Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
12-29-2016
02:30 AM
If you have Deployment Server configured you should be able to monitor the same from Splunk Web --> Settings --> Distributed Environment --> Forwarder Management
It lists out the App (deployment app), Server Classes (Deployment classes) and Clients (Deployment Clients)
Deployment Clients Lists clients with Forwarders configured (includes Client Host Name, Client IP, Machine Types, Apps Deployed and Phoned Home duration.
it makes the following rest call
| rest /services/deployment/server/clients
You can pipe/modify above search/results based on your needs like
| search hostname="<YourAppServers>"
| eval TimeDiffInMin=round((now()-lastPhoneHomeTime)/60,2)
| sort hostname
| table hostname, TimeDiffInMin
... View more
12-29-2016
01:31 AM
If you are able to plot the series on Geo Map with the series names: greenCount blueCount yellowCount orangeCount and redCount then you can use mapping.fieldColors for applying specific color to the series.
Following is an example for redCount and greenCount using hex code for respective colors. You can use mapping.fieldColors
<option name="mapping.fieldColors">{redCount:0xFF0000,greenCount:0x00FF00}</option>
Refer to the following documentation (also look at seriesColors option)
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map_.28event_tokens.29
UPDATED: Added sample screenshot with for above mapping.fieldColors example for redCount and greenCount fields.
... View more
12-29-2016
12:18 AM
1 Karma
Since your stats is based on COMM_AMT and BIZ_RATE include them in your base search.
Following are some of the options to display multiple values in Single Value visualization.
Option 1
index=transaction COMM_AMT=* BIZ_NAME=*
| table TSAC_NO, AGENT_NRIC, BIZ_NAME, MOBILE_NO, RANK_CODE, TEAM_NAME, PROPERTY, PROP_TYPE, TSAC_TYPE, COBROKE_AGENT, DATE_OPTION, DATE_SUBMIT, DATE_ENTER, DATE_INV, COMM_AMT
| stats sum(COMM_AMT) as COMM_AMT by BIZ_NAME
| sort -COMM_AMT
| eval NewField=BIZ_NAME + " - " + COMM_AMT
| table NewField
Option 2
You can pass second stats field i.e. COMM_AMT as a taken by coding preview event of search and then use either unit or underLabel option in Simple XML to print the value.
<single>
<search>
<query> index=transaction COMM_AMT=* BIZ_NAME=*
| table TSAC_NO, AGENT_NRIC, BIZ_NAME, MOBILE_NO, RANK_CODE, TEAM_NAME, PROPERTY, PROP_TYPE, TSAC_TYPE, COBROKE_AGENT, DATE_OPTION, DATE_SUBMIT, DATE_ENTER, DATE_INV, COMM_AMT
| stats sum(COMM_AMT) as COMM_AMT by BIZ_NAME
| sort -COMM_AMT
</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<preview>
<set token="commAMT">$result.COMM_AMT$</set>
</preview>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">- $commAMT$</option>
<option name="unit">- $commAMT$</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
... View more
12-28-2016
11:21 PM
For adding colors to existing Geo Map you can note the names of series plotted in your Geo Map and apply field color as per your need. For example following set colors for red and green series using hex code for respective colors. You can use mapping.fieldColors (refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map_.28event_tokens.29)
<option name="mapping.fieldColors">{red:0xFF0000,green:0x00FF00}</option>
If you want to color map based on stats range, you are actually looking for Choropleth Map (http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethFormatting)
Please also check out Choropleth Map - Color Modes example on Splunk 6.x Dashboard Examples
<option name="mapping.choroplethLayer.colorBins">6</option>
<option name="mapping.choroplethLayer.colorMode">auto</option>
<option name="mapping.choroplethLayer.maximumColor">0xDB5800</option>
<option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option>
... View more
12-28-2016
10:52 PM
1 Karma
Table will list all src_user and src_ip values. Only difference is that stats command counts such occurrences and aggregates the result.
You can validate whether the number of results for the following two commands are same or not.
<Your Base Search> | dedup src_user, src_ip | sort src_user, src_ip | table src_user, src_ip
<Your Base Search> | stats count by src_user,src_ip | sort src_user, src_ip
... View more
12-28-2016
10:45 PM
You can add a Time control to the form and use its earliest and latest properties across the visualizations in your form.
For example if the added Time control is globalTime you will have $globalTIme.earliest$ and $globalTIme.latest$ available in the form.
Additionally, earliest and latest timestamp are available as Single value Tokens which can be coded under <drilldown><condition> block
Please refer to the link for Single value tokens: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#single_.28event_tokens.29
... View more
12-28-2016
10:18 PM
You can parse XML data using either spath or xpath command.
... View more
12-28-2016
09:17 PM
1 Karma
By Summarization I meant use of collect command. Summaries was as per your use case. You can push raw data with collect command as well.
... View more
12-28-2016
09:34 AM
Can you see if you have access to Splunk's _internal index?
index=_internal sourcetype=splunkd source="*metrics.log" group=per_Index_thruput | timechart sum(kb) by series
... View more
12-28-2016
09:21 AM
Are you using Splunk 6.3?
Yes you are right reset_before reset_after and reset_on_change were introduced from 6.4.0 onward.
... View more
12-28-2016
09:17 AM
You can use searchmatch function meanwhile to build table with your eval field.
index= host= source=/var/log/messages "starting IPv4 firewall" OR "Stopping IPv4 firewall"
| eval FirewallStatus=if(searchmatch("starting IPv4 firewall"),"Starting","Stopping")
| table _time, host, FirewallStatus
Creating a field extraction just for identifying Status ,where such Starting/Stopping events might be of very insignificant volume compared to all the other events for the same sourcetype, might not improve any performance. Since this seems to be standard log, can you see if you have message field available on all events and whether they all can be extracted as a Message field, then you can later use eval and other transforming/extracting commands on the Message field itself.
... View more
12-28-2016
07:50 AM
A little different approach which will print row numbers against each row, but without nested Splunk search query, hence should not cause performance issue.
index=xyz sourcetype=123 Message ="*"
| stat count by host Message
| fields - count
Save as dashboard table and set the table properties to enable Row Numbers. You can do the same by editing Dashboard XML also.
<option name="rowNumbers">true</option>
... View more
12-28-2016
03:57 AM
Have you looked at Distributed Monitoring Console which is available with Splunk Enterprise instance and looks at several Splunk performance aspects inclusing Indexers and indexing like:
1) search head and indexer clustering
2) index and volume usage
3) indexing performance
https://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview
... View more
12-28-2016
01:30 AM
1 Karma
Geostats stats fields are sorted alphabetically. You can try to pipe rename commands to add sequence numbers 1., 2., 3. etc as per the sequence you need
Here is an example, by default Count: Get and Count POST are displayed first followed by Sum: GET and Sum: POST. Following will sort GETs first followed by POSTs:
| rename "Count: GET" as "1.Count: GET"
| rename "Sum: GET" as "2.Sum: GET"
| rename "Count: POST" as "3.Count: POST"
| rename "Sum: POST" as "4.Sum: POST"
... View more
12-27-2016
11:02 PM
You can consider:
1) Summarizing the data or retaining entire data from one index to other using collect command
2) Scheduling the search for regular interval (for example every month for past month on main index).
3) Finally you can define a separate retention period for your summary index.
If you summarize the data with stats of important data, it will lead to faster search and significantly less number of events.
... View more
12-27-2016
10:39 PM
You can create your own custom app but that will use html, js and css. You can refer to Image Overlay with Single Values example on Splunk 6.x Dashboard Examples, for displaying data on top of an existing image.
You can also refer to my answer on displaying dynamic status icons overlaid on a base image, which is kind of an extension to the example provided in the app.
https://answers.splunk.com/answers/399332/image-overlay-with-icons-based-on-value.html.
PS: Working with static files like images, css and js requires you to restart Splunk and clear browser cache for the changes to take effect.
... View more
12-27-2016
09:48 PM
Whatever expression you put inside reset_after="("")" should be
1) a valid eval statement
2) returning only true or false.
3) Only if the eval expression returns true the stats will reset.
I have tried both conditions and they work just fine
reset_after="("0==0")"
and
reset_after="("\"0\"==\"0\"")"
Following are couple of examples which should always work:
Example 1: Reset count after every event i.e. 0==0
|gentimes start=12/01/2016 end=12/10/2016
| eval testCount=1
| accum testCount
| eval flag=if(0==0,"Reset Counter","Increment Counter")
| sort _time
| streamstats count as Count reset_after="("0==0")"
| table starthuman testCount flag Count
Example 2: Reset count after every alternate event i.e. even events i.e Modular division by 2 (testCount%2)
| gentimes start=12/01/2016 end=12/10/2016
| eval testCount=1
| accum testCount
| eval flag=if(testCount%2=0,"Reset Counter","Increment Counter")
| sort _time
| streamstats count as Count reset_after="("testCount%2=0")"
| table starthuman testCount flag Count
... View more
12-27-2016
10:11 AM
Are you looking for something like Splunk's ITSI app: https://splunkbase.splunk.com/app/1841/ ?
... View more
12-27-2016
10:08 AM
@danielcmarcosjr, would it be possible for you to add some data field and search query examples?
There are multiple ways this could be done, for example code the chart drilldown event and set the chart clicked values as token, to be used by the table. You would have to do this in XML and convert to HTML for convenience.
Please refer to the Splunk 6.x Dashboard Examples app from Splunkbase for all Drilldown Elements examples.
... View more
12-27-2016
09:45 AM
Please run both search with appendcols and with nested search. Check in Job Inspector for better performance.
... View more
12-27-2016
08:45 AM
This seems to be a CSV file, is there a file header? Have you tried loading single file with Data Preview and sourcetype as csv?
EDITED with an approach to the solution.
If you add file as CSV sourcetype (rename as your own custom sourcetype name), fields should get automatically extracted. As per the details search time extracted field Entity should have the value you want to extract. Since your data is CSV format it would be better to define the sourcetype properly so that you do not need to spend additional time during field extraction/mapping. Also, while rex will do the job for you, you should ideally move the same to Field extraction Knowledge Object, for simplification and easy maintenance of Splunk searches.
Following is an example of using split command to split the Entity field into parts using underscore as the delimiter, mvcount is used to get the total split fields and finally mvindex to extract the last split field that contains the data you need.
<Your Base Search>
| eval SplitFields=split(Entity,"_")
| eval len=mvcount(SplitFields)
| eval MyField=mvindex(SplitFields,len-1)
| table Entity SplitFields len MyField
You can also apply rex on Entity field, however it would be better to move the field extraction to props.conf for the CSV sourcetype that you create.
Following is an example to test above code:
| makeresults
| eval Entity="TACM_QA3_CharlesCheng"
| eval SplitFields=split(Entity,"_")
| eval len=mvcount(SplitFields)
| eval MyField=mvindex(SplitFields,len-1)
| table Entity SplitFields len MyField
... View more
12-27-2016
02:35 AM
1 Karma
You can use eventstats to get the total events containing Result field. Then filter only Results containing "Unable to*" pattern:
index=_internal Result=*
| eventstats count as total
| search Result="Unable to *"
| stats count as nocont values(Result) as Results last(total) as total
| eval resultado=round((nocont/total)*100,0)
| table Values nocont total resultado
... View more
You can use Splunk's index="_audit" and user="admin". Based on action field you can identify various user activities.
Refer to Splunk How To video on Youtube for audit security: https://www.youtube.com/watch?v=Qv-34lKnI70
You can also refer to Splunk Documentation for Security: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Searchforauditevents
... View more
12-26-2016
10:24 PM
Double quotes in the evaluation expression within reset_before or reset_after should be escaped with backslash (\). Since you are switching by static time in this case you don't need by shift as a streamstats split field.
base_search | eval Time=strftime(_time,"%m/%d/%y %H:%M:%S.%3N %p") | streamstats count as shift reset_after="("match(Time,\"11/01/16 05:14:00.000 AM\")")"
... View more
12-26-2016
10:04 PM
You would need to escape quotes inside match() evaluation function. Use backslash (\) for the same
|streamstats reset_after="("match(description,\"session is closed\")")" last(beam_number) as "beam"
OR
|streamstats reset_after="("description==\"session is closed\"")" last(beam_number) as "beam"
... View more
