Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About poete
poete
Builder
Member since:
01-16-2017
01-04-2021
Community Statistics
| Posts | 152 |
| Solutions | 28 |
| Karma Given | 22 |
| Karma Received | 30 |
| Member Since | 01-16-2017 |
Activity Feed
- Got Karma for Re: How to parse Splunk XML response data in python. 01-02-2021 01:51 PM
- Got Karma for Re: Hide Dashboard title but not edit and export buttons. 12-11-2020 05:00 AM
- Karma Re: To include 80+ applications in SPL for KailA. 06-05-2020 12:50 AM
- Karma Re: Why does my dashboard time picker default to use only the earliest time in my token's date time range? for KailA. 06-05-2020 12:50 AM
- Karma Time Picker - The chosen Date Range change by itselft in my dashboard for KailA. 06-05-2020 12:50 AM
- Karma Re: How do you do a trend calculation with a plus sign? for KailA. 06-05-2020 12:50 AM
- Karma Re: How do I use the addcoltotals command with a stats list or stats values? for KailA. 06-05-2020 12:50 AM
- Karma Is there a way to determine the install date for Splunk universal forwarders? for jwalzerpitt. 06-05-2020 12:50 AM
- Got Karma for Re: Dashboard display fields language.. 06-05-2020 12:50 AM
- Got Karma for Re: How to convert hexadecimal IP to decimal. 06-05-2020 12:50 AM
- Got Karma for Re: How to access a property on the last element in an array,accessing last element in json array?. 06-05-2020 12:50 AM
- Got Karma for Re: regex field extraction. 06-05-2020 12:50 AM
- Got Karma for Re: How to group a list per Index/object?. 06-05-2020 12:50 AM
- Got Karma for Re: Parse Nested JSON Array into Splunk Table. 06-05-2020 12:50 AM
- Karma Re: Transpose and Group By? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to convert a chart back to its original format? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: What is a query to get a comparison between last week's results and this week's results? for woodcock. 06-05-2020 12:49 AM
- Karma Re: What is a query to get a comparison between last week's results and this week's results? for somesoni2. 06-05-2020 12:49 AM
- Karma Horizon Chart - How can I change the axis based on user's timezone? for alvin_kwong. 06-05-2020 12:49 AM
- Karma Re: Does anyone know the base recommended amount of disk space for Splunk Enterprise exclusive of indexed data? for somesoni2. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-08-2018
10:12 PM
Hello @Cuonghuutran,
just a few questions:
Is the <set token="InQueryHash">b6ffee0d1c4f18ba</set> located in the <init></init> of the dashboard? A previous search?
Did you try to display $InQueryHash$ in the title of the table? This is faster than installing the Developper Gadget App , but less powerful.
... View more
07-07-2018
03:15 AM
Hello @sh254087,
did you try to use a css in order to change the size of the text displayed in the colum of the table displaying the 'list of books'? I would advise, in Splunk, once the 'title' selected in the dropdown, to display a dedicated row containing a panel (table). This table, once given the right id, can be modified using the id as reference, in order to change the size of the strings in the column refering to the 'list of books' of the author.
Would this be a suitable way to solve your problem?
If so, I can provide an example and references to splunk docs as an answer here
... View more
07-06-2018
06:03 AM
Hello @drultima,
try using rex. For instance:
| makeresults
| eval sc_status="d=b12cLNsVYpmzlry7j5YnBWAea9DqTv7wf4KfnNW5f9uikX1OCcOXHgiGq_gTDdu_Xvuof5kiKu38xBB1vNS7v5kRAsG6Ek5h1XRZs26gkWNCidig5vcOxuVvPxWs3rwqIlHHuo78Yvs6s0jWw9CZ8gAb6HVevXpGJmp6QnvrVCAP50ry0&t=636407345820000000"
| rex field=sc_status "(?^[0-9\.]+)"
will give you a null iis_status, you can then filter out.
For more details about rex, please refer to:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Rex
... View more
07-06-2018
03:00 AM
Hello @NeaIM,
did you already create the sourcetype and index the data sample you provided?
... View more
07-06-2018
02:12 AM
@MERBAG,
depending if you are running a single instance of Splunk, or an instance with separate indexer and search head, the steps for the props.conf to be taken into account are different.
If you are running on a single instance, in what directory is located the props.conf file you modified?
... View more
07-06-2018
01:44 AM
| makeresults
| eval _time=strptime("Jul 6 09:31:18.729: %SYS-5-CONFIG_I: Configured from console by username on vty1 (ip-address)","%b %e %H:%M:%S.%3Q")
works like a charm. Are you sure you are modifying the right props.conf file?
... View more
07-06-2018
01:29 AM
Well, that's good to know. I always used %Q up to now, and it always worked so far. May be worth a try
... View more
07-06-2018
01:17 AM
Hello @MERBAG,
it seems that the fomat for the millisesonds is not OK.
According to the documentation (https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Commontimeformatvariables),
replace %3N with %3Q
... View more
07-06-2018
12:51 AM
Helpful link:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join
... View more
07-06-2018
12:51 AM
Hello @svemurilv,
is it a typo or do you have both Indic, with capital i and indic in the data?
Assuming this is the case, you can try something like this:
index=<firstIndex> Indic="hostname"|join domain host [search index=<secondIndex>]
This will associate, if existing, the ipadd of the second source to the result of the first search, with matching domain and host.
... View more
07-05-2018
05:24 AM
Hello @shraddhamuduli,
In what kind of index/table are the information stored?
Are the 2 fields configured as inut in a dashboard or the result of a query?
It would be interesting to know in order to be more to the point where providing the answer to your question.
... View more
07-04-2018
07:56 AM
Hello @kpavan,
If you want to use HEC, this probably means you want to send the lines of the log files as input through http.
First, if not already done, read carefully the following documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC
Basically, using HEC would mean setting up a process to parse the log files, detect the new lines and send the content of these lines to Splunk, once the input is created in Splunk, of course.
I hope this helps
... View more
07-04-2018
12:17 AM
1 Karma
Hello @Sukisen1981,
I created a html table from your input, and here it is.
<html>
<table style="width:100%">
<tr>
<th>Duration</th>
<th>Start Time</th>
<th>Result Rows</th>
</tr>
<tr>
<td style="text-align: center;">$duration$</td>
<td style="text-align: center;">$starttime$</td>
<td style="text-align: center;">$resultcount$</td>
</tr>
</table>
</html>
... View more
07-03-2018
11:21 PM
Hello @dhruv101,
can you please reword your question in order to include the answers to @niketnilay comments, and make astatement of what you expect to see in the tooltips?
... View more
07-03-2018
11:18 PM
Hello @Wang_xinlu, I understand you developped the tag cloud yourself, since you wrote "I am created", so I wonder. If so, you need to implement the drilldown and enable the drilldown in the vizualisations.conf file supports_drilldown = True
... View more
07-03-2018
02:42 AM
Hi @HeinzWaescher,
di you have a look at this?
https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/CryptographicFunctions
... View more
07-02-2018
08:22 AM
Hello @aayushtandon23,
I suppose you already read this, right?
https://docs.splunk.com/Documentation/Splunk/7.1.1/AdvancedDev/ModInputsBasicExample
It contains a lot of details and the structure of the app
... View more
07-02-2018
12:13 AM
Hello @derekf,
Did you have a look at this?
http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/tokens
and more precisely at the Use global tokens to access environment information section?
I think $env:locale$ is a good place to start.
Please also have a look at the following js code:
require(['splunkjs/mvc','jquery', 'splunkjs/mvc/simplexml/ready!'], function (mvc,$) {
var utils = require("splunkjs/mvc/utils");
$(document).ready(function () {
// Retrieve the default token model
var defaultTokenModel = mvc.Components.get("default");
// Listen for a change to the token value
defaultTokenModel.on("change:token", function(newToken, token, options){
var x = document.getElementById("someTag");
if (token==="True"){
x.style.stroke="red";
}
else{
x.style.stroke="lightblue";
}
});
});
});
From there, you should be able to get started
... View more
06-21-2018
08:27 AM
It works well on my side. Maybe it is a problem of refressing the dashboard, as both queries must have different execution times.
... View more
06-21-2018
05:51 AM
@shankarananth,
what is your query trying to get as a result? I do not understand the error in eval Totals=if(isnull(error),0,error) . To me, the query is not valid
... View more
06-21-2018
05:44 AM
2 Karma
Hello @sbarinov,
please try this:
| makeresults
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]
... View more
06-21-2018
05:05 AM
Hello @RobertRi,
where doas the Paameter come from? Is it the result of a search query?
... View more
06-21-2018
02:52 AM
1 Karma
Hello @shankarananth,
this is the code of the dashboard with the look of your table.
Hope this helps
<dashboard>
<search>
<query>|makeresults
| eval Value1=3.8|eval Value2=100|eval Value3=85|eval Value4=87|eval Value5=75|eval Value6="Yes"|eval Value7="No"|eval Value8=40|eval Value9=44|eval Value10=54|eval Value11="Reach"
</query>
<done>
<set token="Value1">$result.Value1$</set>
<set token="Value2">$result.Value2$</set>
<set token="Value3">$result.Value3$</set>
<set token="Value4">$result.Value4$</set>
<set token="Value5">$result.Value5$</set>
<set token="Value6">$result.Value6$</set>
<set token="Value7">$result.Value7$</set>
<set token="Value8">$result.Value8$</set>
<set token="Value9">$result.Value9$</set>
<set token="Value10">$result.Value10$</set>
<set token="Value11">$result.Value11$</set>
</done>
</search>
<row>
<panel>
<html>
<head>
<style>
table, th, td {
border: 1px solid black;
border-collapse: collapse;
}
th, td {
padding: 5px;
text-align: left;
}
</style>
</head>
<body>
<table style="width:100%">
<tr>
<th>Measures</th>
<th>DB</th>
<th>Detail</th>
<th>Value</th>
<th>Reached</th>
</tr>
<tr>
<td rowspan="6">DB Connect</td>
<td>Oracle</td>
<td>Data Processed volume</td>
<td><3.5%</td>
<td>$Value1$</td>
<!--<td rowspan="2">Logs</td>
<td rowspan="2">lookup</td>-->
</tr>
<tr>
<td rowspan="4">SQL Server</td>
<td rowspan="4">Data Processed volume</td>
<td>100%</td>
<td>$Value2$</td>
</tr>
<tr>
<td>>80%</td>
<td>$Value3$</td>
</tr>
<tr>
<td>>60%</td>
<td>$Value4$</td>
</tr>
<tr>
<td>>40%</td>
<td>$Value5$</td>
</tr>
<tr>
<td>DB2</td>
<td>Data Processed volume</td>
<td><=3</td>
<td>$Value6$</td>
</tr>
<tr>
<td rowspan="2">Logs</td>
<td>Unstructured</td>
<td>Data Processed volume</td>
<td>>=80%</td>
<td>$Value7$</td>
</tr>
<tr>
<td>Structured</td>
<td>Data Processed volume</td>
<td>>=60%</td>
<td>$Value8$</td>
</tr>
<tr>
<td rowspan="3">Lookup</td>
<td>Country</td>
<td>Number of countries</td>
<td>>=40%</td>
<td>$Value9$</td>
</tr>
<tr>
<td>State</td>
<td>Number of State</td>
<td><=3%</td>
<td>$Value10$</td>
</tr>
<tr>
<td>Continent</td>
<td>Number of Continents</td>
<td>>=80%</td>
<td>$Value11$</td>
</tr>
</table>
</body>
</html>
</panel>
</row>
</dashboard>
... View more
OK. And what about this?
| mstats count(_value) where index=* AND metric_name=* by index
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-04-2021
08:46 AM
|
