About robertlynch2020

robertlynch2020 · ‎01-17-2019

Great and thanks

robertlynch2020 · ‎01-17-2019

Hi I am producing a table with time as the column header. However i can only use hour not the full date as i have to hard code it for the color to take effect. How can i make this dynamic so i can add date or use wild characters ? Example of the code i have written, very long and not great to look at. <format type="color" field="00:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="01:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="02:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="03:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="04:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="05:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="06:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> <format type="color" field="07:00:00"> <colorPalette type="list">[#6DB7C6,#F7BC38,#D93F3C]</colorPalette> <scale type="threshold">1,5</scale> </format> Thanks in Advance Robert

robertlynch2020 · ‎01-04-2019

Woodcock - happy new year 🙂 Thanks for info, but this did not work, i posed an answer.

robertlynch2020 · ‎01-04-2019

Thanks, but this did not work, i posted an answer.

robertlynch2020 · ‎01-04-2019

Hi I think i got to the bottom of this. So i think it is not possible to run this query from a button, this is why it was not working. It is possible to set a token `(SET_TOKEN_TO_BE_USED) from the button and then use that token in a query that will re-run when the token is set and giving the effect that the button is working. For Example - I set my token to the SPL of what i want SET_TOKEN_TO_BE_USED <html> <button class="btn" data-token-json="{"SET_TOKEN_TO_BE_USED":"| SPL_THAT_I_WANT_TO_RUN_WHEN_BOTTON_IS_PRESSED": true}">DEMO_BUTTON</button> </html> NEW QUERY (That will run when SET_TOKEN_TO_BE_USED is updated) <table depends="$never_show$"> <search> <query> $SET_TOKEN_TO_BE_USED$</query> <done> </done> </search> </table> I will 100% apply this solution and get back with an update Rob

robertlynch2020 · ‎01-04-2019

Hi Do you have an ETA for 7.2.4 as i am also waiting on this fix before i upgrade Cheers Robert Lynch

robertlynch2020 · ‎12-17-2018

sorry for delay. I can run the command form SPL and it works fine for me |index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv I can open the .csv file and i can see it is updated correctly. The issues is getting it to run when i press the button, am i missing something?

robertlynch2020 · ‎12-13-2018

Hi, I am trying to push data to a lookup table from a button. <html> <button class="btn" data-token-json="{"|index=main | head 1 | table _time | outputlookup JMAP_BUTTON.csv"}">JMAP_HISTO</button> </html> But nothing is happening... not sure As i have a more complex example and it works there: <html> <button class="btn" data-token-json="{"execute_save_test":"| eventstats max(ID) as max_ID | eval ID = if(isnull(ID),max_ID + 1,ID) | fields - max_ID | dedup ID | outputlookup Saved_Tests.csv", "saved_test": true}">Save new test</button> </html>

robertlynch2020 · ‎12-13-2018

Hi I want to run the script from a button on a dashboard. Running the RUN_TEST.sh from as an alert is working (Alert_test). Do i call the alert that will then call the .sh or can i call the .sh directly? Example of button. But i have no idea how to run the RUN_TEST.sh (splunk/bin/scripts/RUN_TEST.sh) <html> <button class="btn" data-token-json="{"execute_save_test":" RUN_TEST.sh }">RUN TEST SCRIPT</button> </html> Thanks in advance Rob

robertlynch2020 · ‎12-13-2018

cheers that worked perfect 🙂

robertlynch2020 · ‎12-12-2018

Hi, I am trying to run a basic script from an alert in /apps/splunk/bin/scripts/TEST_SCRIPT.sh #!/bin/sh DATE=`date '+%Y-%m-%d %H:%M:%S'` echo $DATE >> Date_test.log I am getting the following output, but the file Date_test.log is not getting bigger. When i run it manually i get output. Any ideas? I am in Splunk 7.0.3 2018-12-12 16:44:02,093 +0100 INFO runshellscript:222 - runshellscript: ['/bin/sh', '/hp737srv2/apps/splunk/bin/scripts/TEST_SCRIPT.sh', '6', '| tstats count where index="mlc_live" sourcetype="TPS" by _indextime host \n\t\t | stats sum(count) as No_Of_TPS_lines max(_indextime) as TIME by host \n\t\t | eval TIME=strftime(TIME,"%Y-%m-%d %H:%M:%S") \n\t\t | sort - host \n\t\t | table host No_Of_TPS_lines TIME', '| tstats count where index="mlc_live" sourcetype="TPS" by _indextime host \n\t\t | stats sum(count) as No_Of_TPS_lines max(_indextime) as TIME by host \n\t\t | eval TIME=strftime(TIME,"%Y-%m-%d %H:%M:%S") \n\t\t | sort - host \n\t\t | table host No_Of_TPS_lines TIME', 'SCRIPT_TEST', 'Saved Search [SCRIPT_TEST] number of events(6)', 'http://dell425srv:8000/app/murex_mlc/@go?sid=scheduler__admin_bXVyZXhfbWxj__RMD5a63ba5c7fea78f6c_at_1544629440_52364', '', '/hp737srv2/apps/splunk/var/run/splunk/dispatch/scheduler__admin_bXVyZXhfbWxj__RMD5a63ba5c7fea78f6c_at_1544629440_52364/results.csv.gz']

robertlynch2020 · ‎11-27-2018

Cheers my man 🙂

robertlynch2020 · ‎11-26-2018

HI This is what we did thanks. In the datamodel we put in if(isnull(GC_TIMESTAMP),_time-2592000+relative_time,_time) . So relative_time is the seconds and if no time stamp is there we go back 90 days and start from there. cheers

robertlynch2020 · ‎11-25-2018

One question. Do i need to install the apps onto the indexers(or part of them), or will index clustering take care of index creation and datamodel creation on the new indexers? Rob

robertlynch2020 · ‎11-25-2018

Thanks for the answer 🙂

robertlynch2020 · ‎11-25-2018

HI Cheers and thanks, i will give this a go. 🙂 This is how i was thinking i should give it a go. It was the getting my apps over bit i was not 100% sure, but it makes sence that i can just copy them - cool cool cool. Robbie

robertlynch2020 · ‎11-24-2018

Hi I was looking at the doc and it looks like it should move my current install to an indexer and reimport my apps to a new search head. SO I will try this and get back with updates Rob

robertlynch2020 · ‎11-24-2018

HI I started to us a Forwarder Management on a deployment server and it worked thanks 🙂 Robbie

robertlynch2020 · ‎11-24-2018

Hi I have worked out how to set up a distributed search on my beta site, but how do i move the current data "indexes" and "datamodels" off the search head to a new indexer? Current = One search head + one indexer on the same install Future = One search head + X indexers (New installs) + Original Indexer(With original data). As all my APPs are installed on the current install, i think it is best if I keep this search head and move the data to a new indexer(and put in the old data), then add on X new empty indexers - Right? So do I set up another Splunk install and copy over files from the original install to populate it? If so what files? /splunk/var/lib/splunk, perhaps, is this folder or maybe a subset? [How come i cant find doc on this? i can't be the first person to do this right?] Thanks in advance Robbie

robertlynch2020 · ‎11-23-2018

Thanks. I was incorrect in my understanding. - Thanks for the correction

robertlynch2020 · ‎11-23-2018

Hi What is the correct way to have datamodels for a distributed search? I have one search head and 2 indexers (Non clustered) distributed search. I have installed my app on search heads and indexers, with datamodels. On the indexers i can see the datamodels accelerated and they have a size, this makes sence and the data comes into the indexers->indexs and it is accelerated. I also have datamodels on my searchhead - should they be accelerated (If so they take 0 kbs) When i run On my search head | tstats summariesonly=true I get no results displayed, as the local datamodel is accelerated, but empty. So how do i get it to look at the indexers? 0.00 dispatch.stream.remote 142 - 904,298 0.00 dispatch.stream.remote.dell425srv_5000 67 - 427,241 0.00 dispatch.stream.remote.hp4000_5000 75 - 477,057 If i run below i get answers, but it is slow and not fast | tstats summariesonly=false I can see data from the indexers (But with false, it is slow, i need | tstats summariesonly=true => accelerated) 13.81 dispatch.stream.remote 508 - 4,215,762 6.92 dispatch.stream.remote.hp4000_5000 227 - 1,908,312 6.90 dispatch.stream.remote.dell425srv_5000 281 - 2,307,450 So - what is the correct way to have datamodels for a distributed search? Cheers Robbie

robertlynch2020 · ‎11-23-2018

Cheers i had the same issue 🙂

robertlynch2020 · ‎11-22-2018

Hi. In fact i need this to add to a datamodel, so i need to do it on index time if possible.

robertlynch2020 · ‎11-22-2018

Hi Thanks for the replay. I don't have a Deployment server nor cluster master - what one would be easier to apply, i am assuming i need to get one. http://docs.splunk.com/Documentation/Splunk/7.2.1/Updating/Planadeployment However i am reading that a deployment server cant be a search head also. My plan was to change things in my search-head and these changes get pushed out to my search nodes. So for example if i am logging into my search head and I make a change to my APP [Datamodel limits.conf etc..], I want this change to be take effect in my search nodes. So if this is not possible how does it work? So would a cluster master be easier for this? Thanks Rob

robertlynch2020 · ‎11-22-2018

Hi, I have a log that has a second counter inside it, 1 2...11... 3601...etc . So data i have 1 Data XXYXX 2 Data XXYXX 5 Data XXYXX 11 Data XXYXX 3601 Date XXYY etc... The issues is the log can be given to Splunk on one GO, so it might get 20K links in the same few seconds So I can't use INDEX TIME (As i think it will put all the events into the same few seconds, i need the data to be spread using the seconds in the file) So i need it to say 3600 seconds is 1 hour and give each event a different time stamp pending on the second counter..... ALSO...to make it more complex :):):). I don't want the time to go forward into the future — i would like it to start at the end and go backwards — or, set a negative 2 weeks as "0" and go forward...something like that... [Basally i don't want future events from now()] What i want Splunk to see for TIMESTAMP (Assuming we go back to start of month or something like that) 01/11/2018 12:00:01 1 Data XXYXX 01/11/2018 12:00:02 2 Data XXYXX 01/11/2018 12:00:05 5 Data XXYXX 01/11/2018 12:00:11 11 Data XXYXX 01/11/2018 13:00:02 3601 Date XXYY Any help would be super super stuff thanks Cheers in Advance 🙂 Robbie

Posts	656
Solutions	34
Karma Given	100
Karma Received	66
Member Since	‎11-05-2015

Online Status	Offline
Date Last Visited	‎02-11-2026 08:22 AM

How to Graph white space before and after my data ...

Can i create trellis with overlays, when the overl...

Can i have overlap on a Multi-series graph

Search for a path the might not exist

Joining Large JSON data fields into one Table

Splitting one row into multiple rows.

mvexpand is heavy is there another way

Can Archived Apps be installed onto Splunk Cloud

Extract some key-value pairs

Splunk Custom Visualizations apps end of life FAQ

Re: Add colors to a table for dynamic columns

How to add colors to a table for dynamic columns?

Re: Why can't I push my data to a lookup table fro...

Re: Why can't I push my data to a lookup table fro...

Re: Why can't I push my data to a lookup table fro...

Re: 7.1 Dashboards not converting timepicker to ti...

Re: Why can't I push my data to a lookup table fro...

Why can't I push my data to a lookup table from a ...

How do I run a script from a button on a dashboard...

Re: How do you run a script from an alert?

How do you run a script from an alert?

Re: How do I migrate data from a single install (s...

Re: How do you add a timestamp onto a log that has...

Re: How do I migrate data from a single install (s...

Re: How do I migrate data from a single install (s...

Re: How do I migrate data from a single install (s...

Re: How do I migrate data from a single install (s...

Re: What is the knowledge bundle deafult behavour?...

How do I migrate data from a single install (searc...

Re: What is the knowledge bundle deafult behavour?...

Data-models on a distributed search - Accelerate o...

Re: What do I look at in splunkd.log to troublesho...

Re: How do you add a timestamp onto a log that has...

Re: What is the knowledge bundle deafult behavour?...

How do you add a timestamp onto a log that has a s...

Join the Conversation