Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About pramit46
pramit46
Contributor
Member since:
04-07-2014
03-31-2022
Community Statistics
| Posts | 132 |
| Solutions | 6 |
| Karma Given | 80 |
| Karma Received | 17 |
| Member Since | 04-07-2014 |
Activity Feed
- Karma How do I route data to specific index based on a field? for melonman. 03-31-2022 07:29 AM
- Karma Re: What Capabilities do I need to enable so a user can change sharing permission on their searches? for mattness. 01-11-2022 03:07 AM
- Karma Re: Pass the label of an input to the title of a panel for BorisGrochalski. 08-31-2021 05:22 AM
- Karma Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension? for niketn. 06-10-2021 04:10 AM
- Karma How to capture only string and remove optional digits with regex for ncrs5699. 01-17-2021 11:31 AM
- Karma Re: How to capture only string and remove optional digits with regex for niketn. 01-17-2021 11:31 AM
- Karma Re: How to capture only string and remove optional digits with regex for woodcock. 01-17-2021 11:31 AM
- Karma Re: Installed Splunk Enterprise 7.2.1 and promoted it as cluster master. Splunk Web is not loading. for scheng_splunk. 11-09-2020 11:11 PM
- Karma Re: Installed Splunk Enterprise 7.2.1 and promoted it as cluster master. Splunk Web is not loading. for marend. 11-09-2020 11:10 PM
- Karma Search factor vs Replication factor-If I change my SF=2 , does this mean 2 copies are changed to primary? for jiaqya. 11-08-2020 10:50 AM
- Karma Re: Search factor vs Replication factor for jiaqya. 11-08-2020 10:50 AM
- Karma Re: search peers sick for chinmoya. 11-03-2020 11:12 PM
- Karma How to insert checkboxes in a simple statistics results table? for allan_newton. 07-06-2020 07:40 AM
- Karma Re: Why is KV Store initialization failing on one of our add-on to receive logs? for khusain_splunk. 07-02-2020 11:16 PM
- Karma Re: How to remove if ALL selection is selected in multiselect based on field for label not by Value? for kamlesh_vaghela. 06-11-2020 10:59 PM
- Karma Re: How to make a second download button for hallt3. 06-05-2020 12:50 AM
- Karma Re: What is the best way to pull out IP Addresses from a multivariate field? for HiroshiSatoh. 06-05-2020 12:50 AM
- Karma Re: How to set earliest time based on current time for mayurr98. 06-05-2020 12:50 AM
- Got Karma for How to Run a search using searchmanager (from javascript) when browser/tab closes?. 06-05-2020 12:50 AM
- Got Karma for Re: AND Condition to find the keywords in logs. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-18-2018
12:44 AM
1 Karma
You can try adding the following against each entry:
| appendcols [| datamodel <>|spath displayName | table displayName]
for example:
| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Web | appendcols [| datamodel Web |spath displayName | table displayName]
| append
[| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Malware| appendcols [| datamodel Malware |spath displayName | table displayName]]
| append ...
|eval ...
... View more
09-18-2018
12:14 AM
How about appending 'All' to your dynamic resultset, through the query and make it default value?
<Your search resultset>|append [|makeresults |eval columnname="All", columnvalue="*"]
then make this All as default value. you can do it from ui as well as from xml.
... View more
09-17-2018
11:59 AM
I don't think it's possible. Instead, you can try chart overlay option (I know, this is not what you want, but IMO, that is closest one to your requirement). That provides the option of axisY2. You can read more about it here:
https://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/ChartConfigurationReference
... View more
09-17-2018
10:36 AM
make sure you bump the server after doing the change, otherwise the js will not be loaded.
... View more
09-17-2018
10:32 AM
Try this:
<dashboard script="linktest.js">
<row>
<html>
<h1 id="link">Click Here</h1>
<div id="testDiv" style="display:none;"> <a href="http://www.google.com">go to google</a></div>
</html>
</row>
</dashboard>
linktest.js:
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/utils',
'splunkjs/mvc/tokenutils',
'splunkjs/mvc/simplexml/ready!'], function(_, $, mvc, utils, TokenUtils){
var tokens = mvc.Components.get('default');
$("#link").on("click", function (e){
console.log("link clicked....");
document.getElementById('testDiv').style.display = "block";
});
});
... View more
09-11-2018
03:14 AM
I am not sure what you mean by logging, but as far as forwarding is concerned, you can make it synchronized by changing the value of useACK to true. Additionally, you can also set values against the field readTimeout in order to specify how long the fwdr should wait for indexer response.
... View more
09-11-2018
03:06 AM
Can you please elaborate on this question? Are you talking about any custom dashboard?
Ideally, if your data is indexed, should be able to fetch the historical data. On the other hand, if you are fetching your data from some other systems using a restAPI call (or some similar ways), then you might need some mechanism to store it in order to show historical events.
... View more
08-27-2018
09:42 AM
I am making one assumption:
1. In the second condition you have provided, your host values are comma delimited (when they both come together).
Going by this assumption, I suggest you use a lookup to prepopulate the email ids based on host names and then call another splunk command sendemail . Here is a sample one:
| makeresults
| eval host="a,b"
| makemv host delim=","
| mvexpand host| lookup emaillist host as HOST OUTPUT email as EMAIL| sendemail to=EMAIL
Here even if your host value is only a or only b, it should still work. Lookup helps you managing the email ids without touching the query. However, you can also put some if-else logic in the query to get this done. But that may require changes in query, even if you want to update any spelling.
Let me know if this helps.
... View more
08-27-2018
02:39 AM
@jip31, you can keep this formula handy for future calculations:
1Terabytes = 1024Gigabytes
1Gigabytes = 1024Megabytes
1Megabytes = 1024Kilobytes
1Kilobytes = 1024Bytes
1Byte = 8Bits
You go downwards, you multiply by the number on the right side.
You go upwards, you divide by the number on the right side.
eg: 1
10 GB = 10*1024 MB
10 MB = 10/1024 GB
makes sense? Just keep in mind that people round it off to 1000 but in reality the number is 1024
... View more
08-27-2018
02:17 AM
I had posted a similar question in this forum earlier. I think you can take a look at that. See if it helps.
https://answers.splunk.com/answers/391097/where-do-you-install-the-influxdb-connect-app.html
... View more
05-29-2018
02:43 AM
@niketnilay,
I did try the donut chart. It is cool, but I want to try out the other visualizations in my dashboards, as well. Let me try to integrate the JS with simplexml.
... View more
05-29-2018
02:41 AM
1 Karma
okay. Let me try it in Simple XML. Thanks a lot @VatsalJagani
... View more
05-29-2018
12:32 AM
Sorry about the delay in replying..
So, after going through all the links and tutorials, I presume we cannot do this in simple XML, we need HTML dashboards to implement the custom visualization. Right?
... View more
05-26-2018
12:12 PM
I did see that. But that does not give me 3D and glossy look.
I am fine with online option.
Do you know how to do it?
... View more
05-26-2018
04:08 AM
I have seen the splunk document to integrate D3 sankey visualization into splunk and to be honest, not being a javascript expert, I find it very tough to implement it for another chart.
Can anyone help me understand how to integrate D3/Google charts into my dashboard? If not, can I at least get help in making my pie charts look 3D using google or D3 chart options?
... View more
04-03-2018
09:38 PM
Great. I see you broke it down to four steps. table & transpose | find today's value| combine| stdev
I guess, I messed up during the combining part. Thanks a lot for help in that.
And yes, I need the std dev for the population, not the sample. that's the requirement.
... View more
04-02-2018
05:24 AM
I have data like this:
`a----b----c----d`
`10----12----30----5`
`50----34----46----55`
`22----23----98----56`
`32----78----33----7`
Now my requirement is to get the stdevp of the first value of each row vs all the values on that row.
which means the output should be:
`stda----stdb----stdc----stdd`
`std(10,10)----std(10,12)----std(10,30)----std(10,5)`
`std(50,50)----std(50,34)----std(50,46)----std(50,55)`
`and so on...`
For this, what I have done is:
`base search`
`|table the fields`
`| transpose //to get all the similar values in one column`
`|rename 'row *' to 'r*' // just to avoid the space`
`|eventstats first(r1) as current_val`
`|eval x=mvzip(current_val, r1)| mvexpand x`
`|rex max_match=0 field=x "(?\d+)"`
`|streamstats window=1 stdevp(numbers) as stdDeviation`
`|fields r* current_val stdDeviation`
Here, this does the standard deviation correctly but I cannot move from r1 to r2 to r3. So far, I'm doing it manually. 😞
Foreach would not help since eventstats is present so can I use map to do the looping through the columns? if yes, how? I cannot handle the wildcard (r*)
... View more
03-29-2018
03:35 AM
okay. let's say, in the following dataset:
A----B----C
10----12----5
25----20----15
23----12----25
?----?----?
if I want to fix the first Row and populate the last row, then can I do it?
so in this case the last row would be:
(10-10=)0----(10-12=)-2----(10-5=)5
Basically the same thing, but row-wise.
I think this can be achieved by doing transpose, but with too many rows, transpose may not work well. Hence, asking.
... View more
03-29-2018
02:17 AM
Awesome!!
Thanks @nryabykh, can we also do it row-wise? I doubt, if it is possible.
... View more
03-29-2018
12:50 AM
my data is like the table below. Column C is what I need to calculate:
A----B----C
10----12----?
25----20----?
23----12----?
What I need in the column C is the difference between the first value and the all the values (including itself) in column A. So the values of the column C should be
10-10= 0
10-25= -15
10-23= -13
Any clue, how to do it? Please note that, Column B should not be included in this calculation.
I would also like to know the same can be done row-wise.
Not sure if the question statement clarifies the problem, if not, let me know in the comments, I'll try to clarify it further.
... View more
- Tags:
- splunk-enterprise
01-28-2018
07:26 PM
thanks a lot. but the predict command says cannot find the field avg. when I look into the timechart, I see due to breakup, it shows all the values of mygroupfield but no specific group called avg or avg(usage).
any idea what I can do for this?
... View more
01-27-2018
06:18 AM
I have disk utilization log for which i want to do prediction for next 3 days for the following levels:
location, client, server
Problem is timechart (which is required for the predict command) does not allow more than one field. How do i proceed?
I am using ml app.
My search command is something like this:
Search data| apply model|timechart avg(usage) as avg by location|predict avg future_timespan=3
How do i incorporate client and server in this so that i get prediction for each level?
... View more
11-20-2017
10:56 PM
I did not try this but I think this would also work. But since the trick I found out yesterday seemed less work, I chose that. But yes, I think this would also work. I liked this idea and may use this in future if needed. thanks a lot @kamlesh_vaghela
... View more
11-20-2017
02:41 AM
I read this trick somewhere and it worked for me:
index="idx" sourcetype="st" host="host"
| eval Port_str=toString(Port)
| search Port_str="1/0/44"
Now all I have to do is to use the drill-down parameter instead of "1/0/44" (just make sure you keep the quotes even around the parameter field name e.g.: "$parameter$")
... View more
11-20-2017
02:12 AM
I am supposed to get this value from another panel as part of drilldown. so I'm not sure how to apply your approach.
... View more
