Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About poete
poete
Builder
Member since:
01-16-2017
01-04-2021
Community Statistics
| Posts | 152 |
| Solutions | 28 |
| Karma Given | 22 |
| Karma Received | 30 |
| Member Since | 01-16-2017 |
Activity Feed
- Got Karma for Re: How to parse Splunk XML response data in python. 01-02-2021 01:51 PM
- Got Karma for Re: Hide Dashboard title but not edit and export buttons. 12-11-2020 05:00 AM
- Karma Re: To include 80+ applications in SPL for KailA. 06-05-2020 12:50 AM
- Karma Re: Why does my dashboard time picker default to use only the earliest time in my token's date time range? for KailA. 06-05-2020 12:50 AM
- Karma Time Picker - The chosen Date Range change by itselft in my dashboard for KailA. 06-05-2020 12:50 AM
- Karma Re: How do you do a trend calculation with a plus sign? for KailA. 06-05-2020 12:50 AM
- Karma Re: How do I use the addcoltotals command with a stats list or stats values? for KailA. 06-05-2020 12:50 AM
- Karma Is there a way to determine the install date for Splunk universal forwarders? for jwalzerpitt. 06-05-2020 12:50 AM
- Got Karma for Re: Dashboard display fields language.. 06-05-2020 12:50 AM
- Got Karma for Re: How to convert hexadecimal IP to decimal. 06-05-2020 12:50 AM
- Got Karma for Re: How to access a property on the last element in an array,accessing last element in json array?. 06-05-2020 12:50 AM
- Got Karma for Re: regex field extraction. 06-05-2020 12:50 AM
- Got Karma for Re: How to group a list per Index/object?. 06-05-2020 12:50 AM
- Got Karma for Re: Parse Nested JSON Array into Splunk Table. 06-05-2020 12:50 AM
- Karma Re: Transpose and Group By? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to convert a chart back to its original format? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: What is a query to get a comparison between last week's results and this week's results? for woodcock. 06-05-2020 12:49 AM
- Karma Re: What is a query to get a comparison between last week's results and this week's results? for somesoni2. 06-05-2020 12:49 AM
- Karma Horizon Chart - How can I change the axis based on user's timezone? for alvin_kwong. 06-05-2020 12:49 AM
- Karma Re: Does anyone know the base recommended amount of disk space for Splunk Enterprise exclusive of indexed data? for somesoni2. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
08-09-2019
02:06 AM
1 Karma
Hello @nagar57,
just add a few lines of js in order to hide the dashboard title at load time.
Here is the content of the js file.
require(['splunkjs/mvc','jquery', 'splunkjs/mvc/simplexml/ready!'], function (mvc,$) {
var utils = require("splunkjs/mvc/utils");
$(document).ready(function () {
var l = document.getElementsByClassName("dashboard-title dashboard-header-title");
l[0].innerHTML = "";
});
});
The js file shall be set in the appserver/static directory of the app and referenced in the dahboard like this:
<form script="name_of_the__script.js">
... View more
08-08-2019
07:48 AM
Hello @vn86893,
please find the requst below :
| makeresults
| eval _raw = "{\"action\": \"Get\", \"applicationName\": \"abc\" ,\"controller\": \"Main\", \"ip\": \"123.123.123.123\", \"logLevel\": \"INFO\", \"loggerType\": \"abcdef\", \"machineName\": \"windows\", \"message\": {\"Value\":{\"Data\":{\"Items\":[{\"FieldType\":\"abc\",\"Value\":\"\"},{\"FieldType\":\"abcd\",\"Value\":\"\"},{\"FieldType\":\"123\",\"Value\":\"\"}],\"EncryptedDocKey\":\"123456\",\"Domain\":\"Order\",\"Partner\":\"India\",\"Carrier\":\"Idea\"},\"RequestTrackerId\":\"7894561230\",\"Message\":\"OK\"},\"Formatters\":[],\"ContentTypes\":[],\"DeclaredType\":\"null\",\"StatusCode\":\"null\"},\"principalId\":\" 22222222-2222-2222-2222-222222222222\", \"requestMethod\": \"POST\", \"requestUrl\": \"https://abc.com/api/v1/get\", \"responseData\": {\"Value\":{\"Data\":{\"Items\":[{\"FieldType\":\"abc\",\"Value\":\"\"},{\"FieldType\":\"123\",\"Value\":\"\"},{\"FieldType\":\"xyz\",\"Value\":\"\"}],\"EncryptedDocKey\":\"123456789\",\"Domain\":\"Order\",\"Partner\":\"india\",\"Carrier\":\"idea\"},\"RequestTrackerId\":\"7894561230\",\"Message\":\"OK\"},\"Formatters\":[],\"ContentTypes\":[],\"DeclaredType\":\"null\",\"StatusCode\":\"null\"}, \"time\": \"2019-07-10 18:35:23.3893\", \"traceId\": \"12345678963525\", \"userName\": \"abc/12345\" }"
| spath path=message.Value.Data.Items{}.FieldType
| spath path=message.Value.Data.EncryptedDocKey
| spath path=message.Value.Data.Domain
| spath path=message.Value.Data.Partner
| spath path=message.Value.Data.Carrier
| spath path=message.Value.RequestTrackerId
| rename message.Value.Data.Items{}.FieldType as FieldType message.Value.Data.EncryptedDocKey as EncryptedDocKey message.Value.Data.Domain as Domain message.Value.Data.Partner as Partner message.Value.Data.Carrier as Carrier message.Value.RequestTrackerId as RequestTrackerId
| table FieldType,EncryptedDocKey,Domain,Partner,Carrier,RequestTrackerId
... View more
08-08-2019
06:33 AM
1 Karma
Hello @yomixxxmx,
this gives the result you expect.
| makeresults
| eval _raw = "{ \"container_id\":\"ABC0001\",\"name_box\":\"mangoes\",\"total_boxes_inside\":3, \"boxes\" : [ { \"box_index\":\"121212\",\"box_label\": [ \"sweet\",\"yellow\",\"imported\" ] } , { \"box_index\":\"232323\",\"box_label\": [ \"green\",\"local\",\"sour\",\"hybrid\" ] } , { \"box_index\":\"343434\",\"box_label\": [ \"very sweet\",\"local\",\"round\",\"pink\" ] } ] }"
| spath
| table _raw,container_id,name_box
| spath path=boxes{}
| rename boxes{} as boxes
| mvexpand boxes
| spath input=boxes
| rename box_label{} as box_label
| table container_id,name_box, box_index,box_label
I got the idea from the spah documentation, bottom example (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath).
... View more
08-08-2019
01:03 AM
1 Karma
Hello @kripzadamas,
check the following, it meets your requirements. I got the idea from the documentation (botton of this page https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath).
|makeresults | eval _raw="{ \"items\": [ { \"parts\": [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"101\",\"counter\":1019 }, { \"code\":\"0\",\"var\":\"\",\"pNum\":\"102\",\"counter\":1029 } ], \"se\":\"A1\", \"so\":\"111\" }, { \"parts\": [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"301\",\"counter\":3019 }, { \"code\":\"0\",\"var\":\"\",\"pNum\":\"302\",\"counter\":3029 } ], \"se\":\"A3\", \"so\":\"333\" }, { \"parts\": [ { \"code\":\"0\",\"var\":\"\",\"pNum\":\"401\",\"counter\":4019 } ], \"se\":\"A4\", \"so\":\"444\" }, { \"parts\": [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"501\",\"counter\":5019 } ], \"se\":\"A5\", \"so\":\"555\" } ], \"id\":\"x.9110790\", \"cr\":\"x-273169\" }"
| spath
| table _raw,cr,id
| spath path=items{}
| rename items{} as items
| mvexpand items
| spath input=items
| rename parts{}.code as code parts{}.counter as counter parts{}.pNum as pNum parts{}.var as var
| eval x=mvzip(code,mvzip(counter,pNum))
| table cr,id,x,var,se,so
| mvexpand x
| eval x = split(x,",") | eval code=mvindex(x,0)| eval counter=mvindex(x,1)| eval pNum=mvindex(x,2)
| table id,cr,se,so,code,var,pNum,counter
... View more
08-07-2019
07:24 AM
Hello @noahdietrich,
I played a bit with your question, and I could not have it work either, using the 'in' function.
I somehow found a workaround, and it looks like this :
First, I modified the multiselect.
<input type="multiselect" token="txt_weekend_days">
<label>Weekend Days</label>
<choice value="Saturday">Saurday</choice>
<choice value="Sunday">Sunday</choice>
<choice value="Monday">Monday</choice>
<choice value="Tuesday">Tuesday</choice>
<choice value="Wednesday">Wednesday</choice>
<choice value="Thursday">Thursday</choice>
<choice value="Friday">Friday</choice>
<initialValue>Saturday,Sunday</initialValue>
<delimiter>,</delimiter>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
This is in order to get a string as txt_weekend_days token
Then, as the in function does not seem to work witthin the expression of the colorPalette, I modified the condition too :
<format type="color" field="day">
<colorPalette type="expression">if(isnotnull(mvfind(split($txt_weekend_days$,","),value)),"#FF0000", "#00FF00")</colorPalette>
</format>
It does the trick, as far I can see.
Yet be carefull, it does not seem the expression is re-evaluated every time the txt_weekend_days token is modified.
I hope this helps!
... View more
08-06-2019
10:29 PM
1 Karma
Hello, @arun_kant_sharma.
I had a look to this pb myself some time ago.
Here are the steps you can use in order to translate xml labels and titles.
Create a lookup in order to translate the labels and titles, based on the locale (ja-JP, fr-FR, en-US, ...)
It should look like :
locale,label,title1
fr-FR,phrase,titre1
en-US,sentence,title1
Add as many columns as needed to fit the number of titles.
Add dd as many coa search to your dashboard, looking like this :
|inputlookup yourlookup.csv
search locale=$env:locale|s$
$result.title1$
$result.label$
Add some js to your dashboard
In the js, you can get the content of the tokens, see http://dev.splunk.com/view/webframework-developapps/SP-CAAAEW3
From there, you can replace the content of the <label> tag of the dashboard, and replace it with the value of LabelToken.
In case you need to change the title of different panels, add an id in the <panel> tags, in order to get the right panel.
... View more
08-29-2018
09:12 AM
1 Karma
Hello @KChaudhary,
here is the answer:
| makeresults
| eval sample="1,1,2,2,1,2,1,2,1,2,1,2,2,2,2,2"
| makemv delim="," sample
| mvexpand sample
| delta sample as diff
| eval diff=abs(diff)
| fillnull diff
| accum diff as cum
... View more
08-29-2018
08:39 AM
Hello @pfabrizi,
did you check the global settings of the server, and more especially the timezone?
In addition, did you check the timezone of the user you are running the tests with?
I hope this helps
... View more
08-09-2018
11:00 PM
Hello @flzhang132,
assuming your are using a simple xml dashboard, simply edit the xml (edit->source code), and cut/past thepanel contraining the second gauge into the row containing the first one, and then delete the empty row.
... View more
08-09-2018
04:44 AM
Hello @sangs8788 ,
please have a look at addtotals (http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Addtotals) , and in particular at the last sections of the page.
Once you have the total, you should be able to compute the percentage.
... View more
08-09-2018
12:52 AM
Hello @aorkcreate,
can you please share a sample of the data you are working with?
... View more
08-08-2018
06:22 AM
@bizsplunk,
most probably, the environment variable breaks one the space between Program and Files. Can you try to set SPLUNK_HOME with double quotes and run npm again?
... View more
08-08-2018
05:42 AM
@bizsplunk,
locate the package.json file at the root of your viz directory, and open it with a test editor.
Then, you should finf lines like :
"scripts": {
"build": "%SPLUNK_HOME%/bin/splunk cmd node ./node_modules/webpack/bin/webpack.js",
"devbuild": "%SPLUNK_HOME%/bin/splunk cmd node ./node_modules/webpack/bin/webpack.js --progress",
"watch": "%SPLUNK_HOME%/bin/splunk cmd node ./node_modules/webpack/bin/webpack.js -d --watch --progress"
},
... View more
08-08-2018
05:37 AM
Hello @amiftah,
as you are running npm on windows, please check if the package.json file, the $SPLUNK_HOME is replaced by %SPLUNK_HOME%
... View more
08-08-2018
05:31 AM
Hello @bizsplunk,
as you are running npm on windows, please check if the package.json file, the $SPLUNK_HOME is replaced by %SPLUNK_HOME%
... View more
08-07-2018
11:37 PM
Hello @kulsplunk,
where do you want the message to be displayed? On the dashboard? In an alert popup?
Can you please give more details?
... View more
08-07-2018
11:31 PM
Hello @jip31,
what are you trying to do with this line : | eval Disk = FreeSpace "/" TotalSpace
It does not concatenate and does not perform an operation.
Did you not mean | eval Disk = FreeSpace ."/". TotalSpace ?
... View more
08-07-2018
08:29 AM
1 Karma
Hello @ChrisCLewis,
As you have a csv file containing the list of valid companies, it sould be quite easy to:
extract the company name from the email address field using the rex command
Get the companies not matchng to the list of valid companies, following this answer: https://answers.splunk.com/answers/35092/where-username-not-equal-to-list-of-usernames-in-lookup-table.html
... View more
08-07-2018
08:14 AM
Hello @jvergara,
did you check if the duplicated events where indexed at the same time (same activation of the modular input)?
We have to rule out the possibility that your query from the database returns 2 times the same events.
... View more
08-07-2018
06:59 AM
1 Karma
Hello @cromm,
I think you should try using < and > instead if < and > in your panel code.
Can you please try this?
... View more
08-07-2018
06:31 AM
Hello @vijayakumarkb,
can you please be more precise. ARe the Header1, ...Header 4 static values, or the result of the SPL search.
The reason I am asking is that, in case the fields are static, this can be done quite easily with a html dashboard.
Otherwise, I need mode details to have a look at your question.
... View more
08-07-2018
02:13 AM
Hello @jbp4444,
I would start using the usual log display in the console (console.log(something).
If you open the console (F12 key for chrome), you will be able to see the output, and from there, debug your javascript code.
... View more
08-02-2018
02:06 AM
Hello @Amandeepsin,
please try the following :
| rest /services/saved/searches | table next_scheduled_time, eai:acl.owner
The next_scheduled_time info will let you know when the search will be scheduled next, and eai:acl.owner will let you know the user name. The rest command returns a lot of fields. Some of them may also help you.
More info about the rest command can be found in: https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Rest
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-04-2021
08:46 AM
|
