Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jensonthottian
jensonthottian
Contributor
Member since:
03-06-2015
06-05-2020
Community Statistics
| Posts | 115 |
| Solutions | 17 |
| Karma Given | 22 |
| Karma Received | 106 |
| Member Since | 03-06-2015 |
Activity Feed
- Got Karma for Re: How to search the Percentage and Count of Total by each range of a rangemap?. 01-30-2023 09:30 AM
- Got Karma for Re: Send emailed results to an email address IN the results.. 10-15-2020 03:53 PM
- Karma Re: calculate the days between 2 dates for MuS. 06-05-2020 12:48 AM
- Karma Re: User is gone - how to remove their reports and queries? for kmattern. 06-05-2020 12:48 AM
- Got Karma for Re: How to fix error "Forwarding to indexer group default-autolb-group blocked for 100 seconds"?. 06-05-2020 12:48 AM
- Got Karma for Re: How to fix error "Forwarding to indexer group default-autolb-group blocked for 100 seconds"?. 06-05-2020 12:48 AM
- Got Karma for Re: How to fix error "Forwarding to indexer group default-autolb-group blocked for 100 seconds"?. 06-05-2020 12:48 AM
- Got Karma for Re: How to fix error "Forwarding to indexer group default-autolb-group blocked for 100 seconds"?. 06-05-2020 12:48 AM
- Got Karma for Re: How to fix error "Forwarding to indexer group default-autolb-group blocked for 100 seconds"?. 06-05-2020 12:48 AM
- Got Karma for Re: After rebuilding a Splunk server, is there way to centrally tell all my forwarders to resend all logs prior to the system going down?. 06-05-2020 12:48 AM
- Got Karma for Re: Send emailed results to an email address IN the results.. 06-05-2020 12:48 AM
- Got Karma for Re: [Performance] What does exactly an indexer and a search head during a search ?. 06-05-2020 12:48 AM
- Karma Re: Syslog File Monitor - Issues with multiple monitor paths for tskinnerivsec. 06-05-2020 12:47 AM
- Karma Re: How to parse a JSON array delimited by "," into separate events with their unique timestamps? for s2_splunk. 06-05-2020 12:47 AM
- Karma Re: After upgrade to Splunk 6.3 : Dashboard single value elements are now off position. for frobinson_splun. 06-05-2020 12:47 AM
- Karma Re: How to compare and filter results from an inputlookup table? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Why is Hunk slower than Splunk when it has more nodes? for hsesterhenn. 06-05-2020 12:47 AM
- Karma Re: How do I schedule an alert to run every 12 hours? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to search a moving average of Errors for a 2 hour time period and alert if the number of errors goes 10% higher than the average? for woodcock. 06-05-2020 12:47 AM
- Karma Re: what happens to old events when props.conf is modified? for richgalloway. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
12-03-2015
02:15 PM
Hi Viswanath,
I used the image overlay with single value, in that way I didnt have to override the svg-container. Rewrote my dashboard.
Refer - in Splunk dashboard examples app combine :
Image overlay with single value
Custom decorations -first example
Regards,
Jenson
... View more
11-06-2015
10:08 AM
What metrics were you able to derive from the xml files. Will you be able to share some screenshots.
... View more
10-21-2015
11:57 AM
2 Karma
svg.svg-container
{
height: 75% !important;
width: 75% !important;
}
The above CSS addition did resolve my issue.
... View more
10-20-2015
10:44 AM
Can we override the below in custom CSS
svg.svg-container {
height=x% !important;
width=y% !important;
}
text.single-result
{
x=20.49 !important;
}
... View more
10-19-2015
02:45 PM
.single-value .single-result and .single-value:before are having line-breaks in between.
Dashboard visualization broke after upgrade to 6.3 for single value elements. Seems like the new svg container is adding some inline parameters to the single value element and creating line breaks between before and value.
XML
<label>tttttt</label>
<description/>
<searchTemplate>xxxxx
</searchTemplate>
<row>
<panel>
<single id="abc" >
<searchPostProcess>| where marketName="abc"</searchPostProcess>
<option name="classField">range</option>
<option name="field">Severity</option>
<option name="linkView">abc</option>
<option name="linkFields">result</option>
<option name="refresh.auto.interval">120</option>
<option name="refresh.time.visible">false</option>
</single>
</panel>
</row>
</dashboard>
CSS
.single-value .single-result {
font-size: 18px !important;
word-wrap: break-word !important;
font-family: sans-serif;
font-style: normal;
color: #6699CC;
}
.single-value:before {
font-family: "Splunk Icons";
font-style: normal;
font-weight: normal;
text-decoration: inherit;
font-size: 30px;
}
.dashboard-row1 #abc {
position: absolute;
left: 132px;
top: 356px;
}
... View more
09-03-2015
11:51 AM
Do you the dropdown list to show the Hours and Day available from your base search or this can be random.
... View more
09-03-2015
11:48 AM
2 Karma
It seems you have'nt used the token for the host selected in your search string .
use --Host="$host$" --instead of Host="*" ,throughout both the search strings.
... View more
09-03-2015
09:45 AM
3 Karma
1) If they rerun a script to get an output that replaces the old file. Will my dashboard only include the new information? Or does the old information stay indexed even though the file was deleted -
Is this output an CSV which is imported in Splunk? if yes then you will only have new CSV information at your disposal.
Is this output a text file which is forwarded to Splunk indexer? If yes, then if the old text file is forwarded to Splunk indexer before it is replaced by a new file you will have both old and new file at your disposal with different timestamps.
2) If my account is deleted so are my alerts and dashboards?
If your account is deleted all your private alerts and dashboards are not deleted. Since those are set as "private" permission, can be accessed and edited by an admin.
... View more
09-02-2015
12:07 PM
Agreed, sorry for the typo
it should be -- 0 3,15 * * * -- for 3am and 3pm everyday of every month.
-- 0 */12 * * * -- which means every 12 hours.
... View more
09-02-2015
10:27 AM
Not sure why you voted my answer down, "0 /12 " was in my initial solution.
... View more
09-02-2015
10:26 AM
Good to know that 🙂
... View more
09-02-2015
08:29 AM
Can you check if your CSS is operational or not, by converting your dashboard into HTML and directly adding your CSS in the HTML itself. This is a quick check to see if the CSS is good or not. Everything else seems fine to me.
... View more
09-01-2015
02:09 PM
If I understand your question correctly
Below is your current Config - 10 VMS with each having 8 Cores (5 primary and the other 5 as DR)
so currently your total core in primary is 5*8 =40.
What is your replication factor , concurrent search limit. How is your configuration change set - Replicated changes or Deployed changes. Does any of your search head instance/member have ad hoc only status.
You want to move to H/W which is 24 core's with 12 VMS as backup(96 cores). How many H/W in number? I think 4-5(preferred) such H/W should do the trick for you. F5 LB should deal with all other searches.
... View more
09-01-2015
11:40 AM
0 0 00/12 * * * - Use this in the cron
... View more
09-01-2015
11:36 AM
1 Karma
Use the search below:
`dmc_set_index_introspection` host=--yoursearchead-- sourcetype=splunk_resource_usage data.search_props.sid::* data.search_props.mode!=RT | `dmc_rename_introspection_fields` | stats max(elapsed) as runtime max(mem_used) as mem_used earliest(_time) as _time by sid, type, mode, app, role, user | eval mem_used = round(mem_used, 2) | eval day = round(runtime / (3600*24) - 0.5) | eval hour = round((runtime % (3600*24)) / 3600 - 0.5) | eval minute = round((runtime % 3600) / 60 - 0.5) | eval second = round(runtime % 60, 2) | eval time = day."d ".hour."h ".minute."min ".second."s" | sort 10 - mem_used | fields - runtime, day, hour, minute, second | eval _time=strftime(_time,"%+") | rename sid as SID, type as Type, mode as Mode, app as App, role as Role, user as User, mem_used as "Memory Usage (MB)", _time as Started, time as Runtime
... View more
09-01-2015
11:31 AM
that depends on the alert sampling, what is the time range you are doing it for. It has no relation with the cron schedule.
Please provide more information on your alert.
... View more
09-01-2015
11:25 AM
2 Karma
Two times a day, select cron schedule in alert.
0 3,15 * * * ? - That'll run a job at 3am and 3pm. That's twice a day, with 12 hours between.
You could use 0 0/12 * * * ? which means every 12 hours.
... View more
08-31-2015
08:17 AM
Did you try restarting splunkd?
... View more
08-26-2015
03:55 PM
1 Karma
Seems like a change happened in log configuration to stop logging for those events - check the log config's.
... View more
08-26-2015
03:50 PM
Why not enable the below hosts with wildcards :
splunk.com/* , splunkbase.splunk.com/*
... View more
08-26-2015
03:35 PM
1 Karma
If I am correct you have two time ranges to be compared in one report-
-http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/
Use date format instead of relative time.
... View more
08-25-2015
01:14 PM
check using _internal index as to what the old SH is being used for. You may want to move all the views, alerts, saved searches, report and apps from this SH, maybe create a backup.
... View more
08-25-2015
12:05 PM
Use transaction command as you have clear indication of events corresponding to start and stop.
| transaction processID(--unique ID for your events) startswith="started" endswith="completed"
... View more
08-25-2015
08:53 AM
If the field is not available, extract it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
