Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
01-02-2017
07:14 AM
Will you be able to add the source for Dashboard, which powers your panel? Are you using a token to represent data in a Visualization?
Maybe the token is not set which may result in undefined error during drilldown.
... View more
01-02-2017
06:48 AM
Is your expected output is host being first column or Message being first column?
I am not sure why have you used two statistics i.e. stats and chart when you are trying to just perform count.
Following should give you the results you are expecting.
<your base search>
| chart count by host env
| addtotals row=t col=f
PS:
1) If you want to reverse Column/Row split just reverse the by sequence i.e. chart count by env host
2) If you want to show column totals also then use change from col=f to col=t labelfield=host
... View more
01-01-2017
11:49 PM
You would need to reconsider your regular expression for field extraction. Assuming msg field contains the reason information that you want to extract:
<Your Base Search>
| rex field=msg "reason\\\"\=\\(?<reasonCode>\w+)\\\"(?<newmsg>\w+)\\\"\,"
| table appname, time, source_instance, msg, newmsg
| sort appname, time, source_instance, newmsg
If msg field does not have the reason as expected, you can replace msg with _raw i.e.
| rex field=_raw "reason\\\"\=\\(?<reasonCode>\w+)\\\"(?<newmsg>\w+)\\\"\,"
PS: Ideal you should move this to Field Extraction using Extract New Fields in Splunk Search or through Props.conf, once you have established that the regular expression is working as expected. For quick hints/testing regular expressions you can try regex101.
... View more
01-01-2017
05:11 AM
While exporting are you checking unlimited option?
On Splunk Enterprise 6.4 we have exported all events for backup and it did work as expected.
Based on your concern you definitely do not need reindexing of data and need to correct your question since MAX_EVENTS is not related to cvs export like I have mentioned before.
... View more
12-31-2016
08:24 PM
1 Karma
MAX_EVENTS are used for grouping multiple lines in Single Event when Splunk indexes data. Do you want 20000 lines to get grouped together as a single event in Splunk? Or is this issue more towards exporting as PDF where your search results has more than 20000 rows and you when you export you get only 10000 rows?
... View more
12-31-2016
07:58 PM
There are several splunk functions which will allow you to do "group by" of same field values like chart, rare, sort, stats, and timechart, eventstats, streamstats, sistats etc. Following is a comparison between SQL and SPL(Splunk Processing Language).
DB SQL Example
SELECT mycolumn, avg(mycolumn)
FROM mytable
WHERE mycolumn=value
GROUP BY mycolumn
SPL Example in Splunk
source=mytable mycolumn=value
| STATS avg(mycolumn) BY mycolumn
| FIELDS mycolumn, avg(mycolumn)
Refer to the Splunk documentation on transitioning from SQL to Splunk: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk
You would need to provide more examples of your data so that we can identify data type(based on source of data), field names and suggest query as per your need).
... View more
12-30-2016
12:12 PM
Did you look at my answer for your previous post where you can use use historical search but refresh every periodic interval like 5 minutes? It was option 2 where you did not have to use Real Time Searches.
... View more
12-30-2016
12:10 PM
Try some of the following:
1) Unchecking the "Original search included" option, see if it allows you to select.
2) If above does not work , Open the View in Search to check wither results are returned. Try increasing the date range.
3) If everything else fails you can manually create Field Extractions through Settings> Fields using the regex or Directly in the props.conf for your sourcetype.
... View more
12-30-2016
10:15 AM
Is there any reason why your results are being reversed for the same query?
Have you checked fields for same time stamp for both the searches?
... View more
12-30-2016
05:37 AM
1 Karma
Following should work for you,
1) LINE_BREAKER is not required since you have SHOULD_LINEMERGE turned off, which means each line will be a new event.
2) MAX_TIMESTAMP_LOOKAHEAD will look for number of characters defined to identify timestamp(in your case it is 28 characters after the TIME_PREFIX.
3) The same props.conf for your sourcetype should work for you even without INDEXED_EXTRACTIONS=json, only difference would be that automatic field extractions will not occur for JSON fields.
PS: There are several other props.conf properties which can be set for Timestamp and event extractions. like BREAK_ONLY_BEFORE, BREAK_ONLY_AFTER etc. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf
INDEXED_EXTRACTIONS =json
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N+%4N
TIME_PREFIX="observedTime":"
MAX_TIMESTAMP_LOOKAHEAD=28
... View more
12-30-2016
05:11 AM
Can you add sample events for Format 1 and Format 2 from your logs?
Have you tried Interactive Field Extraction in Splunk using Extract New Fields which generates dynamic regular expressions based on the need.
... View more
12-30-2016
04:19 AM
Hi @umsundar2015,
Will it be possible for you to give complete event as example i.e. whether there is a pattern before and pattern after the field you are trying to extract?
If not can you try Interactive Field Extraction to let Splunk generate regular expression for the required field extraction. In your test machine you can add some sample logs and use Extract New Fields option.
Refer to attached screenshot for a sample regular expression based IFX.
... View more
12-30-2016
03:23 AM
Following are some of the dashnoard/panel refresh options. I am not sure as to how to make this refresh work only betwee 8:30 to 5:30 PM.
1) Refresh entire view on periodic basis (following is for every 5 minutes)
<dashboard refresh="300">
or
<form refresh="300">
2) Individual Panel auto-refresh
(i) Splunk Enterprise 6.5 onward. Create your Search Panel and edit the search to add Auto Refresh Delay or do the same via Simple XML for specific Search Panel add following code
<refresh>5m</refresh>
(ii) refresh.auto.interval to refresh individual panel (deprecated feature now, however you can use the same in case you are using Splunk Enterprise 6.1 or greater but not on Splunk 6.5)
<option name="refresh.auto.interval">300</option>
... View more
12-30-2016
01:42 AM
The Key value pair for regular expression starts with upper case. In this case it should be User and not user.
whitelist2= User="nacuser"
whitelist3= User="paloaltouid"
OR
whitelist2= User="^nacuser$"
whitelist3= User="^paloaltouid$"
Further, if you have more than one values of the same key to be filtered, you should define separate Whitelists, since only the later will be used otherwise. Refer to the following is snippet from Splunk Documentation for the same:
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27
Note: You cannot specify an entry that has more than one key/regular expression set that references the same key. If, for example, you specify:
whitelist = EventCode="^1([0-5])$" EventCode="^2([0-5])$"
Splunk Enterprise ignores the first set and only attempts to include events that match the second set. In this case, only events that contain an EventCode between 20 and 25 match. Events that contain an EventCode between 10 and 15 do not match. Only the last set in the entry ever matches. To resolve this problem, specify two separate entries in the stanza:
whitelist = EventCode="^1([0-5])$"
whitelist1 = EventCode="^2([0-5])$"
... View more
12-30-2016
12:36 AM
Thanks for explaining, maybe I was overwhelmed by the length of your Splunk query and hence overlooked the details.
You are not trying to color geo stats based on series depicted rather you are looking at range value which is not even plotted. I am not sure as to how that can be done. You may want to look at Choropleth map, where you can color map based on ranges (however, values from range needs to be plotted on the geostat).
... View more
12-29-2016
09:30 PM
Give the following a try (ideally values() stats command should give only one result as per code_ID, if it does then do change values() to last() function.)
index="Main1" OR index="Main2" code_ID="*"
| stats values(domain) as Domain values(user) as User by code_ID
You should also look at Splunk map command: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map#1._Use_a_sudo_event_to_locate_the_user_logins
index="Main1" code_ID="*"
| stats count by Code_ID domain
| map search="search index="Main2" Code_ID=$Code_ID$"
| fields Code_ID domain User
Similar to join you can also use append, appendcols, transaction commands also, however, you would need to compare the query performance for each one of them and choose the best that suits your needs (hoping that stats will work faster compared to others). Refer to Splunk event correlation techniques documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation
... View more
12-29-2016
08:29 PM
I have updated my answer with sample screenshot.
... View more
12-29-2016
08:26 PM
As per the code above, do you get series as greenCount, blueCount, yellowCount, orangeCount and redCount when you hover in your Map?
If so then the code similar to the I have provided should work. If not please change the names accordingly in mapping.fieldColors.
... View more
12-29-2016
10:49 AM
EDITED
Since you want to make changes to column data labels which are highchart-data-labels elements not exposed by charting properties like charting.fontColor you can try one of the following options:
1) Option 1 - charting.backgroundColor
Without CSS make column chart Data Labels prominent by changing chart color to contrast
cyan
Pros - No need to modify through css.
Cons - Panel might look ugly. (White or Black background colors usually suits dashboards)
2) Option 2 - Through CSS
(i) Override the highcharts-data-label text color to the color of your choice using following css custom_highcharts.css.
/* SVG Highcharts Data Labels color overridden to blue*/
g.highcharts-data-labels text {
fill: blue !important;
}
(ii) Place the CSS under your Splunk App folder -
$SPLUNK_HOME\etc\apps\<yourAppName>\appserver\static
PS:
- If you have not put any static files for your Splunk App you would need to create appserver\static folder yourself
- If you do not have access to manually place the CSS file to specific Splunk folder, you can load the same through Manage App Edit Properties using Upload asset feature.
(iii) Include the CSS file in your dashboard/form
<form stylesheet="custom_highcharts.css">
(iv) Restart Splunk (splunkd) and clear browser cache for the changes to take place.
... View more
12-29-2016
10:44 AM
Following is the example I described earlier.
<single>
<search>
<query>index=_internal</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">all</option>
<drilldown>
<set token="myEarliestTime">$earliest$</set>
<set token="myLatestTime">$latest$</set>
</drilldown>
Since you plan to use earliest and latest token in a link, you will not require above example.
However, I would suggest using CDATA section so that you dont have to Escape encoded URL. You can test the same by creating a New Dashboard and call using following path for your Splunk App Name. Earliest Time and Latest Time can be passed as query strings(see example below). I will recommend you to check out various Drill Down examples provided in Splunk 6.x Dashboard Examples app.
<drilldown>
<link>
<![CDATA[
/app/<YourSplunkApp>/<YourNewDashboardorRedirection>?earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
... View more
12-29-2016
10:04 AM
You have two options.
Option 1
Convert dashboard to Real Time. For example following looks for 5 minute window. However, you should use Dashboards with Real Time searches only if absolutely required(like depicting real-time network utilization etc), otherwise you should rely on second option (near real-time)
<earliest>rt-5m</earliest>
<latest>rt</latest>
Option 2
Set dashboard or Panel Refresh based on one of following options whichever suits your needs and Splunk Enterprise version:
A) Refresh entire view on periodic basis (following is for every 5 minutes)
<dashboard refresh="300">
or
<form refresh="300">
B) Individual Panel auto-refresh
(i) Splunk Enterprise 6.5 onward. Create your Search Panel and edit the search to add Auto Refresh Delay or do the same via Simple XML for specific Search Panel add following code
<refresh>5m</refresh>
(ii) refresh.auto.interval to refresh individual panel (deprecated feature now, however you can use the same in case you are using Splunk Enterprise 6.1 or greater but not on Splunk 6.5)
<option name="refresh.auto.interval">300</option>
... View more
12-29-2016
09:38 AM
I have tried almost similar props.conf for csv sourcetype and field extraction worked fine for me.
PS: id=qr1249,ab=user" in your data should begin with double quotes. Can you please try to add a single csv file with Data Preview turned on? By default Splunk will apply csv sourcetype, on top of which you can tell first line to be Header line and timestamp column to be time field. Once preview is as per your need you can save sourcetype as Custom > mytest_csv , as per your need.
[mytest_csv ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=AUTO
INDEXED_EXTRACTIONS=csv
category=Structured
description=Custom Comma-separated value. Header field line is 1. Timestamp column is timestamp.
disabled=false
HEADER_FIELD_LINE_NUMBER=1
TIMESTAMP_FIELDS=timestamp
... View more
12-29-2016
08:04 AM
When you asked your question and mentioned that your GeoStats is picking Random colors, can you check the names of pie slices which are showing Random Colors? You would need to rename and set a color for those slices(field names).
... View more
12-29-2016
08:01 AM
Can you share part of query that plots the geostats?
Also hover over your GeoStats pie, and see the series names displayed in the pie.
... View more
12-29-2016
03:16 AM
There are multiple actions that you would need to watch. In fact you might have to check your existing logs for such historical transactions.
For example action=add can be used to monitor files/configurations added. You should also use path to identify what kind of file and what location has the file been added. Like path=".xml" OR path=".html" will show a view added to any app.
Similarly for action=update or action=delete
action="change_authentication" monitors change in user authentication
There are several action="edit_*" which monitor specific Splunk component modification. For example, action="edit_view_html" will monitor changes to HTML views created in Splunk (used along with object=<HTML View Name>)
action="login attempt" along with info field will give number of login attempts with failed or successful information.
action="restart_splunkd" will capture details on who/when Splunk instance was restarted
action="search" and action="rtsearch" will give information on Splunk Historical and Real Time searches. You can identify which are the long running queries.
Essentially, you would need to identify and use the specific queries as per your needs.
... View more
