About niketn

niketn · ‎02-18-2017

I have attached a screenshot with Total clicked and some other value clicked and printed using the following code. Can you try the following code? Can you ensure that you have your field value being tested for row.vendor is placed under dollar sign? Also the double quote in condition block should be escaped as written in the query. Value of Total being matched is case sensitive so if you are printing Total in loswer case you should mention the same as $row.vendor$. (Field Names are always case sensitive, so make sure vendor is lower case not upper. Try out the following code as it should run anywhere(query is on Splunk's _internal index so as far as you have access to query the same it should work.) <panel> <table> <search> <query>index=_internal sourcetype=splunkd | eval vendor=log_level | stats count by vendor | addcoltotals labelfield=vendor</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <condition match="$row.vendor$=="Total""> <set token="myTest">form.Vendor=*</set> </condition> <condition> <set token="myTest">form.Vendor=$row.vendor$</set> </condition> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> <html> <p>My Test Token=$myTest$</p> </html> </panel>

niketn · ‎02-18-2017

You need to blacklist your [WinEventLog://Security] input in inputs.conf blacklist= EventCode="4658" Refer to the documentation for using Whitelist and Blacklist in input.conf http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27 Also for specs and conf of inputs.conf please refer http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

niketn · ‎02-17-2017

In 6.5 Splunk has introduced an init section where token values can be defaulted. On form load you can code init section to unset the token so that your input is not rendered on Dashboard load. Later you can set it through Dashboard events like Search or Input or Visualization Events <init> <unset token="myToken"></unset> </init> <fieldset submitButton="false"> <input type="dropdown" token="selLogLevel" depends="$myToken$"> <label>Select Log Level</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>log_level</fieldForLabel> <fieldForValue>log_level</fieldForValue> <search> <query>index=_internal sourcetype=splunkd log_level=* | dedup log_level | sort log_level | table log_level</query> </search> </input> </fieldset> The above code will not render the dropdown. You can change from unset to set and it will render.

niketn · ‎02-17-2017

Following is a run anywhere example just change the App Name and Dashboard Name. In fact even if you do not have right app and dashboard you should be able to see the values being sent as Selected vendor column value or asterisk in case the same is Total. <panel> <table> <search> <query>index=_internal sourcetype=splunkd | eval vendor=log_level | stats count by vendor | addcoltotals labelfield=vendor</query> <earliest>-60m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <condition match="$row.vendor$=="Total""> <link>app/<myappname>/<MyTestDashboard>/form.Vendor=*</link> </condition> <condition> <link>app/<myappname>/<MyTestDashboard>/form.Vendor=$row.vendor$</link> </condition> </drilldown> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> If you want to test out whether the tokens are being set properly instead of link you can use set or eval for the same and print out the token using html <eval token="SelectedField">if($row.vendor=="Total","*",$row.vendor)</eval> Following is example of html section. Selected Field Name: $SelectedField$

niketn · ‎02-17-2017

You column name is vendor right?

niketn · ‎02-17-2017

You can try streamstats <Your Base Search> | streamstats count by IP reset_on_change=true Please refer to the documentation on the same: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats

niketn · ‎02-17-2017

Can you give timechart command you are using are you computing AverageValue ActualValue and Deviation value using the final timechart command or using stats/eval prior to that? In case you already have computed average Actual and Deviation prior to the timechart then based on the number of buckets per day for a month you might have to use values() or min() or max() or any other suitable command. For the deviation percent field, make sure it is numeric field to be plotted. Are you using Calendar Heat Map custom visualization or using JS/CSS extension?

niketn · ‎02-17-2017

Please try the following to default the vendor form token to asterix * in case clicked field value is Total. Assuming your app name is my_app and view name is details <drilldown> <condition match="$row.vendor$=="Total""> <link>/app/my_app/details?form.vendor=*</link> </condition> <condition> <link>/app/my_app/details?form.vendor=$row.vendor$</link> </condition> </drilldown>

niketn · ‎02-17-2017

Which version of Splunk are you using? For Splunk 6.5 onwards Table cell/row highlighting is built in by default. For previous versions you will require JS and CSS. I hope your logic to color rows based on severity is working, if not you can try refer to the Table Row Highlighting example provided with Splunk 6.x Dashboard Examples App which you can download from Splunkbase. Once you have made sure the row is getting highlighted based on range values, you can use fields option for table to show only required fields (in your case HostName). Add the following code to table section along with other options. This will hide Severity field from the table. <fields>HostName</fields> Also, looking at you Splunk search query, it would be better if you filter Blank HostName upfront rather than in the final pipe. <query>|search ApplicationID=165|table HostName,Severity| where HostName!=" "</query> Should be changed to or if possible in your base search before collecting stats. <query>|search ApplicationID=165 HostName!=" "|table HostName,Severity</query>

niketn · ‎02-16-2017

Can you try this \[(?<ComponentName>\w+)\]\s\-\s(?<Error>[\w|\s]+)\.(?<Reason>[\w|\s|:]+) Alternatively can you try Splunk Field extraction for specific scenario and let Splunk come up with the extraction. You can include non-matches and also remove incorrect match through interactive field extraction.

niketn · ‎02-16-2017

For me the above scenario worked on 6.5.1 after enabling drilldown=all for Single value visualization(which you have already done). <option name="drilldown">all</option> I was able to another Splunk dashboard in a new window using a pre-built panel with single value visualization with drilldown link in Splunk 6.5.1. I am not sure if this is issue with 6.4.1. Alternatively instead of trying <drilldown target="_blank"> Can you try? <link target="_blank"> However, both worked fine for me in 6.5.1. Following is the code I used. Prebuilt Panel (pre_built_panel_with_single_value_drilldown) <panel> <single> <search> <query>index="_internal" sourcetype="splunkd" log_level="ERROR" | stats count</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <link target="_blank">http://answers.splunk.com/search.html?q=$click.name2$</link> </drilldown> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> Dashboard Row with Pre-built Panel <row> <panel ref="pre_built_panel_with_single_value_drilldown"></panel> </row>

niketn · ‎02-16-2017

Based on the three samples provided, I could extract following meaningful information from your logs (ComponentName and ObjectName may be the same). In your Data ComponentName ObjectName and ModuleName are same for all three examples. So, you can replace these with actual text from your log and extract Reason which seems to be the only field you might be interested in based on your question. PS I have tested on Regex101. \[(?<ComponentName>\w+)\]\s\-\sError Occured in method (?<ObjectName>\w+)\.(?<ModuleName>\w+) and the exception is(?<Reason>.*)

niketn · ‎02-16-2017

Links can be attached to Dropdown change event for opening another page within Splunk or Web URL. Following is an example I have taken from Splunk Documentation (only added CDATA for Splunk internal link) <fieldset submitButton="false"> <input type="dropdown" token="openNewPageToken"> <label></label> <default>Select a page to open</default> <choice value="">Select a page to open</choice> <choice value="manager_page">View prebuilt panels</choice> <choice value="splk_page">Open Splunk home page</choice> <change> <condition value="manager_page"> <link target="_blank"> <![CDATA[/manager/search/data/ui/panels?ns=-&pwnr=-&search=&count=25]]> </link> </condition> <condition value="splk_page"> <link target="_blank"> http://splunk.com </link> </condition> </change> </input> </fieldset> Refer to Splunk Documentation for details... I have asked for CDATA correction in the Documentation https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

niketn · ‎02-16-2017

Convert to the following. Timechart limits series to be plotted to 10 so that visualization is not too messy. However, if you know that you have just 20 sensors following should work | timechart count by SensorId useother=f limit=20 Alternatively, you can also set limit=0 to show n number of series.

niketn · ‎02-16-2017

What happens when you try index=ers sev=WARNING

niketn · ‎02-16-2017

You can try running stats for a specific period. Whichever Sensor is not listed you will not get in result. sourcetype=aaa source=bbb | table _time SensorId ParamA ParamB ParamC | stats count last(ParamA) as LastParamA last(ParamB) as LastParamB last(ParamC) as LastParamC by SensorId You can also run a timechart (only count will be meaningful). However, you will come to know if any sensor stops sending data and how ling have they not been sending. sourcetype=aaa source=bbb | table _time SensorId ParamA ParamB ParamC | timechart count by SensorId

niketn · ‎02-16-2017

You would need to escape $ with a backslash as shown in example below. If your fields are numeric try to fieldformat for formatting the results for display only (underlying value will not change only display will change.) Following is a run anywhere example. I have used cascaded replace to remove $ and Comma. | makeresults | eval Amount1="$12,000.00" | eval Amount2="$12,340.00" | eval Amount1=replace(replace(Amount1,"\$",""),",","") | eval Amount2=replace(replace(Amount2,"\$",""),",","") | eval Total = Amount1 + Amount2 | eval Total= "$".tostring(Total,"commas")

niketn · ‎02-16-2017

Since Sankey Diagram Custom Visualization is supported by Splunk can you open a case with Splunk? Meanwhile, if you need Sankey visualization in previous version of Splunk, please check out Splunk 6.x Dashboard Examples App which has an example on Sankey Diagram using JavaScript code that you can try out.

niketn · ‎02-14-2017

Please download Splunk 6.x Dashboard examples which has examples of using CSS to enhance your dashboards. There are several examples on Javascript and CSS extensions to Simple XML dashboards. The Custom Layout Example: Dark deals explicitly with CSS styling of dashboard.

niketn · ‎02-14-2017

First of all, I see no point of renaming count as count, unless you want it to be uppercase. like count as Count. Can you also verify the results with stats command instead of timechart <Your Base Search> | bin _time span=1d | stats count as Count by date_mday

niketn · ‎02-14-2017

Since you have used count it will be defaulted to 0 when there are no violations, hence $job.resultCount$ will have one row with the value of 0. Null search swapping through token will work when the search returns no results. For example if you add condition to search for Violations greater than 0 you will get null result or no results found. On top of the same you can use a combination of set/unset and depends and rejects to display/hide section of your dashboard when there are no Violations. tag=database tag=query action=failure | `find_NULL_fields` | stats count by _time, event_time, event_id, severity, src_ip, os_user, src_app, dest_ip, dest_host, db_name, db_schema, db_user, sql_command, object_type, error_code, action, query | bin _time span=24h | stats count by _time, db_user | where count > 14 | stats count as Violations | search Violations>0

niketn · ‎02-11-2017

Your query seems to be correct single quote or dollar both can be used for condition match block. Can you please try the following? Also print $row1_show$ somewhere in your form just to confirm whether you are actually setting the token to null and true or not. If you have used post-processing in your query, most likely you are sending stats and stats will default aggregates like count and distinct_count to 0, hence instead of setting null results, the query will actually send one result back with the aggregate defaulted to 0 instead of null. So please verify this by printing $row1_show$ either as part of Panel title or else under html panel. <done> <condition match="$job.resultCount$ == 0"> <unset token="row1_show"/> </condition> <condition> <set token="row1_show">true</set> </condition> </done>

niketn · ‎02-08-2017

You can use either or both for fieldColors and seriesColors with your set of colors to be consistent across your app. [Update] Following are built in Chart Coloring options (Refer to Chart Color Options in Splunk 6.x Dashboard Examples app) <option name="charting.backgroundColor"> <option name="charting.foregroundColor"> <option name="charting.fontColor"> <option name="charting.seriesColors"> You can use CSS to override styling as per your need as well. You can override svg segments using !important in CSS. (Refer to Custom Layout Example: Dark example in Splunk 6.x Dashboard Examples App. /* SVG */ .highcharts-container svg { background: #000; } .highcharts-container svg>rect:not(.block-background) { fill: #000 !important; opacity: 0.1; } .highcharts-container svg text:not(.single-result):not(.delta-label) { fill: #ccc !important; }

niketn · ‎02-08-2017

Button is not an input control available in Splunk. You either would need to use radio button with options yes/no or else drilldown event for the same pie slice twice to reset token. Please let me know if one of these may be possible option for you.

niketn · ‎02-07-2017

As far as you are not going to set the value from the second text box, you can use initialValue and default properties of the second text box to fetch value from first text box on its change event. In the following example I am looking for Text Box 1 value to be test to be populated to second text box. <input type="text" token="textBox1" searchWhenChanged="true"> <label>Text Box 1</label> <change> <condition match="$value$=="test""> <set token="texttok">$value$</set> </condition> </change> </input> <input type="text" token="cputok" searchWhenChanged="true"> <label>Text Box 2</label> <default>$texttok$</default> <initialValue>$texttok$</initialValue> </input>

Posts	6912
Solutions	1166
Karma Given	832
Karma Received	2453
Member Since	‎03-09-2015

How to avoid un-responsive dropdown input with 100...

How to enable drilldown from the Horizon Chart vis...

How can we create Tabs using Link List in Splunk w...

Splunk Add On builder not working on Mac but on Wi...

How to enable drilldown from the Outlier Chart vis...

[BUG] Built in token $message$ for <fail> Search E...

How do you make a table that reduces in height whe...

What is the expected behavior for Submit button wh...

App Certification criteria: I need help on the 64...

Parallel Coordinates Example has been named Locati...

Re: Custom Drill-down from Total Row

Re: I need to filter out logs that have "Account N...

Re: fieldset input depends not valid

Re: Custom Drill-down from Total Row

Re: Custom Drill-down from Total Row

Re: What is the best way to count the number of ti...

Re: Regarding implementation of Calendar visualiza...

Re: Custom Drill-down from Total Row

Re: How to assign color a table row based on a val...

Re: Regex to return full string or string untill f...

Re: Drilldown in prebuilt panel not opening a new ...

Re: Regex to return full string or string untill f...

Re: Is it possible to have drop-down choice value ...

Re: How do I find the latest value of multiple par...

Re: search broken in splunk 6.5

Re: How do I find the latest value of multiple par...

Re: Unable to add numbers because of currency sign...

Re: Sankey Diagram - Custom Visualization: Why I a...

Re: CSS reference

Re: Why does the timechart command display inconsi...

Re: Hide Row When Post-Process Search Returns Zero...

Re: Hide Row When Post-Process Search Returns Zero...

Re: Is it possible to change default colors for ch...

Re: How to use an "input type=button" to reset a t...

Re: How to pass token form one text box to another...

Join the Conversation