Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About andrewtrobec
andrewtrobec
Motivator
Member since:
11-09-2016
03-06-2024
Community Statistics
| Posts | 334 |
| Solutions | 7 |
| Karma Given | 122 |
| Karma Received | 42 |
| Member Since | 11-09-2016 |
Activity Feed
- Posted Re: Why is my LINE_BREAKER parameter not breaking properly with multiple capture groups? on Getting Data In. 03-06-2024 09:17 AM
- Posted Re: Why is my LINE_BREAKER parameter not breaking properly with multiple capture groups? on Getting Data In. 03-06-2024 09:16 AM
- Karma Re: Why is my LINE_BREAKER parameter not breaking properly with multiple capture groups? for lucacaldiero. 03-06-2024 09:15 AM
- Posted Re: Why is my LINE_BREAKER parameter not breaking properly with multiple capture groups? on Getting Data In. 03-06-2024 03:00 AM
- Posted Why is my LINE_BREAKER parameter not breaking properly with multiple capture groups? on Getting Data In. 03-05-2024 11:09 AM
- Got Karma for Re: Why does updating a token with JavaScript not cause panels dependent on those tokens to refresh?. 01-03-2024 02:10 PM
- Posted Why does user with "power" role only see the "Search" option in the navigation menu and nothing else? on Splunk Enterprise. 12-13-2023 06:15 AM
- Posted Why is a sourcetype not being applied to a summary index that was migrated? on Getting Data In. 10-27-2023 07:38 AM
- Karma Re: Can Azure AD and Microsoft Entra be configured together on Splunk Enterprise? for isoutamo. 10-27-2023 06:46 AM
- Posted Re: How do I access the data in the maintenance_calendar KV Store for ITSI? on Splunk IT Service Intelligence. 10-27-2023 06:39 AM
- Karma Re: How do I access the data in the maintenance_calendar KV Store for ITSI? for anatolvd. 10-27-2023 06:38 AM
- Posted Why does strptime not parse timestamps to nanoseconds (%9N/%9Q)? on Splunk Search. 10-26-2023 06:30 AM
- Posted Can Azure AD and Microsoft Entra be configured together on Splunk Enterprise? on Splunk Enterprise. 10-18-2023 03:32 AM
- Posted How do I access the data in the maintenance_calendar KV Store for ITSI? on Splunk IT Service Intelligence. 10-11-2023 03:19 AM
- Posted Re: Dark theme swith fails when using emojis in the dashboard on Dashboards & Visualizations. 08-04-2023 09:38 PM
- Karma Re: Dark theme swith fails when using emojis in the dashboard for robtun1. 08-04-2023 09:36 PM
- Posted Re: Why is _time in my JSON payload parsed correctly with milliseconds via manual upload but not via HEC? on Getting Data In. 07-21-2023 12:23 AM
- Karma Re: Why is _time in my JSON payload parsed correctly with milliseconds via manual upload but not via HEC? for PickleRick. 07-21-2023 12:22 AM
- Posted Re: Why is _time in my JSON payload parsed correctly with milliseconds via manual upload but not via HEC? on Getting Data In. 07-14-2023 05:24 AM
- Posted Re: Why is _time in my JSON payload parsed correctly with milliseconds via manual upload but not via HEC? on Getting Data In. 07-14-2023 05:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-13-2022
04:07 AM
@richgalloway Thanks for taking the time, hope you're well! Unfortunately the suggestion does not work. It continues to index as before. Here is a tabled output with the indextime as well (timezone gets localized, I am on CET while raw is UTC): Potentially useful info: the sourcetype is defined in the props.conf belonging to the app that has been deployed to UF via DS. It is not defined anywhere on the indexer that receives the data. This same app contains the shell script as well as inputs.conf. Best regards, Andrew
... View more
- Tags:
- @rich
01-12-2022
11:46 AM
Hello! I have a really simple unix based shell script that returns info about the httpd (Apache) service. The script is encapsulated in an input, so the printf statement becomes the event. Each event is one line only. Here is an indexed event coming from the UF (with highlights that I will explain successively): For some reason the sourcetype is not working since _time is not what I specify, rather it is half from the field I want (timestamp in green) and half some text in the payload that i do not want (date in red). The sourcetype is currently this (it has gone through many evolutions): [linux:httpdinfo]
SHOULD_LINEMERGE = false
KV_MODE = auto
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S %z No matter what I try I cannot seem to get it to work. Could somebody give me a push in the right direction? Thanks! Andrew
... View more
- Tags:
- input
- linux
- props.conf
Labels
- Labels:
-
Linux
-
props.conf
-
time
-
universal forwarder
12-16-2021
01:37 AM
Hello, I am a bit confused as to how Splunk manages its indexes through AWS cloud services, and I am not sure whether both EBS and S3 services are interchangeable for thsi type of deployment. For example, is S3 only for archiving frozen buckets, or can it be used for hot/warm/cold buckets as well? Is there some documentation about best practices here? Compare and contrast? Thanks! Andrew
... View more
11-23-2021
11:14 AM
1 Karma
Hello, I have a dashboard with a text input that has id "text_input". With JavaScript I am listening to changes to that input, and when that happens I just want to read the new value into a variable. Instead of reading the newly inserted value, though, it reads the previous value. The following code gives an idea of what I am doing: var def_tok = mvc.Components.get("default");
var sub_tok = mvc.Components.get("submitted");
...
$("#text_input").on('change', function () {
console.log("Change Detected");
var sub_tok_input = sub_tok.get("text_input");
var sub_tok_input_form = sub_tok.get("form.text_input");
var def_tok_input = def_tok.get("text_input");
var def_tok_input_form = def_tok.get("form.text_input");
console.log("sub_tok_input: " + sub_tok_input);
console.log("sub_tok_input_form: " + sub_tok_input_form);
console.log("def_tok_input: " + def_tok_input);
console.log("def_tok_input_form: " + def_tok_input_form);
}); When I fill in the first value from blank the first print reads blank instead of the value. Then when I update the value it reads the first value, and so on... What I am doing wrong and how can I ensure that I get the newly inserted value instead of the previously inserted one? Thanks! Andrew
... View more
- Tags:
- inputs
- javascript
Labels
- Labels:
-
javascript
11-09-2021
11:33 PM
@kamlesh_vaghela Just to be sure I recopied your original post and it works! I must have done it incorrectly, sorry for the false negative 😞 Thank you so much for your support, I really appreciate i!
... View more
11-08-2021
04:16 AM
@kamlesh_vaghela Thank you for your reply. I tried as suggested but this does not solve the issue. The HTML buttons continue to work, but the JavaScript buttons do not. Did this code work for you? Do you have any other suggestions? Thanks!
... View more
11-07-2021
11:53 PM
1 Karma
Hello! My objective is to be able to use JavaScript to overlay buttons onto a Splunk table viz, listen for a click, and then do something upon clicking. I've managed to overlay the buttons but I'm not sure how to listen for a click. If I add buttons to the dashboard via an html tag then it seems that the listener gets added automatically. Below is a run anywhere dashboard + JavaScript containing: An HTML table with two buttons added to the cells in dashboard XML A Splunk table with two buttons added to the cells using JavaScript All buttons have been assigned the class "html_button". The click listener that I associated to the "html_button" class only works with the HTML table. How do I add a listener to the JavaScript overlay buttons? Thank you and best regards, Andrew --------------------------------------- Dashboard <dashboard script="overlayTable.js">
<label>Buttons and Listeners</label>
<row>
<panel>
<title>Buttons added to HTML table</title>
<html>
<table>
<tr>
<th>Button</th>
</tr>
<tr>
<td>
<button type="button" class="html_button">x</button>
</td>
</tr>
<tr>
<td>
<button type="button" class="html_button">x</button>
</td>
</tr>
</table>
</html>
</panel>
<panel>
<title>Buttons added to Splunk table using Javascript overlay</title>
<table id="tableVizualization">
<search id="searchObject">
<query>| makeresults
| eval Button = "x"
| append [| makeresults
| eval Button = "x"]
| table Button</query>
<earliest>0</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard> overlayTable.js require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
// Add overlay buttons to table
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
return _(["Button"]).contains(cell.field);
},
render: function($td, cell) {
var strCellValue = cell.value;
if (cell.field === "Button") {
var strHtmlInput="<button type='button' class='html_button'>x</button>"
$td.append(strHtmlInput);
}
}
});
// Render table
mvc.Components.get('tableVizualization').getVisualization(function(tableView) {
tableView.addCellRenderer(new CustomRangeRenderer());
});
// Listener for html_button class
$('.html_button').on("click", function (e) {
alert("Button clicked!")
});
});
... View more
Labels
- Labels:
-
javascript
-
panel
-
table
11-06-2021
03:38 AM
@jcraumer Thanks for this example, exactly what I need!
... View more
11-05-2021
04:34 AM
Hello! My objective is to read the values of a Spunk table visualization from a dashboard into a JavaScript object for further processing. I'm not sure what object yet, but my main issue lies with iterating through the table and extracting the cell values. Can anybody provide some sample JS code for identifying the table object and interating through its values? Thanks! Andrew
... View more
Labels
- Labels:
-
development
-
other
-
troubleshooting
09-10-2021
08:55 AM
@isoutamo both lookup and lookup definition are shared globally and provide read access to the "user" role as well as read/write to the "admin" role. I thought that this would be enough to expose the data.
... View more
09-10-2021
08:28 AM
@richgalloway thanks for responding! I gave the "user" role read access to the "logic" app, but this still changes nothing. I'm not sure if this helps, but the "user" role is with default configuration. I was checking the different role capabilities, but I don't see anything that would make a difference. I added the "admin_all_objects" capability and it started working (obviously), even when the "user" role does not have read access to the "logic" app. Might it be some sort of capability issue?
... View more
09-10-2021
03:44 AM
2 Karma
Hello, I am trying to expose data within a lookup from a "logic" app to a "presentation" app for users that have the "user" role. To simplify the situation, I have a lookup "lookup_file.csv" with corresponding lookup deinition "lookup_file" in the "logic" app. Both knowledge objects have "global" sharing and permissions set to "read" for the "user" role. Since I am admin I gave "read/write" permissions to the "admin" role. When I run the search "| inputlookup lookup_file" from the "presentation" app with my admin user I have no issues reading the data. When I run the same command with my user that has the "user" role assigned I get two errors: 1. The lookup table ‘lookup_file' is invalid. 2. The lookup table ‘lookup_file' requires a .csv or KV store lookup definition. Here is a diagram that explains the situation: I have tried many configurations but cannot get the data to load in the "presentation" app with a user that has the "user" role. What am I missing? Any help would be greatly appreciated! Best regards, Andrew
... View more
Labels
- Labels:
-
other
07-08-2021
11:24 AM
Hey @pratik_18 , if you're facing the same KeyError('records') that I have, there's a new release of the connector that's due by the end of the month. Should iron out a few bugs...
... View more
06-18-2021
07:46 AM
Hello! I am looking at the "Search Activity" dashboard, in particular the "Search Concurrency" section. Here is what I see: My question: how are the various limits calculated? Do I have a limit of 22 or 44? Is the limit value 5 for summarization considered or do I add them to have 49 concurrency limit? Since I read that Splunk's concurrency limit is equal to the number of CPU cores, and my server has 16 CPU cores, wouldn't the limit be 16? What am I missing? I've looked at the documentation for this dashboard here, but it doesn't provide any useful information. Any feedback would be great! Thanks! Andrew
... View more
Labels
- Labels:
-
monitoring console
06-09-2021
10:13 AM
1 Karma
@splunk219783 Thanks for contributing! I found the same solution after checking and rechecking. I now have another problem, but I'm accepting your answer as it is relevant to the question. Out of curiosity: did your connector start working once you made the role change? I am now facing a new error: EventProcessor instance '<ID>' of eventhub '<eventhub name>' partition '0' consumer group '$Default'. An error occurred while receiving. The exception is KeyError('records'). Did you get something similar? Thanks! Andrew
... View more
06-03-2021
11:28 AM
I was able to solve by defining the sourcetype within the local props.conf of the app that contained the scripted input on the HF.
... View more
06-03-2021
11:27 AM
@venkatasri Thanks for your concern! I was able to solve in the meantime by defining the sourcetype within the local props.conf of the app that contained the scripted input on the HF.
... View more
06-01-2021
10:05 AM
Hello! Running Splunk Enterprise 8.0.5. I have a scripted input that calls an Azure Event Hub and parses the json response. To start off easy I set the sourcetype to the Splunk default "_json" sourcetype. Everything works fine with the exception of the timestamp not being set correctly. To resolve this I cloned the _json sourcetype with the objective of updating some parameters. Before starting I tested to see whether the cloned sourcetype, let's call it "_json2", would work. To my surprise and confusion it does not. Instead of breaking each object into an event it just indexes all objects into a single non-broken event. I have no idea why. All I did was click on the "clone" button and provided a new name. Why would this not work? Also, since I am working in a distributed environment with 1 x HF, 1 x IDX, and 1 x SH, where should the new sourcetype be stored? I put it on the IDX. It's also defined on the HF and SH, but it makes no difference. Any help would be greatly appreciated! Thank you and best regards, Andrew
... View more
- Tags:
- json
- props
- sourcetype
Labels
- Labels:
-
heavy forwarder
-
JSON
-
props.conf
05-27-2021
08:38 AM
Hello! I am working with version 4.1.3 (latest) of the Splunk Add-on for Microsoft Cloud Services that is installed on Splunk Enterprise 8.0.5. My objective is to pull data from an Azure Event Hub. I have configured an Azure App Account as well as an Azure Event Hub input, but when enabled the data does not come through. Instead I get an unauthorized access error stating that listen claims are required: 2021-05-26 13:40:40,305 level=WARNING pid=15598 tid=Thread-1 logger=uamqp.receiver pos=receiver.py:get_state:270 | LinkDetach("ErrorCodes.UnauthorizedAccess: Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://<namespace>.servicebus.windows.net/<event_hub_name>/consumergroups/$default/partitions/0'. TrackingId:786bfa2366b4413aa87b20c898f7f316_G38, SystemTracker:gateway5, Timestamp:2021-05-26T13:40:40") I referred to the troubleshooting section of the manual, but it only says to ensure that all IDs are correct, which I checked and rechecked numerous times. The correct claims are also configured but I still run into the same issue. I also found this thread which had the issue, but the resolution does not apply to my case. How can I get around this issue? Thank you and best regards, Andrew
... View more
Labels
- Labels:
-
other
-
scripted input
05-18-2021
05:51 AM
@Federico92 This works like a charm! Thank you!
... View more
05-03-2021
09:58 AM
Hello, I'm trying to get more detailed information about my scheduled saved searches, especially when they complete with success but contain errors and warnings in the stack trace. I see that all details are stored in the $SPLUNK_HOME/var/run/splunk/dispatch folder and I am wondering if this folder can be monitored by Splunk. Is this possible? Thank you and best regards, Andrew
... View more
- Tags:
- dispatch
- search.log
04-07-2021
02:55 AM
@arowsell_splunk This is exactly what I needed! I set HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS in props.conf to "à°" to solve. Thank you so much! @manuelostertag I tried the suggestion with the german characters in the field headers and it worked: updated csv: timestamp;field_no_spaces;Field With Spaces;field_with_accented_a_à;field_with_degree_°;german_characters_ßäü 2020-01-01 10:00:00;value;value;value;value;value HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = à°ßäü in props.conf does it not work for you?
... View more
04-05-2021
11:39 PM
Hello, I have a scripted input with a CRON set to 50 5-23 * * * so that it "sleeps" between the hours of midnight and 6AM. I noticed, however, that the script is "sleeping" between the ours of 2AM and 8AM. After investigating I discovered that the CRON was running with UTC time standard and not my time zone, which is currently CEST. How do I set it to run in line with my timezone instead of the UTC time standard? With other objects like saved searches the timezone is retrieved from the account that owns the object, but with scripted inputs I don't see this option. Thanks! Andrew
... View more
Labels
- Labels:
-
inputs.conf
-
scripted input
03-24-2021
11:42 PM
Ciao @manuelostertag! Unfortunately I did not find a solution and no responses came from the community. If you manage to find a solution then feel free to update here 🙂 Best regards, Andrew
... View more
03-09-2021
07:54 AM
1 Karma
Hello! I see that a new version of the Splunk Cloud Gateway (https://splunkbase.splunk.com/app/4250) was released on March 4th. Is it compatible with Python3? If not, when? Thanks! Andrew
... View more
- Tags:
- cloud gateway
Labels
- Labels:
-
administration
-
configuration
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-06-2024
02:53 PM
|
Karma from
Karma given to
