Are you uploading a single file or complete folder through one time upload? Upload option is for a single file where you need to analyze the data sourcetype and ingestion for accuracy of timestamp and event identification. If you want complete folder to be monitored, you should try folder monitor instead. Refer to documentation, the option to monitor comes along with Upload option: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectorieswithSplunkWeb ... View more

@palisetty if you are preparing for any Splunk Certification exam, I would recommend you to go through the course content and refer to Splunk Documentation for all your queries, understanding and additional reading. Splunk Docs have all the required examples and explanations which you require for Certification and in fact for actual development usage. In my opinion quizlet is a inappropriate way to learn Splunk as it gives questions based on memory and half baked scenarios which may actually be incorrect. Learning from such source will lead to incomplete and incorrect knowledge which would be disastrous. So coming to your follow up details, seems like you are interested in multiple aggregations within stats command. If you are going through stats command you should refer to documentation for the same as well to understand it in depth: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats You can also refer to Splunk Documentation for all the available/applicable aggregation functions here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Aggregatefunctions Best way to learn through these examples is to try them out using Splunk's _internal index data on local machine or ingest Splunk's tutorial data as mentioned in the Fundamental course as well as on Splunk Documentation for Search Tutorial: https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/GetthetutorialdataintoSplunk In your question the example has been created based on same tutorial data where data has been uploaded to main (default) index with default sourcetype (pre-defined) access_combined_wcookie. (explained in Search documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Aboutthetutorialdata) index=main sourcetype=access_combined_wcookie | stats values(useragent) as "Agents used" count as "Times used" by useragent In the above stats function by useragent defines the key field for aggregation i.e. each row in the result of stats function will have unique value for each useragent present. The values() stats aggregation function gives unique values of specific field. Which implies you will have two columns useragent and Agents used with same values as both are unique per row. So, your SPL seems to be performing stats (transformation) for a non-realistic scenario. Coming to my point, if your use case is to get the access count through various user agents , you could have performed the following: index=main sourcetype=access_combined_wcookie | stats count as "Times used" by useragent | rename useragent as "Agents used" ... View more

@palisetty what are you trying to do? What is your complete query? Do you get any error or is your output not as expected? What does your data look like and what is the expected output. For the community to assist you better please provide as much details as possible. ... View more

@davidda this seems to be a bug with 7.3.x and higher versions (even in 8.x) where data elements do not seem to work in Simple XML. If you download the demo tabs app from the blog and convert to HTML Dashboard, then it would work. The issue seems to be that data elements in simple xml html panels no longer work for example data-toggle , data-elements etc. However, I did not see any error thrown browser, so not sure where it is failing. Work around would be to handle such things through Simple XML JS extension. Let us know if 1) either conversion to HTML Dashboard will work for you 2) You can create a ticket for Splunk Support/Splunk Dev team to look at the issue with data elements in Simple XML. If the above do not work and you need further assistance for Splunk Answers community for a workaround with Simple XML JS extension please let us know. ... View more

@genesiusj |s is a token escape mechanism which treats token as string (within quotes) and escapes any quote character within the token value. Refer to one of my older answers: https://answers.splunk.com/answers/568209/how-to-prevent-injection-from-field-in-a-dashboard.html The default and submit token models do not make much of a difference when you have searchWhenChanged set to true. Since both will get updated simultaneously. However, searches using tokens may not run when searchWhenChanged is set to false, the input value is changed and Submit button is not clicked. As only default token model gets updated on change of input and submit token model gets updated only after clicking the Submit button. Refer to one of my older answers to understand this: https://answers.splunk.com/answers/679596/what-is-the-expected-behavior-for-submit-button-wh.html I would need to explore the reset to default value condition. ... View more

@pgadhari while the Trellis limitation will not allow you to have more than 20 splits per page, based on the sample screenshot provided, seems like you need Single Value kind of viz with (1) Title (2) Value and (3) Viz background color. This you should be able to do with <html> panel where search results are parsed using Simple XML JS extension with Splunk JS to read search result and create html template. PS: Simple XML CSS Extension would be required for formatting viz background color as per range. Refer to one of my answers on similar lines. Kindly post a separate question specific to your needs if this does not help: https://answers.splunk.com/answers/662523/how-to-show-table-result-in-one-page-table-modific.html PS: I dont know if Trellis configuration to show more than 20 splits per page would be available in the current dashboard framework since this has been a really old issue since 6.6 when Trellis was introduced. At the same time current Splunk Dashboard App (Beta) also does not have Trellis feature. ... View more

@to4kawa you can request renewal of developer license as far as you are using it for development instance. https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html Or was there something else in your wishlist? ... View more

@spunk311z once you convert Dashboard to HTML you use the advantages of Simple XML Framework and you will have to use Splunk Web Framework to create Panels, Viz and Searches. Refer to documentation for conversion from Simple XML to HTML and understanding the HTML Dashboard components: https://dev.splunk.com/enterprise/docs/developapps/webframework/usewebframework/convertsimplexml However, could you please explain the specific reason for HTML dashboards as to what can not be done in Simple XML dashboard (with JS and CSS extensions if required)? ... View more

Fundamental 1 elearning is free for everyone. Which means you can go ahead and take the core certification exam. If the company you work for is a partner with Splunk and has enrolled for any Education subscription, then you should check which courses are free for you. You should always register for one course at a time. https://education.splunk.com/HowtoEnroll#subscription All the best with your Certification journey! ... View more

If you are on Splunk 7.1 or higher you can try the Splunk Cloud Gateway app from splunkbase and configure the same to allow Splunk Dashboards to be displayed on mobile (both Android and iOS) using the Splunk Mobile app. Refer to documentation for setting up Splunk Cloud Gateway and about Splunk Connected Experience. ... View more

@marylenebrey you might have to provide more details. Do you have searchWhenChanged set to true for Date Filter and if so is it the same for Product filter as well? What is the behavior of the dynamic pop up? When and where should it display? Should it be on change of Data and/or Product inputs or some other event in the dropdown? What is the query used in the table for dynamic pop up? Are both filter values passed to the dynamic pop up table query? Would it be possible for you to share more code from Simple XML and JavaScript? Please mask/anonymize any sensitive code/information before posting on Splunk Answers. ... View more

@ashu_ipec which exam are you planning to write. ... View more

@alexlombardi using index replication you cant take the advantage of map-reduce if lookup command is used after a transforming/non-streaming command and lookup is processed on SH instead of Indexers. Refer to the following documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Writebettersearches#Parallel_processing_example https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Parallelreduceoverview Also check out lookup command optimization: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_search Lookup command can be forced to run on SH but by default runs on Indexer provided all the commands prior to lookup are purely streaming. You would need to run performance tests to ensure position of lookup command as sometimes map-reduce can get you better results and other times transforming commands can reduce the result set to too low. We have seen advantage of both the steps. Index replication of KV Store and accelerating only the required field usually it is only one or two per KV store like unique ID field or unique Name field . We store 3-5 million rows in the KV Stores. ... View more

@alexlombardi you can try out following two options: Accelerated fields for the fields which are used for joining your SPLs to the KVStore (restrict fields to key input fields rather than enrichment output fields). Refer to answer: https://answers.splunk.com/answers/333540/for-large-lookups-should-i-use-the-kv-store.html Indexer Replication for KV Store Knowledge Objects (this takes disk and network for replicating KVStore data as CSV bundle to indexer). This will allow map-reduce advantage in case only streaming commands are used prior to KVStore lookup. Refer to answer: https://answers.splunk.com/answers/390686/how-to-replicate-a-search-head-clusters-kv-store-l.html ... View more

@praveen_ please elaborate your question around your visualization needs. Splunk's Custom Visualization API was released only with 6.4 in 2016 and was modified in 6.5 which is still in use. Splunk Custom Visualization API lets you integrate any visualization in Splunk using JS frameworks like D3, Highcharts etc. You can check out Custom Visualizations on Splunkbase which have already been built using the same API, most of them Splunk Built and Splunk Appinspect passed. ... View more

@to4kawa can you add some sample data, do you have control over the date format in the data you are indexing to Splunk? ... View more

@genesiusj you should ideally check out Splunk Dashboard Examples app for access all the tokens in use and extend the same to clear out tokens safely. However, let me provide your with a quick workaround for clearing all the tokens in the default and submitted token model. PS: 1) init tokens once cleared via JS would need to be explicitly set afterwards. (2) Form tokens with default values will not reset back to default values. So it is better to follow naming convention to ensure that you automatically unset only required tokens. Following is a sample dashboard with all types or tokens like (1) init token, (2) drilldown token and (3) Form token. Following is the Reset functionality implemented through SimpleXML JS extension: Following is the SImple XML code for the example: <form script="reset_tokens.js"> <label>Iterate through tokens</label> <init> <set token="tokInitTest">initialize</set> </init> <fieldset submitButton="false" autoRun="false"> <input type="time" token="field3" searchWhenChanged="true"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="field1" searchWhenChanged="true"> <label>field1</label> <default>test</default> </input> <input type="dropdown" token="field2" searchWhenChanged="true"> <label>field2</label> <choice value="alpha">Alpha</choice> <choice value="beta">Beta</choice> <default>alpha</default> </input> </fieldset> <row> <panel> <table> <title>Click Time below to set drilldown token</title> <search> <done> <set token="tokSearchTime">$result._time$</set> </done> <query>| makeresults</query> <earliest>-1s</earliest> <latest>now</latest> </search> <option name="refresh.display">progressbar</option> <drilldown> <set token="tokDrilldownSearchTime">$click.value$</set> </drilldown> </table> </panel> </row> <row> <panel> <html> <div> tokInitTest: $tokInitTest$<br/> tokSearchTime: $tokSearchTime$<br/> field1: $field1$<br/> field2: $field2$<br/> field3.earliest: $field3.earliest$<br/> field3.latest: $field3.latest$<br/> tokDrilldownSearchTime: $tokDrilldownSearchTime$<br/> </div> <div> <button id="reset_tokens" class="btn btn-primary">Reset</button> </div> </html> </panel> </row> <row> <panel> <table> <search> <query>| makeresults | eval tokInitTest=$tokInitTest|s$, tokSearchTime=$tokSearchTime|s$, field1=$field1|s$, field2=$field2|s$, field3.earliest=$field3.earliest|s$, field3.latest=$field3.latest|s$, tokDrilldownSearchTime=$tokDrilldownSearchTime|s$ </query> </search> </table> </panel> </row> </form> Following is the JS code for reset_token.js: require(["jquery", "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!"], function($,mvc) { console.log("Inside Reset button"); var defaultTokenModel=mvc.Components.get("default"); var submittedTokenModel=mvc.Components.get("submitted"); // On Click of Reset button iterate through // default and submitted token models and unset all $(document).on ("click","#reset_tokens",function(){ var objDefaultTokens=defaultTokenModel.attributes; var objSubmittedTokens=submittedTokenModel.attributes; for (var token in objDefaultTokens) { if (objDefaultTokens.hasOwnProperty(token)) { defaultTokenModel.unset(token); } } for (var token in objSubmittedTokens) { if (objSubmittedTokens.hasOwnProperty(token)) { submittedTokenModel.unset(token); } } }); }); ... View more

@azulgrana if this works it is great. I was thinking that it is possible to create our own table row expansion and drilldown instead of using built-in. However it would involve considerable coding. Something in line with : https://answers.splunk.com/answers/324828/render-html-code-from-search-result-in-splunk-dash.html However, I would explore this only in case above approach of yours does not work for you. So if it does do convert your comment to answer and accept the same 🙂 ... View more

@cefalan, Sorry I think I misunderstood the question. If KV_MODE=xml is not working out of the box for your data, then you need to ensure that only XML data is present in the raw data. If your raw events contain XML and some additional content, you would either need to remove additional content from the raw events while indexing using props and transforms config files to ensure KV_MODE=xml works on raw data or else during search time using rex and followed by spath to get the required XML data at search time. Could you post the result of the following search after macking/anonymizing any sensitive data? Do you see only XML data or XML with some additional content: index=<yourIndexWithXMLData> | head 1 | table _raw ... View more

@prettysunshinez try the following search index=<yourIndexName> [| inputlookup <yourLookupFile> | stats values(Test_Name) as Test_Name | eval Test_Name=" NOT (\"".mvjoin(Test_Name,"\" OR \"")."\")" | rename Test_Name as search] Provided your lookup file has Test_Name field values as Abar and Azad the above query will execute a search similar to the following: index=<yourIndexName> NOT ("Abar" OR "Azad") Following is a run anywhere example based on Splunk's _internal index with component field where instead of lookup, I am using same index to pull fewer components using recent time and then running the main query for a longer time period to return all the components that were present for overall time but not in the recent time. index=_internal sourcetype=splunkd log_level!=INFO earliest=-24h latest=now [ search index=_internal sourcetype=splunkd log_level!=INFO earliest=-1h latest=now | stats values(component) as component | eval component=" NOT (\"".mvjoin(component,"\" OR \"")."\")" | rename component as search] | stats count by component ... View more

@khojas02 if you are using Splunk's Time Picker input then you can either use <change> event handler with <eval> to format selected time to epoch or string time as per your final format or use independent search to pass time picker inputs and use addinfo in the SPL to get the time as epoch or string as per your need and pass the same as token to your search. Both the approaches have been explained in one of my previous answers. Please refer to the same to understand each approach: https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html PS: While using string time ensure you have time in format ensure %Y/%m/%d format so that data remains sorted and filter can also be applied correctly on string time. ... View more

@darrenfuller you would need additional escaping in Splunk for " and \ while defining the regular expression. Following is a test you can run in Splunk SPL to validate the REGEX: | makeresults | eval _raw=" 2020-02-20 20:22:02.202020 test:>\"value\" test1:>\"value1\" test2:>\"this is a \\\"test\\\"\" test3:>\"this is \\\"a test\\\" ok\" test4:>\"this is \\\"another\\\" test ok?\"" | rex "(?<field>[\w\_]+)\:\>\"(?<value>(?:[^\"\\\]|\\\.)*)\"" max_match=0 If the above works as per your expectation, you would need to use following REGEX in transforms.conf ([\w\_]+)\:\>\"((?:[^\"\\\]|\\\.)*)\" PS: If you pass the regex101 regular expression to Splunk SPL I have provided above, you can notice that it is unable to parse the regular expression as quote and backslash need additional escaping in Splunk. ... View more