Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About harshal_chakran
harshal_chakran
Builder
Member since:
09-26-2013
08-01-2025
Community Statistics
| Posts | 206 |
| Solutions | 5 |
| Karma Given | 25 |
| Karma Received | 35 |
| Member Since | 09-26-2013 |
Activity Feed
- Posted How to achieve drilldown from Dashboard Studio with results field value passed to it as token? on Dashboards & Visualizations. 06-19-2023 06:02 AM
- Posted Why are we receiving asyncio.TimeoutError while setting up 'Splunk Add-on for Salesforce Streaming API'? on Splunk Search. 02-15-2022 05:29 AM
- Karma Re: How to identify where the Splunk roles - authorize.conf is located in an app for isoutamo. 02-15-2022 05:24 AM
- Karma Re: How to identify where the Splunk roles - authorize.conf is located in an app for gcusello. 02-15-2022 05:23 AM
- Posted How to identify where the Splunk roles - authorize.conf is located in an app on Splunk Search. 02-07-2022 08:42 AM
- Posted Re: How to find the indexes.conf and monitor stanza for certain indexes in multisite environment on Monitoring Splunk. 10-12-2021 12:14 AM
- Posted How to find the indexes.conf and monitor stanza for certain indexes in multisite environment on Monitoring Splunk. 10-11-2021 06:08 AM
- Got Karma for Re: How to get kvstore data using Splunk's REST API in CSV format?. 06-05-2020 12:50 AM
- Got Karma for How to get kvstore data using Splunk's REST API in CSV format?. 06-05-2020 12:50 AM
- Karma Re: Why is KV store initialization failing after fassert() error in mongod.log? for scottrunyon. 06-05-2020 12:48 AM
- Got Karma for Re: what would be the cron expression when i want my alert to run in every 8 yours. 06-05-2020 12:48 AM
- Got Karma for Re: Why does my search return error "Unable to parse the search: Comparator '=' is missing a term on the right hand side"?. 06-05-2020 12:48 AM
- Karma Re: Cannot display the Plot from R on splunk for rfujara_splunk. 06-05-2020 12:47 AM
- Karma Re: How to create add-on and where to code for further processing for MuS. 06-05-2020 12:47 AM
- Karma Re: What is the recommended hardware Configuration and License requirement for below for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to replace column values in a CSV with static text? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to extract all values for a single field using rex? for wpreston. 06-05-2020 12:47 AM
- Karma Re: How to extract all values for a single field using rex? for wpreston. 06-05-2020 12:47 AM
- Karma Re: How to join two tables with default row if tables do not match? for sideview. 06-05-2020 12:47 AM
- Got Karma for Re: Merge Multiple Events into a Single Event. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
10-06-2016
11:52 PM
Hi,
I am using the Splunk's timepicker Date Range selection with token "timestamp".
In panel search, this token is used as :
index=xyz sourcetype=abc earliest=$timestamp.earliest$ latest=$timestamp.latest$
When I select before condition, the value passed to earliest is null and because of it no result is shown.
index=xyz sourcetype=abc earliest= latest=1475260200
I kept default earliest as 0 in fieldset, but null issue occurs again if I select some presets and then go back to Before Date Range selection.
One way I was trying to achieve it ,is to assign 0 value to $timestamp.earliest$ if its null. I have used following fieldset, but it didn't worked.
<fieldset submitButton="false">
<input type="time" token="time">
<label>Date Range</label>
<default>
<earliest>0</earliest>
<latest>1475260200</latest>
</default>
<change>
<condition match="$time.earliest$ == ">
<set token="$time.earliest$">0</set>
</condition>
</change>
</input>
Is there any way to do this.
... View more
09-27-2016
12:02 AM
Hi,
Iam trying to build the chart as below:
Here I am having two fields as X-Axis (one is Parameter and other is time)
Is there any way I could build this chart? I am using timechart with span of month to group but cant display Parameter.
... View more
09-22-2016
02:15 AM
Hi,
I have a python script which formats the json file and create a new file in another location. My splunk instance reads this new formatted file.
Is there any way we can use Splunk to take the not formatted file, run script on it and upload the same?
... View more
05-15-2016
11:28 PM
I am planning to get the extract fields count per index for past 7 days duration and then compare it with the fields count for today.
... View more
05-05-2016
11:23 PM
Hi, Trying to get the count of extracted fields per index. I am using the following search for this:
index=*|fieldsummary|stats count This gives me the entire list of all fields in all index.
Also "stats count by index" doesnt work as fieldsummary doesnt have index value. How can we get the field count per index.
... View more
07-07-2015
02:13 AM
Hi,
I am trying to achieve the below format in advanced xml
--MainSearch
---Pulldown with static options
----Postprocess search to load a table taking values from pulldown
When I do this, the postprocess search is not running.
Can anybody please help me with the sample code or the correct format to use?
... View more
07-01-2015
10:45 PM
1 Karma
Hi,
I have used inputcsv to get the following table
Parameter Value
p1 1
p2 2
p3 3
p4 0
Is there any way to add another column "Result" which tells me if "Value" column contains numerical 0, the "Result" value will be shown as "Red" else "Green"
i.e.
Parameter Value Result
p1 1 Red
p2 2 Red
p3 3 Red
p4 0 Red
Please Help...!!!
... View more
06-26-2015
05:06 AM
Hi,
I have a requirement in which i'll be receiving around 150 KB file every 15 min from 100,000 terminals
No. of Terminals which send files = 100,000
No. of Files Received per day from one terminal = 96
Approx. size of single file = 150 KB
So total data per day to be indexed = 1440 GB
I wish to know what will be the splunk recommended hardware configuration for the above requirement. Also i wanted to know the cost of per year as well as perpetual license cost for the said requirement.
Also if possible i would like to have the hardware and license cost for both Splunk Enterprise and Splunk Light.
... View more
06-09-2015
07:41 AM
1 Karma
Hi,
i have a table whose result is as below:
parameter value result
P1 V1 R1
P2 V2 R2
P3 V3 R3
P4 V4 R4
P5 V5 R5
And a lookup file as below:
parameter value result color1 color2
P1 V1 R1 C1 C2
def def def C3 C4
How can I join the two table? If the parameter value result doesn't match for both, then it should take the "def" row value.
Planning to get the result as below:
parameter value result color1 color2
P1 V1 R1 C1 C2
P2 V2 R2 C3 C4
P3 V3 R3 C3 C4
P4 V4 R4 C3 C4
P5 V5 R5 C3 C4
I have used the join , but doesnt displays the result as I expected.
Please Help...!!
... View more
05-29-2015
05:03 AM
Hi,
I am using a tab switcher from sideview utils.
My dashboard includes 4 Tabs. The TAB1 contains a table.
Is there any way to switch to TAB2 on click of table row in TAB1 and also passing an argument from that Table to the drop-down in TAB2,
Please Help...!!!
... View more
05-20-2015
11:38 PM
Hi,
I have one scheduled search which saves the output in a file "filename.csv" at specific interval of time.
index="myindex"|........|.....|outputlookup filename.csv
But what is happening now is that the complete file content is replaced with the new one, hence losing the old data from the file. I want to append the search result to the data already present in filename.csv
Please Help...!!!
... View more
04-17-2015
05:00 AM
Hi,
I have a dashboard in html code with one search query which provides the result in Single Numeric Value.
Is there any way that I can take the result of my search in some variable?
I want to display it in a JavaScript alert popup i.e. alert("my search result is: " + search_result_var) .
Which variable in html code of dashboard stores the search result.
Please Help..!!!
... View more
03-20-2015
08:53 AM
Hi,
I have a csv file as shown below:
DATE VALUE
1-Jan 2
02-Jan 3
04-Jan 5
05-Jan 4
06-Jan 7
07-Jan 88
08-Jan 09
09-Jan 77
10-Jan 7
11-Jan 66
12-Jan 34
13-Jan 234
14-Jan 23
15-Jan 4
16-Jan 4
I am creating a dashboard with time picker, where result is shown as per my time range selection.
I have used following xml code for the same.
<form>
<label>Timechart for drilldown</label>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true" token="dashboardTime">
<default>
<earliestTime></earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
<chart>
<searchString>|inputcsv NETWORK.csv|eval _time=strptime(DATE,"%d-%b")|table _time VALUE</searchString>
<earliestTime>$dashboardTime.earliest$</earliestTime>
<latestTime>$dashboardTime.latest$</latestTime>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.drilldown">all</option>
</chart>
</row>
</form>
No matter what I select, the complete result like 1-Jan to 16-Jan is always displayed in dashboard.
What wrong I am doing here.
Please Help...!!!
... View more
03-19-2015
07:49 AM
Hi,
You can refer to this link :
Define Eventtypes
... View more
03-19-2015
06:17 AM
Hi,
Try using this sample code below:
<form>
<label>Test Form</label>
<description></description>
<fieldset autoRun="true" submitButton="false">
<input type="text" token="limit" searchWhenChanged="true">
<label>Folder Name</label>
</input>
<input type="text" token="limit2" searchWhenChanged="true">
<label>Workflow Name</label>
</input>
<input type="text" token="limit3" searchWhenChanged="true">
<label>Session Name</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index="_internal"|eval text1="$limit$"|eval text2="$limit2$"|eval text3="$limit3$" |table text1 text2 text3</query>
<earliest>0</earliest>
<latest></latest>
</search>
</table>
</panel>
</row>
</form>
... View more
03-16-2015
09:05 AM
Thanks gfuente...
... View more
03-13-2015
03:07 AM
Hi,
I want to display the data only from last day's 6pm to next day 6pm.
I tried various forms of earliest and latest. But couldn't figure it out how.
Please Help...!!
... View more
03-12-2015
05:31 AM
Hi ,
I have a CSV file, whose visualization I want to see in the form of Pie-Chart.
But on display, one of the parameter is not shown. I am guessing the Pie-chart is hiding it because of its small value.
Below is my CSV file:
PARAMETER VALUE
ASDF 6
XCV 34
ERT 1
TDED 14
GHT 3
GHB 2
BNHJ 17
QWE 17
DDD 9
YYY 8
KLO 7
POL 2
YUO 82
TRYU 2
The Pie chart hides parameter "ERT" with value "1". while remaining ones are properly displayed.
What change I have to do to display every single value in Pie-Chart, even if its very small.
I have added this line in XML too:
charting.chart.sliceCollapsingThreshold = 0
, It removed the "others()" tag but didn't solved the issue
Please Help...!!!
... View more
03-12-2015
05:16 AM
I have changed the earlier and latest according to my data timestamp.
... View more
03-12-2015
05:14 AM
Yes, that last comma was the actual problem.
Thanks alexiri. It worked
... View more
03-11-2015
06:25 AM
Hi,
Sorry, It was typing mistake, its "Parameters" only
I am using the source code of the Gantt Chart visualization app. There I have inserted my search query which I mentioned above. And made the changes as per my understanding.
When I save the XML Source Code, no result is displayed.
... View more
03-11-2015
06:07 AM
Hi, I have a CSV file with start_time and end_time and the difference.
Parameters START_TIME END_TIME DIFFERENCE IN MINS
param1 1425485370 1425490179 80.15
param2 1425525368 1425528124 45.93
param3 1425462452 1425464795 39.05
param4 1425619254 1425620315 17.68
Here the start and end time both are in epoch format.
I want to built a Gantt chart, with Y axis as "Parameters" and X-axis as time over a day.
I have taken help from the Gantt Chart visualization app , but couldn't get through.
I have altered the source code as follows:
<form script="autodiscover.js">
<label>Gantt Chart demo</label>
<row>
<html>
<h2>Gantt Chart demo</h2>
<div id="demo-search"
class="splunk-manager"
data-require="splunkjs/mvc/searchmanager"
data-options='{
"search": { "type": "token_safe", "value": "|inputcsv myfile.csv |table Parameters, START_TIME END_TIME" },
"earliest_time": { "type": "token_safe", "value": "-4h@m" },
"latest_time": { "type": "token_safe", "value": "now" },
"cancelOnUnload": true,
"preview": true
}'>
</div>
<div id="demo-view"
class="splunk-view"
data-require="app/gantt/components/gantt/gantt"
data-options='{
"managerid": "demo-search",
"startField": "START_TIME",
"endField": "END_TIME",
"categoryLabel": "Parameters",
"categoryField": "Parameters",
}'>
</div>
</html>
</row>
</form>
Please Help...!!
... View more
03-09-2015
08:23 AM
1 Karma
Hi,
I have a CSV file as shown below:
PARAMETER VALUE
param1 val1
param4 val2
param2 val3
param1 val4
param7 val5
param2 val6
I want to replace all the values inside column named "PARAMETER" with text "common", so whatever values comes inside column "PARAMETER", it should be changed with text "common", Like below:
PARAMETER VALUE
common val1
common val2
common val3
common val4
common val5
common val6
Please Help...!!!
... View more
02-26-2015
02:47 AM
Hi,
I have already made the database connection.
What I am trying to make is a Database input. Following is my SQL Query:
SELECT * FROM MY_FILE {{ WHERE $rising_column$ IN (19123136031)}}
Here "MY_FILE" is my table and "FILE_ID" as my rising column.
But I am getting an error. When looked into the Splunkd.log, I found the following text msg:
ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://librarydb.catalog/T_FILE: Invalid column index with query = SELECT * FROM MY_FILE WHERE FILE_ID IN (1927016031)\r\r\nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17
What I am doing wrong here?
Kindly Help
... View more
02-25-2015
04:28 AM
Hi,
I am curious to know, what Splunk App and Add-on for ServiceNow provides more over the ServiceNow's own dashboard.
What extra features does it provide?
If somebody can give me some points or just the link. It would be very helpful.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-01-2025
07:43 AM
|
Karma from
