5.0.2 but it is not working for me
any known issues on Splunk 5 about this??
... View more
07-30-2013
02:06 PM
would it be possible to get rid of this "warning" now?
'Your timerange was substituted based on your search string'
... View more
07-30-2013
02:03 PM
it worked!! you are the man!! type it as an aswer and I will approve it 😉
... View more
07-29-2013
08:59 PM
I am trying to plot data in a timechart with a span of 1 month. I run the search for the last 12 months until now, but as I only have data from the last 4 months, Splunk snaps the graph to those last months (this only occurs when I convert the simple XML to the advanced mode).
Is there any way to specify a range of 12 months in the X axis?? I was only able to set a fix date as a start and end date, but not a relative one....
This is my XML:
<earliestTime>-12mon@mon</earliestTime>
<latestTime>@mon</latestTime>
<module name="ViewstateAdapter">
<param name="suppressionList">
<item>charting.axisLabelsX.majorUnit</item>
<item>charting.fieldColors</item>
<item>charting.chart</item>
<item>charting.axisTitleX.text</item>
</param>
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.axisLabelsX.majorUnit">P0Y1M0DT0H0M0S</param>
<param name="charting.chart">column</param>
<param name="charting.axisTitleX.text">Month</param>
<module name="FlashChart">
<param name="width">100%</param>
<module name="Gimp"/>
<module name="ConvertToDrilldownSearch">
...
..
... View more
07-28-2013
02:28 PM
hi guys
I need to create sort of a visual Time Range picker.
My customer does not like the default Time Range Picker that comes with Splunk, and he would rather have something like a whole year timechart, and when he clicks on the name of a month, then the whole dashboard will reload using the new timeframe. As you can imagine the dashboard has several searches and postprocesses...
has anyone achieved something similar? could someone address me in the easiest way of achieving this?
thanks
... View more
- Tags:
- timepicker
07-18-2013
07:49 PM
do you want to achieve that at the same time that you get that table?? coz otherwise you can always omit "description" in your search, sorry not sure if I understood what you are after
... View more
07-18-2013
07:43 PM
1 Karma
if you have a search or view with the permissions set to global, and you create a new search or view with the same name and change its permissions to global, Splunk will not let you do that and will show you an Error Message.
You can have all your apps with views and searches with global permissions, then it will be a matter of creating a custom Navigation Menu for each app.
I hope that helps
... View more
07-18-2013
07:38 PM
what you want is a Switcher Module, you can find the instructions and sample code if you install the app Splunk Dashboards Examples
http://splunk-base.splunk.com/apps/64805/splunk-dashboard-examples
Then, you can start by taking a look at the view called "switcher1"
... View more
07-18-2013
07:32 PM
could you paste the XML?
... View more
07-15-2013
03:57 PM
I am guessing you want the column name to be renamed for the result of the search?
If that is the case you can pipe your search to
| rename column_name AS "your_new_name"
if you want to change the name of the field before doing calculations with the new name, you should use the eval command
| eval new_name=old_name
... View more
07-15-2013
03:25 PM
if Value is always constant for each host you could do something simple like this:
stats last(Value) by host
if it is not constant and you want to get the sum by host:
stats sum(Value) by host
... View more
07-15-2013
03:09 PM
wow! I am really overwhelmed and lost by all that nesting, mate
... View more
07-15-2013
03:05 PM
you can indeed set up new fields on the fly with the rex command if it's a field extraction (you create a new field) and you can also create new fields with the eval command if they are not extractions but transformations
... View more
07-14-2013
02:20 PM
parent search:
eventtype="pyme_page" status=200 | geoip clientip | search clientip_country_name="$country$" | fields clientip _time date_hour date_wday
postprocess 1:
stats count(clientip) | rangemap field=count(clientip) low=0-29 elevated=30-99 high=100-500 severe=501-10000 default=low
and that is replicated 3 exact times in my dashboard, in each of the panels. I was lost and that's why I came here to ask, I'm really suspecting it has something to do with the geoip command...
... View more
07-14-2013
02:10 PM
The idea of that dashboard was to make comparisons between different timeframes and different values of certain fields. I spotted some discrepancies between the same searches in two dashboards so I decided to run the same exact search in those 3 panels at the same time.... and surprise! I got 3 different results for the count of events: 1794, 1797, 1789 ..... so strange!
... View more
07-14-2013
02:01 PM
yes, could you do a field extraction for those values?that way they could be under the same FIELD. then try this:
sourcetype=gc.log FIELD="PSYoungGen" OR FIELD="Full GC" | stats count(FIELD=="PSYoungGen") AS "GCs", count(FIELD="FullGC") AS "Full_GCs", count AS "Total" ...... and then calculate your percentange
I was assuming that in some events you got this value "PSYoungGen" and in some other you got "Full GC" , if it does not work like that maybe you can still see where I was going with my explanation. Please do not hesitate to ask if you don't understand
... View more
07-14-2013
01:44 PM
I'm afraid not, it does not include current time. I am running those searches through the month of June
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
