Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About faustf
faustf
Communicator
Member since:
11-21-2016
10-04-2023
Community Statistics
| Posts | 57 |
| Solutions | 2 |
| Karma Given | 8 |
| Karma Received | 3 |
| Member Since | 11-21-2016 |
Activity Feed
- Got Karma for Why the error "Failed to load resource: the server responded with a status of 404" when following the tutorial?. 10-03-2024 04:31 AM
- Posted Re: Create a timeline table on Splunk Search. 10-03-2023 10:52 PM
- Karma Re: Create a timeline table for richgalloway. 10-03-2023 10:48 PM
- Posted How to create a timeline table? on Splunk Search. 10-01-2023 11:49 AM
- Karma Message "Eventtype 'wineventlog-ds' does not exist or is disabled" appears in splunk app for *nix for gregbo. 06-05-2020 12:48 AM
- Karma Re: Unexpected behaviours dropdown for rjthibod. 06-05-2020 12:48 AM
- Karma Re: How to edit my timechart search to create a vertical line? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Default Alerts dashboard replaced by Splunk app for *nix for bohanlon_splunk. 06-05-2020 12:48 AM
- Got Karma for Why the error "Failed to load resource: the server responded with a status of 404" when following the tutorial?. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk app dashboard list disappeared. 06-05-2020 12:48 AM
- Karma Is there any way to overlay vertical lines for event marking in Splunk timecharts? for aramirez_evolut. 06-05-2020 12:47 AM
- Karma Issues with Splunk_TA_nix permissions when using deployment server on Windows 2012 server for selim. 06-05-2020 12:46 AM
- Karma How can I reload a view I'm editing without restarting Splunk? for jrodman. 06-05-2020 12:45 AM
- Posted Re: Adding new email address to Splunk Profile on Security. 04-25-2019 08:06 AM
- Posted Re: Adding new email address to Splunk Profile on Security. 04-25-2019 08:02 AM
- Posted Re: Why is the nodejs unable to perform a number of sequential queries? on Splunk Search. 04-10-2018 11:45 PM
- Posted Why is the nodejs unable to perform a number of sequential queries? on Splunk Search. 02-05-2018 05:04 AM
- Posted Re: Why is the SDK Javascript auto_cancel expiring after 10 minutes? on Dashboards & Visualizations. 02-05-2018 04:10 AM
- Posted Why is the SDK Javascript auto_cancel expiring after 10 minutes? on Dashboards & Visualizations. 02-05-2018 03:10 AM
- Tagged Why is the SDK Javascript auto_cancel expiring after 10 minutes? on Dashboards & Visualizations. 02-05-2018 03:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-23-2017
07:47 AM
It was already an overlay
... View more
02-23-2017
07:31 AM
As I wrote in the comments, it isn't.
... View more
02-23-2017
07:30 AM
This is what I want but there is a problem, a line is missing, check the picture.
If I remove "| appendpipe ..." the graph is drawn right but, of course, there isn't the test point.
... View more
02-23-2017
06:58 AM
Thanks for your comment. Do you also have an Idea to how solve my problem?
... View more
02-23-2017
06:57 AM
I noticed if I use this query :
index=myindex ALARM="ALARM" [| gentimes start=-1 | eval earliest = relative_time(1487770130,"-15m") | eval latest = relative_time(1487770130,"+1m") | return earliest, latest] | timechart count | eventstats max(count) as Fault | eval Fault=if(_time=1487770130, Fault,null)
I saw what I want (the yellow point at 1487770130), but if I change, for example, the latest time
from
eval latest =relative_time(1487770130,"+1m")
to
eval latest =relative_time(1487770130,"+5m")
The yellow point disappear. Does anyone knows why?
... View more
02-23-2017
12:04 AM
Thank you for you answer but I think that I don't explained myself well because this is not exactly what I'm looking for.
What I'm trying is to create a VerticalLine, or a point, or a Mark at a specific TimeStamp of the chart.
In this case I want a Vertical Line ( if it is not possible a visible point/mark on the graph should be ok) at ** 1487771030** (the time interval of my query is from 1487771030 -15minutes, 1487771030+5minutes)
I talk about Max because to draw the Vertical Line should be at 1487771030 (X-axes) with MAX count (in y-axes)
In your solution I saw a point corresponding at the MAX Count value.
check the follow image:
Thanks
... View more
02-22-2017
12:53 PM
Hi guys,
I need to create a vertical line in a time chart.
I thought that I could use the following search to draw the vertical line:
index=myindex ALARM="ALARM" [| gentimes start=-1 | eval earliest = relative_time(1487771030,"-15m") | eval latest = relative_time(1487771030,"+5m") | return earliest, latest] | timechart count | eval test=if(_time==1487771030,100,10)
that produces the following chart:
I was expecting to see a vertical line at 1487771030
Of course, in the final search, the last part should be like this
| eval test=if(_time==1487771030,MAX,0)
Obviously this is not working.
The next question is "How can I calculate the MAX"
In this solution (if I will able to reach what I'm looking for) there is the following problem: The "test" line will be visible even when the _time is not equal to 1487771030
is there a better way to draw a vertical line in a time chart?
thanks
(I'm using Splunk 6.5)
... View more
02-22-2017
04:16 AM
Perfect.. Thanks.
It works even if I don't fully understand the query you wrote (| gentimes start=-1 .... |s$ ....).
Could you just explain it?
... View more
02-22-2017
03:23 AM
Hi guys,
I have this code:
<form>
<label>Fault Stats</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="dropdown" token="failureID" searchWhenChanged="true">
<label>FailureID</label>
<fieldForLabel>Date</fieldForLabel>
<fieldForValue>FailureID</fieldForValue>
<search>
<query>MYQUERY</query>
<earliest>0</earliest>
<latest></latest>
</search>
<change>
<eval token="failureID.earliest">relative_time($value$, $minBefore$)</eval>
<eval token="failureID.latest">value</eval>
</change>
</input>
<input type="dropdown" token="minBefore" searchWhenChanged="true">
<label>Time before fault</label>
<choice value="-1m">1 minute</choice>
<choice value="-5m">5 minutes</choice>
<choice value="-15m">15 minutes</choice>
<choice value="-1h">60 minutes</choice>
<choice value="-1d">24 hours</choice>
<default>-15m</default>
<initialValue>-15m</initialValue>
<change>
<eval token="failureID.earliest">relative_time($failureID$,$minBefore$)</eval>
<eval token="failureID.latest">$failureID$</eval>
</change>
</input>
<chart>
<search>
<query>MYQUERY</query>
<earliest>$failureID.earliest$</earliest>
<latest>$failureID.latest$</latest>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
</row>
</form>
That creates this panel:
The time range of the graph should be:
[LeftDropDownSelectedValue - RightDropDownSelectedValue, LeftDropDownValue]
Also every time That You change the selected value of dropdown Both the graph Should be redrawn.
At the beginning it seemed to work fine but, if you play a bit with the right dropdown I noticed two unexpected behaviours:
Some times the graph is not redrawn when the right dropdown value changes
After playing a bit with the right dropdown the graph interval is wrong (if you look at the previous picture I selected 1 minutes but the interval is 1 day)
Am I doing something wrong?
Thanks
... View more
02-22-2017
03:03 AM
you are right it worked.
... View more
02-22-2017
02:29 AM
This is working
<chart>
<search>
<query>index=myindex ALARM="ALARM" | timechart count</query>
<earliest>$failureID$</earliest>
<latest></latest>
</search>
<option name="charting.chart">line</option>
</chart>
But I need to subtract -15 minute from <earliest>$failureID$</earliest>
... View more
02-22-2017
02:14 AM
This seems interesting but I don't need to modify the dropdown, instead, I need to modify the query that create the line chart based on the value selected in the dropDown:
<panel>
<input type="dropdown" token="failureID">
<label>FailureID</label>
<fieldForLabel>Date</fieldForLabel>
<fieldForValue>FailureID</fieldForValue>
<search>
<query>myquery</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<chart>
<search>
<query>index=myindex ALARM="ALARM" | timechart count</query>
<earliest>$failureID$/1000 - 15 minutes</earliest>
<latest>$failureID$/1000</latest>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
is it possible?
... View more
02-22-2017
12:51 AM
Yes, the user select the failureID (that is my type of timestamp) in the dropdown (the token of the dropdown is $failureId$) and I what to perform a query to create a line chart using this time range: [$failureId$/1000000 - 15m, $failureId$/1000000 ]
... View more
02-22-2017
12:48 AM
The failureID is a TimeStamp like this: 1487753100000000 but to let Splunk treat this timestamp I have to perform this division: 1487749956/1000000 (sorry it is not 1000 but 1000000)
For example the following is a query that I created and it's working
index=myindex sourcetype="csv" Resource=myres myfield=* FailureID=* | eval _time=(FailureID/1000000) | table _time, myfield
Then I want to get all the logs that are between my (FailureIDTimestamp - 15 minutes) and FailureIDTimestamp.
... View more
02-21-2017
11:51 PM
Hi guys,
I'm trying to create a custom dashboard.
I've added a DropDown input with the following parameters:
token failureId
query= myquery
Field for label= Date
Field for Value= FailureID
I would like to create a graph line where the time range is between: ($failureId$/1000)-15minutes and ($failureId$/1000)
how can i configure the chart panel to perform this query?
thanks
... View more
02-20-2017
02:18 AM
1 Karma
Sorry.. my mistake.
I misspelled the name . "dashboards" in my data/ui/nav/default.xml
Thanks
... View more
02-20-2017
02:08 AM
Hi guys,
I've created a custom Splunk Application.
I've noticed that my dashboard list view desappeared.
is there a way to restore it?
Thanks
... View more
02-17-2017
07:20 AM
Perfect. It worked.
I used:
<script src="/static/app/<YOUR_APP_NAME>/home.js"></script>
... View more
02-17-2017
07:02 AM
I tried also:
- home.js
- /home.js
- /static/home.js
- static/home.js
What should be the right way to include the script?
... View more
02-17-2017
06:57 AM
Hi Guys,
I was creating my Splunk application. My folder structure is this one:
drwxrwxr-x 3 user user 4096 Feb 17 15:19 appserver/
drwxrwxrwx 2 user user 4096 Feb 16 17:29 bin/
drwxrwxrwx 3 user user 4096 Feb 17 14:02 default/
drwx------ 2 root root 4096 Feb 17 14:39 local/
drwxrwxrwx 2 root root 4096 Feb 17 11:04 lookups/
drwxrwxrwx 2 user user 4096 Feb 17 15:01 metadata/
drwxrwxr-x 2 user user 4096 Feb 17 15:30 static/
I've a script in appserver/static/home.js
I've an html script in default/data/ui/html/home.html
<!DOCTYPE html>
<html lang="en">
<head>
........
</head>
<body class="simplexml preload locale-en" data-splunk-version="6.5.2" data-splunk-product="enterprise">
<!--
BEGIN LAYOUT
This section contains the layout for the dashboard. Splunk uses proprietary
styles in <div> tags, similar to Bootstrap's grid system.
-->
<header>
.....
</header>
<div class="dashboard-body container-fluid main-section-body" data-role="main">
....
</div>
<script src="/static/home.js"></script>
I tried to incude home.js n different way:
-
But, looking at the chrome console, I've a 404 error
Also every time that I modify the .html I call http://localhost:8000/en-US/debug/refresh
What I'm doing wrong?
Thanks
... View more
02-17-2017
02:59 AM
Thanks, this helped!
... View more
02-17-2017
01:25 AM
Hi guys
I've defined my sourcetype, transforms and lookup in /opt/splunk/etc/system/local/props.conf and /opt/splunk/etc/system/local/transforms.conf (I set the lookup from the web interface).
Everything is working fine with the default Search and Reporting App.
After I created my customApp and if I perform the same search in the App, I can see the right source_type associated to my data but the regex that I defined in /opt/splunk/etc/system/local/transforms.conf is not applied.
Any suggestion?
Thanks
... View more
02-14-2017
03:22 AM
Hi guys
I'm not an expert of Splunk.
I was wondering if I can use a lookup to reference fields that are stored into another log file (not csv) indexed in Splunk
Let me explain:
I have a log file indexed in Splunk:
col1,col2,GCD1,col4,col5
col1,col2,GCD2,col4,col5
col1,col2,GCD3,col4,col5
I've another file always indexed in Splunk:
graph [
directed 1
node [
id 1
Node "Node1"
]
node [
id 2
Node "Node2"
]
node [
id 3
Node "Node3"
]
]
I need a new field when I search for the first file that match the GDCID with the id in the second file
col1,col2,GCD1,col4,col5,Node1
col1,col2,GCD2,col4,col5,Node2
col1,col2,GCD3,col4,col5,Node3
Is this possible?
Thanks
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-04-2023
05:58 AM
|
Karma given to
