Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About LukeMurphey
LukeMurphey
Champion
Member since:
01-19-2011
08-26-2024
Community Statistics
| Posts | 895 |
| Solutions | 191 |
| Karma Given | 126 |
| Karma Received | 477 |
| Member Since | 01-19-2011 |
Activity Feed
- Got Karma for Re: Using Session Credentials in a Splunk React App. 08-25-2024 03:26 AM
- Posted Re: Using Session Credentials in a Splunk React App on Splunk Dev. 08-23-2024 09:33 AM
- Got Karma for Re: How to get the Audit for Lookup files modification using the Lookup File Editor App?. 03-25-2024 05:30 AM
- Got Karma for Re: File Metadata only indexing on Splunk Startup. 02-21-2024 03:35 PM
- Got Karma for Re: Universal Forwarder: How to install app and configure input.conf?. 11-01-2023 02:32 PM
- Got Karma for Re: How to show a custom icon for a single value module (such as a stoplight)?. 05-22-2023 01:42 AM
- Got Karma for Re: What is the distinction between "events" versus "results"?. 05-17-2023 11:26 AM
- Posted Re: No new input type as Google Spreadsheet after installing Google Import and Export App? on All Apps and Add-ons. 03-01-2023 10:21 AM
- Got Karma for Re: Is there an easy way to close out 150K+ incident events?. 01-13-2023 07:25 AM
- Got Karma for Re: How to install the Website Monitoring Splunk app ?,How to install the website monitoring app. 12-06-2022 02:24 AM
- Posted Re: Splunkbase Website Monitoring Configuration on Splunk Cloud Platform. 09-14-2022 08:28 AM
- Got Karma for Re: How do I clear the cache to see the changes after updating a Splunk application?. 09-06-2022 01:31 AM
- Got Karma for Re: Why can I not relaunch react component on Splunk App?. 06-23-2022 03:00 PM
- Posted Re: Why can I not relaunch react component on Splunk App? on Splunk Dev. 06-23-2022 02:42 PM
- Got Karma for Re: minimum required files for an app?. 04-19-2022 08:17 AM
- Posted Re: FTP Receiver with sftp protocol on All Apps and Add-ons. 04-05-2022 02:38 PM
- Got Karma for Re: Should the Splunk Common Information Model Add-on go onto indexers only, or should it be installed on forwarders and search heads too?. 11-17-2021 07:28 AM
- Got Karma for Re: How do I determine why a Correlation Search isn't creating a notable event when I expected one?. 11-05-2021 06:14 PM
- Got Karma for How do I determine why a Correlation Search isn't creating a notable event when I expected one?. 11-05-2021 06:14 PM
- Got Karma for Re: How do I clear the cache to see the changes after updating a Splunk application?. 09-28-2021 01:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 |
05-01-2013
08:13 AM
A couple of questions:
What version of Splunk are you using?
How are you generating PDFs (through the native PDF support in 5.0+ or with the old PDF Report Server)?
Let me know, I would like to get this reported immediately. Based on your answers, I might make a minimal repro so that this can get escalated quickly.
... View more
04-30-2013
08:59 AM
1 Karma
See this set of instructions to install Curl on Windows. You can also use the rest search command to access the REST API (provided you are using a Splunk account with admin privileges).
... View more
04-30-2013
08:56 AM
I am almost positive the answer is no.
However, it is easy enough to incorporate your own content into Splunk. Check out the app framework or the SDKs.
... View more
04-30-2013
08:17 AM
Can you let me know how you want to determine the style of the cell? I am unclear how you are going to stylize the contents based on the values if you don't have some knowledge about the potential values (I'm guessing you have some technique in mind).
... View more
04-29-2013
10:24 AM
2 Karma
Use the linksearch parameter.
See here for an example.
... View more
04-29-2013
10:16 AM
2 Karma
See "Color in a table based on values" for a method that allows you to colorize cells based on the contents. This works in simple and advanced XML.
You may want to take this a step further and colorize a cell based on the value of a previous cell. This is useful when you want a to stylize a cell according to something on the server (but not based solely on the contents of one cell). This technique would allow you to stylize a cell based on a value pulled in from a lookup.
For example, you could include a column called dest_class in your view and then use this column to indicate how the dest column ought to be stylized. You can do this via CSS once you are using the application.js specified in the other Splunk-Base answer above:
Define CSS to stylize the column next to the dest_class column
This CSS will style the cell in the column just after the "dest_class" column if "dest_class" is set to "internal":
.splView-YOUR_VIEW_NAME .SimpleResultsTable tr td.d[data-value="internal"][field="dest_class"] + td
{
color: #C42323;
font-weight: bold;
}
This should be placed in $SPLUNK_HOME/etc/apps/YOUR_APP/appserver/static/application.css.
Defined CSS to hide the dest_class column
There is a good chance that may want to hide the column that you are using to stylize the other column. You can do this with a little CSS. Note that this examples assumes that the column you want to hide is the 8th column (modify per your view):
.splView-YOUR_VIEW_NAME .SimpleResultsTable tr td:nth-of-type(8),
.splView-YOUR_VIEW_NAME .SimpleResultsTable tr th:nth-of-type(8){
display:none;
}
See https://github.com/LukeMurphey/splunk-website-monitoring/blob/master/src/appserver/static/application.css for an example of application.css where this techique is being used.
... View more
04-24-2013
10:06 AM
Do you have a snippet of code I could look at? I would like to reproduce this and see if I can figure out what is going on and if this is the same issue. Might help get some leverage to get this fixed if your issue isn't the same as mine.
... View more
04-24-2013
08:57 AM
I don't believe an app has been created for this purpose yet. I might work one up though, sounds like a good idea.
In the meantime, you could probably use a browser extension such as:
Tab slideshow for FireFox
Tab slideshow for Chrome
... View more
04-24-2013
08:46 AM
1 Karma
I have observed similar behavior with some of my apps (though I didn't use an accumulator widget). I believe this is some sort of defect. I escalated this to Splunk a few months ago and I know they did some work to reduce the number of calls. I don't believe this fix has yet been released yet though.
BTW: For those who were a little lost on what an accumulator widget is: it is a UI pattern consisting of two lists where you select items you want to include from another list. Otherwise known as "the thing where you have two boxes and you can move things in between".
... View more
04-23-2013
11:27 AM
Try using the entity name: http://www.w3schools.com/tags/ref_entities.asp
I'll update the answer accordingly.
... View more
04-23-2013
08:37 AM
1 Karma
I think you may just missing an amperstand between $click.value$ and form.example1:
<link>www.example.com?row.Type=$click.value$&form.example1=$form.example1$</link>
Make sure to use the XML entity for the amperstand (and other enitities) or use a CDATA block:
<link><![CDATA[www.example.com?row.Type=$click.value$&form.example1=$form.example1$]]></link>
... View more
04-22-2013
09:47 AM
1 Karma
The problem is that you included your own version of jQuery which is conflicting with the one that Splunk ships.
1. Use jQuery noConflicts mode
jQuery supports a mode call noConflict that allows you to use two version of jQuery without conflict. Mode info
2. Use Splunk's jQuery
You could try using Splunk's built-in version of jQuery. I'm guessing that you already tried this and found that this didn't work but it is worth a shot if you haven't tried it already.
3. Swap $
This solution is ugly so I don't recommend it if you can avoid it. You can replace $ with the newversion of jQuery temporarilly, and then swap it back. Here is an example:
<script src="/en-US/static/app/YOUR_APP/scripts/jquery.min.js"></script>
<script>
new_jquery = $;
old_jquery = $.noConflict(true);
$ = new_jquery; // Use the new jQuery for a moment
do_something_with_new_jquery();
$ = old_jquery; // Return to the original jQuery
<script>
... View more
04-18-2013
05:51 PM
You can influence using the manager. The manager retains the context of the app that you clicked the manager link from. In other words, if you open the manager from the search app then the config will be made in the search app. You can observe this in the URL; note that the URL below is the for the search app (see the third part of the path):
/en-US/manager/search/data/inputs/some_modular_input
The link below make the modular input in the app "some_other_app":
/en-US/manager/some_other_app/data/inputs/some_modular_input
I know that isn't what you probably looking for. But I confirmed that this does work.
... View more
04-18-2013
05:37 PM
1 Karma
Are you attempting to edit the file in the default directory? If so, you should be overriding the entries in default with a file in the local directory. See the docs for more info.
... View more
04-17-2013
09:25 PM
@carmenho92: That error is because the script expects the arguments in the format: ( ) [as ]
... View more
04-17-2013
08:41 AM
The ability isn't officially supported but you can manage with a bit of CSS. Just place CSS in $SPLUNK_HOME/etc/apps/YOUR_APP/appserver/static/application.css that hides the column. Below is an example below that hides the 8th column:
/*
* Hide the 8th column:
*/
.splView-YOUR_VIEW_NAME .SimpleResultsTable tr td:nth-of-type(8),
.splView-YOUR_VIEW_NAME .SimpleResultsTable tr th:nth-of-type(8){
display:none;
}
You will need to make that selector more specific if you have multiple tables on that page (just use the ID of the relevant SimpleResultsTable).
This technique works in simple XML and advanced XML.
... View more
04-17-2013
08:27 AM
Are you providing any arguments to your script? If you aren't then the script is likely failing at this line:
if len(sys.argv) < 2:
splunk.Intersplunk.parseError("No arguments provided")
That line expects that an argument has been provided (since the example expects an argument).
... View more
04-16-2013
03:20 PM
@jonuwz: good point.
... View more
04-15-2013
09:11 PM
Check out the eval and rename commands. These will you to make new fields and override the values of existing fields. No Python required.
If you do want to write a custom Search command, then check out these docs.
Edit - jonuwz And on the offchance you actually mean you need the SDK to connect to splunk, run a search then read the results - the SDK docs are here
... View more
04-15-2013
09:06 PM
Most of use the built-in sendemail command. You can configure the mail settings within the manager under System settings » Email alert settings.
... View more
04-15-2013
02:07 PM
What version of Splunk are you running on?
... View more
04-12-2013
10:56 PM
See http://splunk-base.splunk.com/answers/83206/color-in-a-table-based-on-values for a simple approach that allows you to use CSS selectors to update colors in SimpleResultsTable.
... View more
04-12-2013
08:22 PM
1 Karma
Look for the tiny "edit" link on the lower right of the page on Splunk-Base. Click it and you'll see the description under the "Short Description" section. The long description is on the same page; click the "edit" link under the long description section. The long description is posted under the short description on the app page.
... View more
04-12-2013
08:10 PM
1 Karma
You do this easily with props and transforms. Your props.conf will look something like this:
[host_from_message]
SOURCE_KEY = Message
REGEX = The session setup from computer '(.+)' failed because the security
FORMAT = hostname::"$1"
With a transforms.conf entry like:
[your_sourcetype]
REPORT-host_from_message = host_from_message
As @Ayn said, check the docs out. They are very helpful.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-26-2024
02:24 PM
|
Karma given to
