Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
03-14-2017
11:52 PM
@phillipmadm, looking at your sample events LOGOUT event in itself is complete as it also has the login details for example
Correlation Keys like - SessionId, User, Client_ip
And correlating fields like - Start_time, End_time, Duration
Also like you have mentioned so many other interesting fields are also present like LogoutMethod.
You can add LOGOUT to your base search to get only the logout event and then with override _time with Start_time and plot duration on the timechart. You can also consider using Timeline custom visualization to plot duration as Gantt Chart
<Your Base Search> LOGOUT
| eval Start_time=strptime(Start_time,"%m/%d/%Y:%H:%M:%S")
| eval _time=Start_time
| timechart max(Duration) as MaxDuration by User
You can try various by clauses apart from User like Client_ip, SessionId and even composite key like
eval Key=User." (SessionID:".SessionId.")"
PS: I have performed _time override with Start_time from your log since LOGOUT event has Logout time in the _time event by default.
Finally, if you want to display all Login/Logout you can use values(Duration) and preferably stats instead of timechart. Please try this and let us know how it goes.
... View more
03-14-2017
08:02 AM
@mblauw, can you please explain the reason for linebreak? Are you trying to parse/read JSON KV pairs?
If so, you can try spath command instead.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#7:_Extract_and_expand_JSON_events_with_multi-valued_fields
Also, as you have mentioned, if you are getting data file itself as json, Splunk should already do search time field extraction for you. Refer to KV_MODE settings for JSON data in props.conf.
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
... View more
03-14-2017
06:09 AM
@srichansen... the query that returns you multiple values. Can it be further granulated through any key field so that it only returns whatever value you have at index 0 and 1(preferably filter in the base search itself)?
... View more
03-14-2017
05:07 AM
In terms of documentation what I can suggest is going to the following for choosing correct method for correlation:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation
Please accept this answer if this has helped you, or else provide your own answer and accept the same.
... View more
03-14-2017
03:47 AM
@srichansen transaction command generates a field called duration which is the difference in seconds betwee first and last event in the transaction. Similar to transaction you can create a search using stats and compute your own duration using min(_time) as FirstStopDepartureTime and max(_time) and LastStopArrivalTime
... View more
03-14-2017
03:07 AM
@bharathkumarnec... You need to mark code using 1010 button so that it does not get removed from your post. I have updated my query with run anywhere search please try that out and let me know if I misunderstood your question.
... View more
03-14-2017
02:29 AM
@aqstevens... I had taken the field names from your previous query, can you please ensure that field name and case is same as that in your data being searched?
You can add the following before stats to make sure you are getting all the fields as required for stats.
| table _time Account_Name Source_Network_Address dest_nt_host New_Process_Name Process_Command_Line
Run the query with table command and without stats to ensure all fields being displayed as expected,
Then run the stats (match all the field names in stats command and run without search criteria to ensure stats is correlating events as expected.
Finally you can add in the search condition as per your need. Let us know how it goes.
... View more
03-14-2017
01:22 AM
1 Karma
With append it is matter of how many events subsearch has to parse rather than how many events it has to display. You ensure that you get only required events in your base search for both main and appended search. If you have to work only with one column have you tried appendcols instead of append?
Also if you run the two searches separately in verbose mode, do you still see issue with one or both of them?
... View more
03-14-2017
01:14 AM
Can you put in what you have tried? Also based on numeric fields that you are working with... in the first case whether you want the sum of two numbers xyz and abc in the first case or multiplication or concatenation?
Have you tried something like the following:
eval result=case(xyz>15 AND abc>15,xyz*abc,xyz>15 AND abc<15,xyz,xyz<15 AND abc>15,xyz,1==1,"both less than 15")
[Updated with run anywhere search]
Can you please try the following run anywhere search. As you can see if the value of xyz and abc is 15 it will hit default block with value Other. You can try changing values for xyz and abc to validate the case statement.
| makeresults
| eval xyz=15
| eval abc=15
| eval xyzabc=20
| eval result=case(xyz>15 AND abc>15,xyzabc,xyz<15 AND abc>15,abc,xyz>15 AND abc<15,xyz,1==1,"Other")
| table result
... View more
03-13-2017
10:35 PM
Are you on version 6.5 or later? Can you try something like the following to ensure token is populated?
<form>
<label>Report</label>
<init>
<set token="kpiTotalMS_SLA">6688</set>
</init>
......
<search>
<query>|makeresults
| eval baseline_ms=$kpiTotalMS_SLA$
| table baseline_ms
</query>
</search>
......
</form>
You can also print token as part of panel/visualization title or directly as html panel within any panel
<panel>
<html>
<div>baseline_ms: $kpiTotalMS_SLA$
</div>
</html>
</panel>
... View more
03-13-2017
09:11 PM
@Branden, I see that you have voted both Answers by @somesoni2 and me. Please accepted one of these which has helped you or else provide your own answer and accept so that the question is marked as solved.
... View more
03-13-2017
12:15 PM
1 Karma
@Branden... While the message JSON structure seems valid, outer JSON seems to be missing proper formatting and commas after each Key Value pairs. Is that how the data looks or is it typo while keying in example here?
Following data for me loaded successfully as json sourcetype and Splunk was itself able to extract all required field including inner jSON like message.authors{}.authorResourceID, message.warningReasons{} and message.invalidPublication etc.
{
"level": "warn",
"message": {
"invalidPublication": "Publication is valid for indexing at Elasticsearch and will be updated, but has warnings.",
"authors": [ {
"lastName": "foo",
"initials": "fb",
"firstName": "bar",
"authorResourceID": 99999 } ],
"title": "Some Title",
"warningReasons": [ "Invalid value for 'publicationDate' field [Sat Apr 01 2006 00:00:00 GMT-0500 (EST)], year not found in citation - dateComponents: [{\"year\":\"2008\",\"month\":\"6\",\"day\":\"2\"}].]" ]
},
"pid": "2888",
"sourceHostname": "somehostname.somewhere.com",
"timestamp": "2017-03-13 09:55:40"
}
Needless to say, spath is also able to extract the same.
... View more
03-13-2017
11:04 AM
1 Karma
They are very prompt with their reply. Just give them one business day.
... View more
03-13-2017
10:45 AM
Do you have unique id per message or per session or do not have unique id for correlation at all? What kind of user information do you have? Can you add some sample mocked up data?
... View more
03-13-2017
09:18 AM
2 Karma
You can try to get Splunk SDK for C# v1.0.x from the link below (supports VS 2012 .Net Framework 3.5 onward). However, version 1 is deprecated and is incompatible with current version 2. Splunk will be supporting until Sep 2016 (details on the link below).
http://dev.splunk.com/view/csharp-sdk/SP-CAAAEXR
... View more
03-13-2017
09:08 AM
1 Karma
@dmuraleetcs... Have you tried contacting [email protected] with your issue?
... View more
03-13-2017
09:05 AM
1 Karma
You can specify the inputs.conf with specific index on the Deployment Server. Based on the server class specific inputs.conf (and/or other configuration) files can be sent to various servers with Universal Forwarder.
Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver
... View more
03-13-2017
05:55 AM
@gerdhuber, Sorry I misunderstood your question. I have edited my answer below to reset the default Dashboard for specific user back to Choose a home dashboard option using user-prefs.conf. Please try out and let me know whether the same works for you or not.
... View more
03-13-2017
03:02 AM
@srichansen... Anytime! Glad it worked 🙂
... View more
03-12-2017
03:13 PM
@Tiago. I am hoping you have Threshold computed in the lookup file for the same duration/span being plotted through timechart on your base search.
Can you please try join instead of appendcols. Make sure the only the field required to be correlated is present in your base query/timechart from your saved search and also in the sub-search from the lookup file.
<search id="rootchart" base="StatusChart">
<query>
| timechart blablabla
| join
[ | inputlookup Thresholds.csv ] ..........
</query>
PS: You can also check appendpipe or append which should work as opposed to appendcols, however, might not fit your need.
... View more
03-10-2017
11:43 PM
@shabdadev were you able to try out the example? Is your issue resolved?
... View more
03-10-2017
01:50 PM
3 Karma
I was trying to use Custom Visualization API to build my own custom visualization using tutorial from Splunk Docs (similar available on Splunk Dev also : http://docs.splunk.com/Documentation/Splunk/6.5.2/AdvancedDev/CustomVizTutorial ).
Following is the error I received while trying to build Custom Visualization on Windows System.
> $SPLUNK_HOME/bin/splunk cmd node ./node_modules/webpack/bin/webpack.js
'$SPLUNK_HOME' is not recognized as an internal or external command,
operable program or batch file.
Following is the error from npm-debug.log
13 info lifecycle [email protected]~build: Failed to exec build script
14 verbose stack Error: [email protected] build: `$SPLUNK_HOME/bin/splunk cmd node ./node_modules/webpack/bin/webpack.js`
I was not sure if it is picking my SPLUNK_HOME path set in Windows, or has it been written only to work on Linux/Mac systems.
I have set both SPLUNK_HOME and $SPLUNK_HOME as the Splunk installation path on my machine(verified the same using echo command as below).
echo %$SPLUNK_HOME%
echo %SPLUNK_HOME%
Can anyone confirm whether Custom Visualization worked on Windows machine? If yes, what mistake do you think I might be doing while initial setup?
... View more
03-10-2017
12:24 PM
You can try rex to begin with for your field extraction on sample data like one you have provided
<Your Base Search>
| rex field=_raw "response\stime\s(?<ResponseTime>\d+)\sms"
| where ResponseTime>30
However, with you complete set of data, you should try Splunk Interactive Field Extraction to let Splunk figure out required regular expression for extracting Response Time from your events.
... View more
03-10-2017
12:15 PM
@srichansen... Sorry Field name inside eval should have been in single quotes. I miss typed as I was trying with other test names/values. I have updated my answer, can you please try once more?
... View more
