Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About LuiesCui
LuiesCui
Communicator
Member since:
02-04-2015
06-05-2020
Community Statistics
| Posts | 82 |
| Solutions | 2 |
| Karma Given | 6 |
| Karma Received | 7 |
| Member Since | 02-04-2015 |
Activity Feed
- Got Karma for How to search the names of triggered alerts, their trigger time, and the events that triggered them?. 08-16-2022 05:01 PM
- Karma Re: Violent file caching in Splunk 6.2.x for mitch_1. 06-05-2020 12:47 AM
- Karma Re: timechart shows 0 when there is no result for woodcock. 06-05-2020 12:47 AM
- Karma Re: Can't update images , JS or CSS for s2_splunk. 06-05-2020 12:47 AM
- Karma Re: add more title to dashboard for woodcock. 06-05-2020 12:47 AM
- Karma How to create a table in Sideview Utils where the rows expand to show more data? for lyndac. 06-05-2020 12:47 AM
- Got Karma for Re: Why can't I drill down a table with the _time column renamed or converted to a different format?. 06-05-2020 12:47 AM
- Got Karma for Re: Why can't I drill down a table with the _time column renamed or converted to a different format?. 06-05-2020 12:47 AM
- Got Karma for How to forward old data from a forwarder to a new Splunk index?. 06-05-2020 12:47 AM
- Got Karma for Dashboard Input Error When Time Is Set As "All Time". 06-05-2020 12:47 AM
- Got Karma for Dashboard Input Error When Time Is Set As "All Time". 06-05-2020 12:47 AM
- Got Karma for How can I change the timezone of a forwarder?. 06-05-2020 12:47 AM
- Karma Re: drilldown from a hidden column for Jason. 06-05-2020 12:45 AM
- Posted Re: Event log cannot be fully displayed in Field Extractor on Splunk Search. 03-10-2019 07:26 PM
- Posted Event log cannot be fully displayed in Field Extractor on Splunk Search. 03-09-2019 11:53 PM
- Posted Re: How to customize the sourcetype in java? on Getting Data In. 12-03-2015 05:25 PM
- Posted Re: How to customize the sourcetype in java? on Getting Data In. 12-02-2015 07:42 PM
- Posted Re: How to customize the sourcetype in java? on Getting Data In. 11-30-2015 05:37 PM
- Posted Re: How to customize the sourcetype in java? on Getting Data In. 11-29-2015 05:15 PM
- Posted How to customize the sourcetype in java? on Getting Data In. 11-26-2015 10:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-07-2015
06:43 PM
Thanks for your reply! I'm using a different user from the user who created the alerts. But the permission of all alerts is set as "display for app", and I'm sure I search it in the same app. And also as you can see in the first image, it shows the count 20. And if I search the search line in the second image without the "where" section, it shows the count 21 (which means it just doesn't meet the condition of triggering alert, not returning nothing). And all extracted fields' permission are set as either global or app. So is there anything wrong with my setting?
... View more
09-07-2015
03:37 AM
Hi, thank you for your reply! I kind of worked this out but got a new problem. Could you help me with this please? Thank you again. http://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html
... View more
09-07-2015
03:30 AM
Hi guys I got a problem with the results from the triggered alerts and I really need your help!
I have some alerts in Splunk and I want to know which alert is triggered and Why. So what I have done is to find all triggered alerts and get their triggered time by:
index=_audit action="alert_fired" | table _time ss_name trigger_time
For example, alertA will be triggered when the number of Error events in indexB is over 0, and it runs once an hour. What I'm doing is to take alertA's trigger_time, eval start_time=trigger_time-60min (which is the time when alertA starting counting Error events), and then count how many Error events in indexB with the trigger_time as latest, the start_time as earliest. So if I see alertA is triggered, I should get the result over 0 with the search.
But it's not going very well. When I see a record of alertA, if I check its detail from Triggered Alerts Page and click "view results", it does shows the result over 0. However, if I put alertA's search line into search and set the same time period as alertA, sometimes it shows no results, by which alertA should not be triggered!
The first image is what I get by clicking "view results" in Triggered Alerts Page and the second image is what I get manually. See I just copied the search line and search time to the search and got totally different results! By the way in the first image, the "|" at the end of the search line is the cursor, not a real "|". Same to one of the "|" before "where" of the search line inf the second image.
So anyone know what's wrong with it? Any suggestion will be appreciated!
... View more
09-05-2015
09:25 PM
1 Karma
Hi guys,
I have a problem with the triggered alerts and I really need your help!
Now, I have some alerts working great in my Splunk. To count the number of the alerts triggered in a period of time, I made a report with the search string like:
index=_audit action="alert_fired" | timechart count by ss_name
From this search string, I get the time and name of the triggered alerts as below:
But I also want to know the original events which triggered these alerts. All I want is a table with 3 columns. Column 1 shows the trigger time of the alerts, Column 2 shows the names of the triggered alerts, and Column 3 shows the events which triggered the alerts. How can I do that?
... View more
09-03-2015
11:05 PM
Thank you!
... View more
09-01-2015
06:45 PM
Thank you for your reply. So we can't do it with Website Input right? Any suggestion to do that?
... View more
08-30-2015
06:04 PM
need help...
... View more
08-28-2015
01:01 AM
Hi guys, I got a problem with the app Website Input and I really need ur help!
Well, I wanted to monitor a forum and get the list of the themes. So I tried the app Website Input (https://splunkbase.splunk.com/app/1818/) and it works well! Well not perfect.
If the content can be shown in the monitored website without logging in, the app works, but the app can't receive the content which only will be displayed after I log in. I filled out the authentication section like this (which really is the account of the monitored website) :
And it just doesn't work. What splunk gets is the content of what I can see before I log in. For Example, the website shows "a" before I log in and shows "b" after I log in. No matter if I fill out the authentication section or not or what I fill out, Splunk only gets "a".
Does anyone know how to solve this? And is there any other app to do that?
... View more
08-19-2015
02:56 AM
Yeah...tried firefox and worked. Thank you so much for this question!
Btw, can I use the same way to get/set tokens in js in the /appserver/static/components/forcedirected folder?
... View more
08-19-2015
02:37 AM
Yeah...tried firefox and workd. Well thank you so much on this qustion!
... View more
08-18-2015
06:37 PM
Sorry about the typo but gosh I still got "$remark$" after I corrected my code
var unsubmittedTokens = splunkjs.mvc.Components.getInstance("default");
var location = unsubmittedTokens.get("location");
console.log(unsubmittedTokens.get("location"));
unsubmittedTokens.set("remark",location);
And I stil saw "undefined" in browser console. Did I miss anyting in deps[] or parameters of the function?
... View more
08-18-2015
01:48 AM
Here is the dashboard xml :
<dashboard script="home2.js">
<label>solution2</label>
<set token="remark"></set>
<row>
<panel>
<input type="dropdown" token="location" searchWhenChanged="true">
<label></label>
<default>%</default>
<choice value="%">ALL</choice>
<choice value="%Page%">Page</choice>
<choice value="%Search%">Search</choice>
</input>
<input type="radio" token="issue" searchWhenChanged="true">
<label></label>
<default>%</default>
<choice value="%">ALL</choice>
<search>
<query>| inputlookup worklog.csv | where (location LIKE "$location$") | stats count by issue</query>
</search>
<fieldForLabel>issue</fieldForLabel>
<fieldForValue>issue</fieldForValue>
</input>
<table id="table">
<search>
<query>| inputlookup worklog.csv | where (location LIKE "$location$") AND (issue LIKE "$issue$") | table solution remark</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<fields>solution</fields>
</table>
</panel>
<panel id="chart1">
<html>
<div>
<p id="Remark">$remark$</p>
</div>
</html>
</panel>
</row>
</dashboard>
And the js:
var deps = [
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/utils",
"splunkjs/ready!",
"splunkjs/mvc/tableview",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/simplexml/ready!"
];
var db_boo = true;
var qt_boo = true;
require(deps, function($,mvc, TableView) {
var unsubmittedTokens = splunkjs.mvc.Components.getInstance("default");
var location = unsubmittedTokens.get("lotaciton");
unsubmittedTokens.set("remark",location);
mvc.Components.get('table').getVisualization(function(tableView) {
tableView.on('click', function(d) {
window.open("http://www.baidu.com");
d.preventDefault();
if(d.field=="solution"){
if(d.data["row.remark"]){
unsubmittedTokens.set("remark", d.data["row.remark"]);
} else {
unsubmittedTokens.set("remark", "");
}
};
});
});
});
... View more
08-18-2015
01:44 AM
In fact I got a input in my dashboard:
<input type="dropdown" token="location" searchWhenChanged="true">
<label></label>
<default>%</default>
<choice value="%">ALL</choice>
<choice value="%Page%">Page</choice>
<choice value="%Search%">Search</choice>
</input>
I think the default value of token "location" will be "%".
Then I editd my js ( let's ignore .on('click',function) by now ) as:
var unsubmittedTokens = mvc.Components.getInstance("default");
var location = unsubmittedTokens.get("lotaciton");
unsubmittedTokens.set("remark",location);
Theoretically when the dashboard is loaded, the token "remark" should get the value of token "location", which makes the div show "%" ( I tried "unsubmittedTokens.set("remark","aaa");" and it did show "aaa" in div). But actually the div shows "$remark$". This is why I think the "unsubmittedTokens.get()" is not working. Any ideas?
... View more
08-17-2015
08:31 PM
Actually i don't want to set the value of the token in js. Instead in this case, I want to get the value of the token "remark" (not the value of the column) from dashboard, in js see if its value is null or some other things, then change the value if it's null, then pass the token to the div to display.
Now the problem is, as I tried, "unsubmittedTokens.set("remark", "Initial Value");" works, which means I can set the value of tokens by js and that's great. However, on the other hand "var remarkValue = unsubmittedTokens.get("remark");" doesn't work, which means I can't get the value of token to js. This is what confuses me cuz I really wanna pass the token by this way.
And I think there are 3 events can be used in js: 1.clicking the table, 2.value changing of the token, and 3.value changing of the text of div. I don't know which one is better.
Ur code above works and I see "function(e)" and "e.preventDefault();" in ur code, what does it mean by "e"? Thank you so much!
... View more
08-17-2015
03:01 AM
Well of course I would like to set the value of the token but what I wanna do first is to pass a token from dashboard to js, then pass a related token back to dashboard. And I think the js didn't get the token cuz I tried the code above, and when I pass a token back to dashboard, it shows "value". What should I do?
... View more
08-17-2015
02:12 AM
Thank u for ur reply! Well, I check the console and it tells me
"Uncaught TypeError: undefined is not a function
Failed to load resource: net::ERR_CACHE_MISS "
I'm not sure what it means, and when I deleted line 12 to line15 of my js, the dashboard shows up. So I think the problem should be caused by the ".on('click',funtion{" staff. Any idea to fix it?
I also tried the way to pass the token as u said. Xml code remains the same and js code shows below:
var deps = [
"splunkjs/mvc",
"splunkjs/mvc/utils",
"splunkjs/ready!",
"splunkjs/mvc/searchmanager"
];
require(deps, function(mvc, utils) {
var unsubmittedTokens = mvc.Components.getInstance('default');
var remarkValue = unsubmittedTokens.get("remark");
//unsubmittedTokens.set("remark", "value"); I don't wanna set its value here
var remark = document.getElementById("Remark");
remark.innerHTML=remarkValue
});
Then the div shows "undefined" no matter what I click in the table. Is there anything I did wrong? Thx again!
... View more
08-16-2015
11:46 PM
Hi guys, I have a problem with drilling down the table and I really need ur help!
I have a simple xml dashboard here:
<row>
<panel>
<table id="table">
<search>
<query>| inputlookup worklog.csv | table solution remark </query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<fields>solution</fields>
<drilldown>
<set token="remark">$row.remark$</set>
</drilldown>
</table>
</panel>
<panel id="chart1">
<html>
<div>
<p id="Remark">$remark$</p>
</div>
</html>
</panel>
</row>
As u can see, there is a table and a div in the dashboard. What I wanna do is the content of the div will be changed and get the value of some fields of the search when I click any cells in the table. It works well but is not perfect. Before I click the table, the content of div will be "$remark$", which makes the dashboard really weird. In some events the column of "remark" return no result and the content of div will be "null". So I wrote a js to help this.
var deps = [
"splunkjs/ready!",
"splunkjs/mvc/searchmanager"
];
var db_boo = true;
var qt_boo = true;
require(deps, function(mvc) {
var table = document.getElementById("table");
var remark = document.getElementById("Remark");
table.on('click:cell', function(properties) {
if(remark.innerHTML=="null"||remark.innerHTML=="$remark$"){
remark.innerHTML="";
}
});
})
But after I add this js and refresh, the dashboard just keeps "loading" and shows nothing. Is there any way to fix it? And by the way, how can I pass the value of a token, for example "remark" in this case, to the js? The format of js is kind of different from what I know. What kind or type of js is it? Thx in advance!
... View more
08-13-2015
06:26 PM
Restarting splunk, debug/refresh, clearing browser cache work on the js and css in app/appserver/statics only, not on those in myapp/appserver/static/components/forcedirected. But restarting splunkweb works at last! Thank you both!
... View more
08-13-2015
01:16 AM
Hi guys, I'm new to splunk and I really need ur help!
I have some images in my app and I put them in myapp\appserver\static\img. The problem is, if I edit the image after I put it into myapp/appserver/static/img, it will never be updated. However, it will be updated once its file names is changed!
Same thing happens to the js and css in myapp/appserver/static/components/forcedirected. If I want to edit my js and css, I have to create a new app and put the edited js and css in it to make them work. But the js and css in app/appserver/static works just fine, which is really wierd.
I think the problem is that Splunk only loads the files once and won't reload them again. So what should I do to make Splunk reload them again?
... View more
08-05-2015
08:41 PM
In fact I just edited my comment a few minutes before your comment, and I asked why num2 didn't need to be subtracted ( silly me ). Anyway thx again!
... View more
08-05-2015
06:18 PM
I did choose "All time" so I tried "Last 24 hours" later. Well it shows the data of every hour by now but when one of the subquery returns nothing ( let's say column "num1" shows all 0 ), no matter if column "num2" should return something or not, column "num2" shows all 0, too.
... View more
08-04-2015
11:35 PM
In fact, sometime I face the same issue when I use the subqueries with different indexes. If so can I use your way? If yes, how?
... View more
