Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gaurav_maniar
gaurav_maniar
Builder
Member since:
02-05-2017
12-03-2021
Community Statistics
| Posts | 166 |
| Solutions | 29 |
| Karma Given | 4 |
| Karma Received | 54 |
| Member Since | 02-05-2017 |
Activity Feed
- Got Karma for Re: Export to csv on click of button. 02-27-2025 04:43 AM
- Got Karma for Re: Export to csv on click of button. 08-11-2024 11:53 PM
- Got Karma for Re: Export to csv on click of button. 08-05-2024 11:59 PM
- Got Karma for Re: Export to csv on click of button. 07-31-2024 10:45 PM
- Got Karma for Re: Export to csv on click of button. 06-26-2023 02:35 AM
- Got Karma for Re: sort multi value field by word length. 04-26-2023 02:45 AM
- Got Karma for Re: Export to csv on click of button. 02-24-2023 09:05 AM
- Got Karma for Re: Export to csv on click of button. 09-13-2022 05:41 AM
- Got Karma for Re: Export to csv on click of button. 06-27-2022 11:35 PM
- Got Karma for Re: Help with script to make Splunk status up automatically if Splunk is down. 03-18-2022 10:04 AM
- Got Karma for Re: Export to csv on click of button. 02-07-2022 11:12 AM
- Posted Re: Issue with Microsoft Azure add-on for Splunk on All Apps and Add-ons. 12-03-2021 03:35 AM
- Got Karma for Re: Export to csv on click of button. 07-13-2021 07:06 AM
- Got Karma for App setup.xml - 404 page not found. 02-24-2021 03:35 PM
- Posted Re: How to call a python script from an html view? on Splunk Dev. 01-21-2021 02:01 AM
- Posted Re: How to provide the upload option in a view to upload procedure documents in the Splunk app static folder? on Dashboards & Visualizations. 01-20-2021 09:31 PM
- Posted Re: How to upload file on dashboard, without navigating to another page? on Splunk Search. 01-20-2021 09:29 PM
- Posted What is the best way to monitor large log files? on Getting Data In. 12-02-2020 10:48 AM
- Tagged What is the best way to monitor large log files? on Getting Data In. 12-02-2020 10:48 AM
- Tagged What is the best way to monitor large log files? on Getting Data In. 12-02-2020 10:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 |
11-12-2019
04:32 AM
As long as the file permission are correct, Splunk will manage modification of files with insert of new lines, without particular configurations. Splunk automatically reads the modified files and forward the newly added logs.
Windows may prevent reading of open files. In that case you can add monitorNoHandle to your file monitor configuration. This Windows-only input lets you read files on Windows systems as Windows writes to them.
For more details - https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Monitorfilesanddirectories
If the given information answers your all queries, please accept the answer to close the question.
... View more
11-12-2019
03:05 AM
1 Karma
provide the screenshot of the log file and the same data in Splunk.
I think, the issue is because of sourcetype configuration for multiline event.
... View more
11-12-2019
02:56 AM
1 Karma
Hi,
Splunk File Monitoring does not lock the file for writing while indexing the data.
The purpose of Monitoring is to read the files as soon as it gets new data, but it will not lock the file for writing by the application that modifying it.
If there are many source systems, instead of installing Splunk on all the system rather gather all the logs on central system by file transfer or other methods.
Now monitor all the logs from the Central system via Splunk.
... View more
11-11-2019
12:41 PM
Please provide proper example with sample output and expected output.
... View more
11-11-2019
11:45 AM
1 Karma
Hi Hoytn,
please try the below working example,
| makeresults | eval query="sourcetype=splunkd* | head 1" | outputlookup query_lookup.csv
Now get the result from lookup via sub-search,
index=_internal | search [| inputlookup query_lookup.csv | return $query]
Accept the answer if it helps.
... View more
11-11-2019
08:24 AM
Append this to your query,
...| eval allowed = if(like(allowed_group, “%”.accessed_group.”%”), “yes”, “no”)
It will check, if values of accessed_group is present in allowed_group or not.
Accept the answer if it helps.
... View more
11-11-2019
06:31 AM
hi,
Add html input in the dashboard and handle change values from javascript to set token.
<form script="html_input.js">
<fieldset submitButton="true">
<html>
<label>Range 0-20 step=2</label>
<input type="range" id="slider_input" value="10" min="0" max="20" step="1"/>
</html>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults | eval slider_value=$slider_value$</query>
<earliest>-1h@h</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<form>
html_input.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc){
var tokens = mvc.Components.get('default');
$(document).on("input change", "#slider_input", function(){
tokens.set("slider_value", $(this).val());
});
});
UPDATE
at line 10, element id was used without # .
... View more
11-11-2019
04:41 AM
hi Arun,
Your question is very broad, but I will try to answer it as specific as possible.
Create Custom .conf file
- You can include setup.xml in your application. Using it you can create your custom conf and modify it.
- It will be accessible to users from "Manage Apps" page.
- Setup page is useful when you want to customize an app for a particular usage
- You can update the values using the setup page. The values will be saved in local directory of the app
- https://dev.splunk.com/enterprise/docs/developapps/setuppage
Now, to read the custom conf value, use the below code with your splunk python script,
from splunk.clilib import cli_common as cli
.
...
.
cfg = cli.getConfStanza('custom_conf_file_name','custom_stanza')
print cfg.get('parameter')
Let me know if you have any queries.
... View more
11-11-2019
01:57 AM
Still it is not working? which Splunk version you are using?
Check the article with FieldAlias bug on Splunk versions.
https://docs.splunk.com/Documentation/Splunk/7.3.1/ReleaseNotes/Fieldaliasbehaviorchange
... View more
11-11-2019
12:38 AM
1 Karma
Hi @jeswin96 ,
All the assets uploaded through SplunkWeb will be available at,
$SPLUNK_HOME$/etc/apps/<app_name>/appserver/static/
... View more
11-08-2019
01:59 PM
Hi,
It is also possible, without hidden panel
If your search is taking time to execute, so till your search execution is not completed, you will see the token variable as panel title.
<row>
<panel>
<title>$panel_title$</title>
<table>
<search>
<query>index=foo |timechart count as devAppCount | eval devAppC=10*devAppCount | head 1 | table devAppC</query>
<earliest>-1h@h</earliest>
<latest>now</latest>
<done>
<set token="panel_title">$result.devAppC$</set>
</done>
</search>
</table>
</panel>
</row>
... View more
11-08-2019
01:58 AM
it looks like the issue with epoc time format of Splunk & standard format in Elastic.
I don't know much about Elastic, but will let you know if I find something on this.
... View more
11-07-2019
02:35 PM
1 Karma
Hi,
Try the below code, if it works you can hide the first row with depends .
The input values should be space separated - 111 222 333
<form theme="dark">
<label>Serials</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="serials">
<label>Removed Serials</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults | eval input_sql="$serials$" | makemv delim=" " input_sql | mvexpand input_sql | eval input_sql="'".input_sql."'" | mvcombine delim="," input_sql | nomv input_sql</query>
<earliest>-5m@m</earliest>
<latest>now</latest>
<done>
<set token="input_sql">$result.input_sql$</set>
</done>
</search>
</table>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>|dbquery REPORT_DB "Select * from abc IP.Serial IN ($input_sql$)"</query>
<earliest>-5m@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>
accept the answer if it helps.
... View more
11-07-2019
01:53 PM
1 Karma
can you please check the permission of the FIELDALIAS?
If permission is private and you are looking for FIELDALIAS in the different app that it is created, it will not show.
If the permission is private, change it to 'All Apps', 'Read' allow 'Everyone'.
... View more
11-07-2019
12:22 PM
Provide one input and expected query example
... View more
11-07-2019
12:16 PM
1 Karma
If its standalone search head, you can refresh configuration without restart by, goto
‘https://splunk_host:8000/en-US/debug/refresh/‘ and hit Refresh button.
... View more
11-07-2019
07:06 AM
1 Karma
Hi @danielbb ,
Syntax for defining FIELDALIAS is incorrect. It should be,
[<sourcetype>]
FIELDALIAS-test2 = status AS aaaaaa
Refer to the document, https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Configurefieldaliaseswithprops.conf
As you have configured it from the UI this should not be the case. Which Splunk version you are using?
May be your FIELDALIAS created from UI is being ignored by any manually added FIELDALIAS for same sourcetype with same name.
UPDATE
From version 7, FIELDALIAS created from web are store with ASNEW keyword.
As per the documentation, creating FIELDALIAS with props.conf AS keyword is used in definition.
But both will work.
... View more
11-07-2019
06:40 AM
just remove that print line and try with timeout changes
... View more
11-07-2019
05:50 AM
Nor sure if the following changes will work or not, just give it try.
Open file - /hp400srv2/apps/SPLUNK_8/splunk/etc/apps/TA-elasticsearch-data-integrator---modular-input/bin/ta_elasticsearch_data_integrator_modular_input/elasticsearch/transport.py
- goto line number 353 and change it from timeout=timeout to timeout=60s
- add print str(body) before line number 341 try
Let me know the new errors
... View more
11-07-2019
03:56 AM
I can suggest a work around.
Schedule the script with cron and save the output of the script to a file and monitor that file in Splunk.
So whenever the script is executed, it will create the file.
It will not totally stop the duplicates but,
- in case there is no updates in the file names, than the same files names will not be indexed multiple times.
- file names will be listed in alphabetic order, so if any file is renamed / removed / added than only it will reindex the entire file.
... View more
11-07-2019
03:05 AM
Hi @Anantha123 ,
I have updated my answer.
please answer the comments from @sandeepmakkena and @arjunpkishore5 , so that we can provide better solution.
... View more
11-06-2019
04:22 AM
The results of my query and the your query are different even for failed/skipped saved searches.
According to rest query, there are very few failed searches, but when compared manually with searches that were not executed, than they were not in the results.
... View more
11-05-2019
01:45 PM
1 Karma
Hi @Anantha123 ,
Put this query inside a hidden panel/row. On search done action, set a token to the `devAppcz value and use that token as panel title.
Try the below code,
<row depends="$hidden$">
<panel>
<table>
<search>
<query>index=foo |timechart count as devAppCount | eval devAppC=10*devAppCount | head 1 | table devAppC</query>
<earliest>-1h@h</earliest>
<latest>now</latest>
<done>
<set token="panel_title">$result.devAppC$</set>
</done>
</search>
</table>
</panel>
</row>
<row>
<panel>
<title>$panel_title$</title>
<table>
<search>
<query>|makeresults | eval title="$panel_title$" | table title</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
Accept the answer if it helps.
... View more
11-05-2019
12:25 AM
Hi @atammana_splunk ,
Opps, I mistaken the Dashboard beta with Dashboard Example app.
The app available with .spl extension. The app file can be easily extracted using 7zip application on Windows or by using "tar" command on windows/linux systems. "tar" is zip/unzip command, not any installation command.
tar -xvf<path_to_file>/<app_file>.spl -C <destination>/<folder>/
Once application file is extracted, it will create two folders.
Now copy/paste these 2 folders inside $SPLUNK_HOME$/etc/apps/
Now, restart your Splunk to load the application or you can load it without restart by going to URL,
https://:8000/en-US/debug/refresh --> click refresh.
Once page loading is complete, refresh your Splunk Home page, and dashboard app will be available in the application list.
Accept & up-vote the answer if it helps.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-03-2021
07:08 AM
|
Karma from
