Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About fk319
fk319
Builder
Member since:
10-19-2010
03-18-2021
Community Statistics
| Posts | 144 |
| Solutions | 10 |
| Karma Given | 66 |
| Karma Received | 43 |
| Member Since | 10-19-2010 |
Activity Feed
- Posted Re: How to use same set of filter value on multiple Dashboard on Splunk Dev. 03-16-2021 12:37 PM
- Posted Re: Pyton SDK custom command runing distributed instead of local only on Splunk Dev. 03-16-2021 12:34 PM
- Posted Running a script on the Search Head initiated from browser on Splunk Dev. 03-16-2021 09:58 AM
- Posted Re: Sending Splunk email alert with variable email address and variable subject values. on Splunk Enterprise. 08-11-2020 11:39 AM
- Posted Re: Splunk 8.0 sendemail/subsearch issues after upgrading on Splunk Search. 07-15-2020 01:25 PM
- Karma Re: Deployment Server - when app is redeployed, what is overwritten for Lowell. 06-11-2020 05:59 AM
- Karma Re: Use lookup table to populate otherwise empty rows for rmmiller. 06-05-2020 12:51 AM
- Karma How to disable realtime searches for the power user role? for skoelpin. 06-05-2020 12:49 AM
- Karma Re: App.conf version is empty on .spl file for dnamal. 06-05-2020 12:49 AM
- Got Karma for Re: What is the correct way to remove an item from restmap.conf ?. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Got Karma for using sendemail in a dashboard. 06-05-2020 12:49 AM
- Got Karma for using sendemail in a dashboard. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Karma Re: How abort a search based on a condition? for mmol. 06-05-2020 12:48 AM
- Karma How abort a search based on a condition? for reed_kelly. 06-05-2020 12:48 AM
- Karma Re: What is the difference between the metasearch and tstats commands? for cpride_splunk. 06-05-2020 12:48 AM
- Got Karma for Simple XML strips onclick from HTML button. 06-05-2020 12:48 AM
- Got Karma for Simple XML strips onclick from HTML button. 06-05-2020 12:48 AM
- Got Karma for Re: Simple XML strips onclick from HTML button. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 2 | |||
| 1 |
10-20-2017
12:51 PM
look at your _internal logs. splunkd, python and /var/logs. There will be something there.
index=_internal sendemail
... View more
10-20-2017
11:28 AM
<panel>
<title>inline search</title>
<table>
<search>
<query>| metasearch index=* OR index=_*
| stats count by index, host
| sendemail to="me@domain.com" sendcsv=false subject="index host"
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
... View more
10-20-2017
06:35 AM
2 Karma
I have a dashboard that I want to send an e-mail when the search finishes. When I do the search in the search dashboard, all works fine. When I do the search in the dashboard, I get several copies of the e-mail.
Has anyone experienced this and is there a way to fix this behavior?
... View more
09-14-2016
10:15 AM
Thank you, it gets me one step closer...
... View more
09-14-2016
07:20 AM
I have also tried, but it does not seem to help.
feature_id_element = /Placemark/@id
... View more
09-14-2016
05:53 AM
yes, thanks.
... View more
09-13-2016
09:42 PM
This is in greater than and less than signs. It did not copy well, even with & code.
<Placemark id="ID_00000">
... View more
09-13-2016
09:40 PM
I am using the id in the placemark for my featureIdField
I have tried in my transforms several variations:
feature_id_element = /Placemark
feature_id_element = /Placemark/id
feature_id_element = /Placemark[@id]
... View more
03-24-2016
08:52 AM
1 Karma
I worked:
https://answers.splunk.com/answers/378289/calling-java-script-from-dashboard.html
and
http://www.w3schools.com/jquery/event_on.asp
but was unable to get anything to work.
... View more
03-21-2016
06:27 AM
2 Karma
I am trying to do an onclick in a button in an HTML block in Simple XML:
<code>
<dashboard>
<label>Test Button onclick error</label>
<row>
<panel>
<html>
<div>
<button id="button" onclick="myfunction()" rover="dog">Click Here</button>
</div>
</html>
</panel>
</row>
</dashboard>
</code>
When it gets rendered, onclick is removed. Noticed I added a bogus tag and it was passed through.
<code>
<div id="row1" class="dashboard-row dashboard-row1">
<div id="panel1" class="dashboard-cell" style="width: 100%;">
<div class="dashboard-panel clearfix">
<div class="panel-element-row">
<div id="element1" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<div><button id="button" rover="dog">Click Here</button></div>
</div>
</div>
</div>
</div>
</div>
</div>
</code>
I am trying to execute a java script on demand from a link in an HTML panel.
Any ideas?
... View more
10-06-2015
09:25 AM
I was successful in generating a 300x300 rectangular grid.
I think this was excessive, and I would like to have a 100x100 grid, then 'zoom' into parts of my 300x300.
... View more
03-13-2015
08:28 AM
mostly it is a string concationation, "apache host: ".host
While host is common, often they include custom field extractions
... View more
03-12-2015
09:13 AM
My question comes down to this,
| eval str="1+2"
| eval sum=eval(str)
... View more
03-12-2015
08:13 AM
that is about it, my table will have something like:
eventtype,output
Apache,"""Apache host:"".host."" has "".count."" errors"""
I will do something like
[inputcsv Alerts | fields eventtype] | lookup Alerts eventtype | eval out={output} | table out
... View more
03-12-2015
06:50 AM
1 Karma
I have a table that I want to extract an expression from. The expression is quoted string with some fields in it. is there a way I can eval on a string. Something like this would be in my table:
"Apache host:".host." has ".count." errors"
... View more
04-23-2014
05:28 AM
in 5, I could include a "index=unix" in the search bar automatically.
... View more
02-12-2014
02:47 PM
I have events that have a start and an end. I would like to know how many events I have each second. so by computing before the report window an can count starts that have not ended yet, ie that are still running during my report window. I am using streamstats to count, I was not able to get meaningful data from eventstats.
... View more
02-12-2014
12:17 PM
I have a search that spans several minutes, but due to flashchart, I can only view a 1 minute window.
starttime="2/12/2014:0:0:0" endtime="2/12/2014:1:0:0"
| stats stuff
| search starttime="2/12/2014:0:10:0" endtime="2/12/2014:0:11:0"
This does not work, any suggestions?
... View more
01-16-2014
10:09 AM
I looked and looked and skipped the 'p's I guess. pow is what I was looking for, thanks...
... View more
01-16-2014
09:59 AM
I am using "bucket span=log1.1 Time" but it puts it bucket ranges, 1-1.1, 1.1-1.2, etc.
so I tried to use log(Time,1.1) but I could not fine the correct exp() function.
This works, "eval Time=exp(floor(ln(Time)))".
... View more
- Tags:
- expression
- math
10-15-2013
01:39 PM
Another option you may consider is
SourceType=”A” | stats values(A1) as A1, values(A2) as A2 by common_field
SourceType=”B” | stats values(B1) as B1, values(B2) as B2 by common_field.
and build the table later
transaction common_field | table common_field, A1, A2, B1, B2
My question is it quicker to use a summary indexes than the raw logs? Another option is to use two summary indexes, one is fields A's and the second is fields A and B.
I hope something here helps...
... View more
08-29-2013
07:37 AM
yannK, thanks for your help. It seems that there is a major network issue.
... View more
08-28-2013
09:21 AM
I am missing logs. My logs rotate faster than 5 minutes, anywhere greater than 1 min.
It seems that every 5 minutes the current log gets loaded, but when it rotates, the new file does not get loaded. If that file gets rotated before the 5 minute mark, then it gets missed.
Has anyone ran into this? is there a work around?
This is on a Universal Forward V5.0.4
... View more
