About ma_anand1984

ma_anand1984 · ‎09-10-2012

Events type name, subtype, type, sal EVENT sample jack,male,human, 1000 rose,female,human,1500 I want to get the below output. Can someone help? Name Salary Human(male) Jack 1000 Human(female) Rose 1500

ma_anand1984 · ‎08-29-2012

I "yay"ed my dashboard 🙂 thank you

ma_anand1984 · ‎08-29-2012

Thank so lot, you exactly got the problem. It worked like a charm

ma_anand1984 · ‎08-29-2012

With the below code. My page is not generating graphs as expected. It loads only on pressing submit button. Last 2 hours False True True Submit True False False progress False False 300 some search some search some label True True False Hits top line Time 100% flashtimeline flashtimeline some search some label True True False Response Time (ms) top line Time zero 100% flashtimeline

ma_anand1984 · ‎08-29-2012

@Ayn let me know if you need more information

ma_anand1984 · ‎08-29-2012

Now i have to hit submit button to load. I want the page to show charts as soon as i visit the dashboard. Please note that putting timepicker and submit module inside searchString module works. But the problem is i want the time picker to be common for both search string modules

ma_anand1984 · ‎08-29-2012

My Dashboard looks like below I have set 2 hours as default time. I wanted my app to show results onload. How can i achieve Timepicker submit button searchString (summary search) autorun = true post process1 autorun = true ..... ..... post processN autorun = true End searchString (summary search) searchString (raw search) autorun = true post process1 autorun = true ..... post processN autorun = true End searchString (raw search) End submit button End Timepicker

ma_anand1984 · ‎08-28-2012

thank you MHibbin for your time. I'm aware of both the methods you told. I was checking whether there is any magic that does it in one Shot.

ma_anand1984 · ‎08-23-2012

I have a dashboard with 10 graphs all pointing to one saved search each. what is the easiest way to convert all of them to inline search at One GO?

ma_anand1984 · ‎08-14-2012

I add users in authentication.conf. I push them to SH. The updated file resides on .../primary/.. But when i reload (which i have to do for some reason), a new copy of authentication.conf is automatically created and is placed in ../etc/system/local/ this system/local copy overrides the one in primary. Now i have to delete this system/local copy every time i add users to see newly added users in UI. Is there a way to avoid this step ?

ma_anand1984 · ‎08-14-2012

@HEXX when i tried this url, http[s]://[splunkweb hostname]:[splunkweb port]/debug/refresh it gets timed out every time i tried. Is there any other way , i can get the list of entities? like "admin/auth-services"

ma_anand1984 · ‎08-09-2012

I know we can refresh different entities like the following. Is there any link where i can all the entities available? http://splunkserver:8000/en-US/debug/refresh?entity=

ma_anand1984 · ‎08-09-2012

Thanks for all your time I just found that we can reload using the following ./splunk reload auth -uri https://splunkserver:8089/

ma_anand1984 · ‎08-09-2012

I understand, turnaround time for adding people to LDAP group is very high in my organization. Also there are multiple teams who want to create dashboards and share only with their team members. so creation of roles happen a lot. your suggestions ?

ma_anand1984 · ‎08-09-2012

Thank you. We use LDAP authentication but define roles in authorise.conf and use them. We are using ldap for authentication and splunk for access restriction (roles). Now to map user to splunk defined role, i add them under [roleMap_AD] in authentication.conf as role_name = user id1,user id2,.... Now with this setup, i have to reload in each Search Head. Is there any way i can simplyfy this. We have 10 SH and doing it ten times if not a good idea

ma_anand1984 · ‎08-09-2012

We are having LDAP enabled for user management. I add user id in authentication.conf. then run the command splunk reload deploy-server. This command pushes authentication.conf to all pooled Search Head. How ever users are not able to login. Only after running 'splunk reload auth' in each SearchHead, user is able to login. why should i run reload auth in every search head ? Is there any alternative ? I'm seeing the below note in the link http://docs.splunk.com/Documentation/Splunk/latest/admin/SetupuserauthenticationwithLDAP but i will have to reload auth when i add new users. Else they are not able to login. Should i make some other changes? Note: Splunk automatically checks LDAP membership information when a user attempts to log into Splunk. You do not need to reload the authentication configuration when adding or removing users.

ma_anand1984 · ‎08-04-2012

thank you

ma_anand1984 · ‎08-03-2012

we can get query result values by "result[0].column name". can this variable be dynamically created. in other words, can i dynamically compute number in the brackets based on number of rows?

ma_anand1984 · ‎08-03-2012

I would like to read query results(from Search Module) in my javascript written in my View. Note: I'm not using js SDK

ma_anand1984 · ‎07-19-2012

thanks for the reply. I am aware of view.rng or view.rnc and i also know that i can get it from http://localhost:8000/en-US/info. I'm looking for ways to use them in RAD.

ma_anand1984 · ‎07-18-2012

How can i add nrg schema/DTD to RAD so that i can edit SPlunk XML there?

ma_anand1984 · ‎07-18-2012

Is there any Editor available that can validate and suggest as i type for creating SPLUNK advanced XML.

ma_anand1984 · ‎07-16-2012

Thank so lot 🙂

ma_anand1984 · ‎07-15-2012

Tom has "POWER" ROLE that inherits "USER" Role and has more capabilities. Tom creates dashboard "Dash1" Tom wants to share Read access to ROLE "TOM-TEAM-ROLE". Tom is not able to see "permissions" link against "Dash1" I'm an Admin. I have complete access to splunk. What should i do to enable permissions link against "Dash1" for Tom.

ma_anand1984 · ‎06-19-2012

Hi, Will it be a good idea to add logger function in Java-SDK where you can put logs with INFO,DEBUG,ERROR... category? So that we can enable log level in one common place and go about the code flow (for faster learning and debugging)

Posts	121
Solutions	5
Karma Given	230
Karma Received	43
Member Since	‎04-11-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

whats wrong with this inputs.conf configuration

How to escape double quotes in a Dashboard?

Is it possible to change case of a column name?

How to get email id from LDAP

Mutiple timepicker for same search

If SPLUNK provides UNIQUE ID to every event index...

Splunk query - update a field with first value of ...

How to add delete update tags using | rest command...

Could not understand Splunkd.log

Why does the query take so long to find time dura...

Splunk Query with complex join and groupBy

Re: Want results onload for unique scenario

Re: Want results onload for unique scenario

Re: Want results onload for unique scenario

Re: Want results onload for unique scenario

Re: Want results onload for unique scenario

Want results onload for unique scenario

Re: Convert saved search to inline search

Convert saved search to inline search

user addition issue

Re: List the entities that can be refreshed in spl...

List the entities that can be refreshed in splunkw...

Re: Why should i run reload auth every time i add ...

Re: Why should i run reload auth every time i add ...

Re: Why should i run reload auth every time i add ...

Why should i run reload auth every time i add user...

Re: How to create dynamic variable name?

How to create dynamic variable name?

How to Read Query results in JAVA SCRIPT in my Vie...

Re: How to add nrg in RAD

How to add nrg in RAD

Splunk Advanced Xml Editor

Re: User Permissions

User Permissions

Re: Splunk Python SDK unavailable from Google Code

Join the Conversation