Hi Good day, I was trying to run a python script after a saved search has been executed. I have set it up on alerts settings in the search and reports but the script won't run. I have properly include my python script to $SPLUNK_HOME$/bin/scripts folder and make it executable using chmod. There was no logging in splunkd.log that the alert was executed or any errors that occur. Thanks ... View more

Good day Splunkers, I have successfully created a dashboard with Inpage Drilldowns using Splunk 6 Dashboard Examples. It uses a javascript and css file to drilldown on the same page. In my dashboard I have a timerange-picker which populates the time variables in my first/master search panels. My panels are on charts (line). I have manage to successfully control its drilldowns passing my click values to the next panels which is also a chart (line). How ever I wasn't able to pass the time variables on click, it still uses the time which I have set to my timerange-picker. I was thinking should I put another set of text inputs to hold the time variables on click, then use this on my drilldown search for my drilldown panels? Is there modifications to be made in the javascript file? Here's my sample code in the javascript file which pass the click values. // start submit click value on cpudrilldown1 view cpumainView.on('click', function(e) { e.preventDefault(); var newValue = e.data['click.name2']; // Submit the value for the host field unsubmittedTokens.set('form.host', newValue); submittedTokens.set(unsubmittedTokens.toJSON()); urlTokens.saveOnlyWithPrefix('form\\.', unsubmittedTokens.toJSON(), { replaceState: false }); }); // end I'm not familiar to what codes should I put, would you help me figure out what to do with this? It would be a great help. Thanks, -crt89 ... View more

Good day Splunkers, I would like to ask how can I add a Search Progress bar/indicator to my dashboard if I am using web framework (django). Is there an available django tag to make the indicator appear or a javascript code to be used or follow? This is needed for the users of the dashboard so that they would identify if the searches are still populating my charts/tables. In advancedxml there's a module that is easily be used to achieve this, that was I was using in the past. Hope you can share your procedures in making it achieve in a django/javascript view. It would be a great help. Thanks ... View more

Good day everyone, I am currently developing an app that displays a network diagram that consist of images. These images vary from the status of the element that will be pulled from Splunk. I am currently using Splunk 6 Web Framework. I was wondering what "Splunk View"/Wrapper should I use to render results as simple text and place them to a variable so I can pull them. This is what I am doing. I have a search that pulls the status of a network element, let say if the value of the element ranges from 0-70 this will output an eval field called icon with the image filename on it (ex. server-icon-good.png), 71-90 is warning and 91-100 is alert (server-icon-warning.png and server-icon-alert.png). Now in my html code I will put an <img src="/dj/static/sampleapp/images/-- results of my search --"> so that it will render the image depending on its current range. I found in the documentation using a DataTemplate view this seems achievable. Splunk 6 Web Framework. I did some test and I have manage to render the images. In my search the eval value of the field icon would be the whole image path (ex. my search | eval icon="<img src='/dj/static/sampleapp/images/server-good.png'>" etc.), this is my temporary solution. I was using sideview and rendering results are easier by using $results.[0].value$ and like commands. So I was wondering if this is also possible in Splunk 6 Web Framework other than the method I was using. It would be a great help for me as a developer who started using the new Web Framework. Thank you so much, ... View more

Hi good day all, I have been using this app:Splunk 6 Dashboard Examples I'm currently doing this Multi Select example available in the app. The simple xml code imports 2 javascripts (multi_select.js and multi_value_token.js). I have edited this scripts in order to populate the dropdown with the values I want. Works fine, so what I did was I need to create another xml with the same dropdown but different values to populate it. What I did was I have copied the 2 javascript files, rename it (multi_select_new.js and multi_value_token_new.js) and edit it again to display what values I want. I also edit my new xml importing the 2 new javascripts I needed, I did a restart of the service so that splunk will know I have put 2 new files. The problem is it won't show the Multi Select dropdown. I don't know much about javascripts so I don't know if I broke the code of the examples or where to troubleshoot my problem. I did check the source if the xml loaded the javascript (by checking in my browser then right click > view page source). Here's the code for the 1st set of javascripts on my 1st xml. multi_select.js require(['jquery','underscore','splunkjs/mvc','splunkjs/mvc/simplexml/ready!'], function($, _, mvc, SimpleSplunkView){ //Instantiate our multi select view multiSelect = new MultiSelectView({ "id": "multi_value_input", "value": "$submitted:multiToken$", "el": $('#multi_value_input'), "labelField": "sourcetype", "valueField": "sourcetype", "managerid": "multiSearch" }, {tokens: true}).render(); //Run the search the multi select is looking for var multiSearch = new SearchManager({ "id": "multiSearch", "earliest_time": "-15m", "status_buckets": 0, "search": "index=_internal | stats count by sourcetype", "cancelOnUnload": true, "latest_time": "now", "auto_cancel": 90, "preview": true }, {tokens: true}); } ); multi_value_token.js require(['jquery','underscore','splunkjs/mvc','splunkjs/mvc/simplexml/ready!'], function($, _, mvc, SimpleSplunkView){ //Grab the instance of the token model for submitted tokens var submitted = mvc.Components.get('submitted'); //When the token bound to the multi value input changes recompute the query submitted.on('change:multiToken',function(submitted, value) { setMultiTokenQuery(value); },this); var setMultiTokenQuery = function(value){ //Handle the default cases, if we aren't passed a value, search everything value = value || []; if (value.length === 0) { value.unshift(""); } //Produce the search query and set the token var multiTokenQuery = value.join(' OR BSCNAME='); submitted.set('multiTokenQuery', multiTokenQuery); }; //Set the initial value for the query. setMultiTokenQuery(submitted.get('multiToken')); }); 2nd set of javascripts multi_select_new.js require(['jquery', 'underscore', 'splunkjs/mvc', 'splunkjs/mvc/multiselectview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/simplexml/ready!'], function($, _, mvc, MultiSelectView,SearchManager){ //Instantiate our multi select view multiSelect2 = new MultiSelectView({ "id": "multi_value_input", "value": "$submitted:multiToken$", "el": $('#multi_value_input'), "labelField": "Site_ID", "valueField": "Site_ID", "managerid": "multiSearch" }, {tokens: true}).render(); //Run the search the multi select is looking for var multiSearch2 = new SearchManager({ "id": "multiSearch", "earliest_time": "-15m", "status_buckets": 0, "search": "| inputlookup new_TAMIT.csv | dedup Site_ID | fields BSCNAME, Site_ID | addcoltotals labelfield=BSCNAME label=None | eval Site_ID=if(BSCNAME="None","None",Site_ID)", "cancelOnUnload": true, "latest_time": "now", "auto_cancel": 90, "preview": true }, {tokens: true}); } ); multi_value_token_new.js require(['jquery','underscore','splunkjs/mvc','splunkjs/mvc/simplexml/ready!'], function($, _, mvc, SimpleSplunkView){ //Grab the instance of the token model for submitted tokens var submitted = mvc.Components.get('submitted'); //When the token bound to the multi value input changes recompute the query submitted.on('change:multiToken',function(submitted, value) { setMultiTokenQuery(value); },this); var setMultiTokenQuery = function(value){ //Handle the default cases, if we aren't passed a value, search everything value = value || []; if (value.length === 0) { value.unshift(""); } //Produce the search query and set the token var multiTokenQuery = value.join(' OR Site_ID='); submitted.set('multiTokenQuery', multiTokenQuery); }; //Set the initial value for the query. setMultiTokenQuery(submitted.get('multiToken')); }); my 1st xml code <dashboard script="multi_select.js, multi_value_token.js"> <label>BSC Manager</label> <!-- Leverage row grouping to put the input in the panel --> <row grouping="2"> <!-- Use an html panel to have a place for multi_select.js to put the multi select --> <html> <label>Filter by BSCNAME:</label> <div id="multi_value_input"/> </html> <!-- multi_value_token.js will produce the $multiTokenQuery$ token --> <table> <title>Current Selected BSC</title> <searchTemplate>| inputlookup BSC_SITE_ID_LIST.csv | dedup BSCNAME | fields BSCNAME</searchTemplate> <drilldown>off</drilldown> </table> </row> <row> <table> <title>Selected Values</title> <searchTemplate>| inputlookup new_TAMIT.csv | dedup BSCNAME | search BSCNAME=$multiTokenQuery$ | fields BSCNAME | lookup new_TAMIT BSCNAME OUTPUT Site_ID | mvexpand Site_ID | dedup Site_ID | outputlookup BSC_SITE_ID_LIST.csv | fields Site_ID</searchTemplate> <drilldown>off</drilldown> </table> </row> </dashboard> 2nd xml code <dashboard script="multi_select_new.js, multi_value_token_new.js"> <label>Sites Manager</label> <!-- Leverage row grouping to put the input in the panel --> <row grouping="2"> <!-- Use an html panel to have a place for multi_select.js to put the multi select --> <html> <label>Filter by Site ID:</label> <div id="multi_value_input" /> </html> <!-- multi_value_token.js will produce the $multiTokenQuery$ token --> <table> <title>Current Selected Site ID(s)</title> <searchTemplate>| inputlookup BSC_SITE_ID_LIST.csv | dedup Site_ID | fields Site_ID</searchTemplate> <drilldown>off</drilldown> </table> </row> <row> <table> <title>Selected Values</title> <searchTemplate>| inputlookup new_TAMIT.csv | dedup Site_ID | search Site_ID=$multiTokenQuery$ | fields Site_ID</searchTemplate> <drilldown>off</drilldown> </table> </row> </dashboard> Hope you can help me with it. Thanks, -crt ... View more