Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dmarling
dmarling
Builder
Member since:
02-22-2017
Community Statistics
| Posts | 228 |
| Solutions | 42 |
| Karma Given | 44 |
| Karma Received | 116 |
| Member Since | 02-22-2017 |
| dmarling@paychex.com |
Activity Feed
- Got Karma for Re: How to find all Dashboards, Reports and Alerts related to a specific index ?. 06-03-2025 11:43 AM
- Got Karma for Re: how to upload csv data file into splunk by using REST API? Can someone provide the exact URI Used to upload CSV File. I was confusing with the URI's provided by splunk.. 11-19-2024 04:43 AM
- Got Karma for Re: How to find all Dashboards, Reports and Alerts related to a specific index ?. 10-10-2024 01:43 AM
- Got Karma for Re: How to parse Json and extract all fields. 08-06-2024 10:08 PM
- Posted Re: How to combine two searches with common value into one table on Splunk Search. 06-28-2024 11:02 AM
- Got Karma for Re: How to combine two searches with common value into one table. 06-28-2024 10:48 AM
- Got Karma for Re: Setting a webhook alert via a proxy server. 05-26-2024 07:59 PM
- Got Karma for Re: In a Simple XML dashboard, is it possible to set a token when a user clicks the submit button?. 05-07-2024 03:15 AM
- Got Karma for Re: How to encode a URL for a Hipchat notification alert action if there is no urlencode() function?. 04-11-2024 02:06 PM
- Got Karma for Re: What would intermittently cause less events to return the raw data versus the total number of events it says it matched on?. 02-26-2024 01:38 PM
- Got Karma for Re: How to create a dashboard for server status i.e. whether it is up or not?. 02-19-2024 10:41 AM
- Got Karma for Re: How to find all Dashboards, Reports and Alerts related to a specific index ?. 01-30-2024 09:35 AM
- Got Karma for Re: How to combine two searches with common value into one table. 11-09-2023 10:33 AM
- Got Karma for Re: paychex/Splunk.Conf19 Cover Your Assets (CYA): Export error with fields tagged.abcd=efgh. 09-15-2023 02:24 AM
- Got Karma for Re: How to find all Dashboards, Reports and Alerts related to a specific index ?. 08-29-2023 03:04 AM
- Got Karma for Re: How to find all Dashboards, Reports and Alerts related to a specific index ?. 02-16-2023 06:40 AM
- Got Karma for Re: How to encode a URL for a Hipchat notification alert action if there is no urlencode() function?. 01-06-2023 09:45 PM
- Got Karma for Re: How to find all Dashboards, Reports and Alerts related to a specific index ?. 12-12-2022 11:11 PM
- Got Karma for Re: how to use string from lookup table in search. 12-05-2022 12:57 PM
- Got Karma for Re: Converting bytes to GB or MB. 11-21-2022 08:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 5 | |||
| 0 | |||
| 0 |
04-11-2019
10:41 AM
The referenced host field extraction should be this so you get both http and https prefixed domains:
| rex field=URL "https?:\/\/(?<domain>[^\/\s]+)"
The "s?" in the regular expression means match 1 or 0 times so if a "s" is present it will still proceed to where the domain is located on your url.
Here's a link to this picking up both domain's you listed as examples in regex101: https://regex101.com/r/aFKeoc/1
... View more
04-11-2019
06:06 AM
Are the column names all the same? Also are these three searches scheduled at all? If not you can just have a union run all three searches and produce the results to a single table:
| union
[search search1
| eval Type="Search 1"
| table Type col1 col2 col3]
[search search2
| eval Type="Search 2"
| table Type col1 col2 col3]
[search search3
| eval Type="Search 3"
| table Type col1 col2 col3]
... View more
04-11-2019
06:00 AM
This will extract that information from _raw for any comma seperated key value pairing, which Splunk will do normally without much prompting, but this format is an odd format since it's wrapped in curly brackets like json, but contains a comma seperated key value pair instead of what I would expect from a json string.
| makeresults count=1
| eval _raw="{author=John, book=Splunk }"
| extract kvdelim="=" pairdelim=","
If your goal is to not have the curly bracket get picked up you can just remove it prior to the extract with this:
| makeresults count=1
| eval _raw="{author=John, book=Splunk }"
| rex field=_raw mode=sed "s/[\{\}]+//g"
| eval _raw=trim(_raw)
| extract kvdelim="=" pairdelim=","
... View more
04-10-2019
08:05 AM
1 Karma
If you are truly not getting any base events to pass the token to the mapped dbxquery, then it should just fail the search with an error "Error in 'map': Did not find value for required attribute 'BATCHSEQUENCE'." If your goal is not have that error at all then this can accomplish that:
[| makeresults count=1
| eval search=if(
[ search index=main sourcetype=ampData_source
| fields BATCHSEQUENCE
| dedup BATCHSEQUENCE
| sort 0 - BATCHSEQUENCE
| head 1
| stats count
| return $count]>0, "index=main sourcetype=ampData_source
| fields BATCHSEQUENCE
| dedup BATCHSEQUENCE
| sort 0 - BATCHSEQUENCE
| head 1
| table BATCHSEQUENCE
| map search=\"| dbxquery query=\\\"SELECT analyticsutil.closeBatchFunction($BATCHSEQUENCE$,'Y') from dual;\\\" connection=\\\"ERPM\\\"\" maxsearches=1", null())
| table search]
You will now just get no results instead of an error.
... View more
04-10-2019
07:48 AM
Your solution is way simplier! I like it.
... View more
04-10-2019
07:35 AM
1 Karma
This will accomplish a average of the 5 minute bucket counts over whatever time frame you run it, but it won't include the zeros that get added by the timechart process into your average.
sourcetype=system*process*gc* "[GC pause"
| rex field=source "print.prod..?(?.?)\/"
| rex field=source "system_print(?.*?)_"
| bin span=5m _time
| stats count by _time instance
| stats avg(count) as Average by instance
If you require those zeros provided by the timechart this will use that, but it will only work for a 60 minute time range of the search:
sourcetype=system*process*gc* "[GC pause"
| rex field=source "print.prod..?(?.?)\/"
| rex field=source "system_print(?.*?)_"
| timechart span=5m limit=0 count(_raw) by instance partial=f
| transpose 0 column_name="instance" header_field=_time
| addtotals
| eval Average=round(Total/11,6)
... View more
04-08-2019
10:47 AM
The search I just updated on the answer is doing that, but instead of field= subsearch, I'm having the subsearch generate that with the return command. The problem with this is you have to pass that clientip into your search three times. Shouldn't be a problem if you have this on a dashboard with tokens, but that will get annoying when having to do it by hand each time. We could use map instead to get around that:
| makeresults count=1
| eval clientIP="255.255.255.255"
| map search="| savedsearch IPresolver src=$clientIP$
[ search sourcetype=DNSlogs
[ search sourcetype=intel
| stats values(intelstuff) as queried_domain
| format]
| return clientIP queried_domain _time]
| eval
[ search sourcetype=DNSlogs $clientIP$
[ search sourcetype=intel
| stats values(intelstuff) as queried_domain
| format]
| return queried_domain]
| eval
[ search sourcetype=DNSlogs $clientIP$
[ search sourcetype=intel
| stats values(intelstuff) as queried_domain
| format]
| return _time]
| table user queried_domain _time"
... View more
04-08-2019
10:28 AM
The problem is that when you use a subsearch to pass search criteria into another search, it doesn't pass it as a new field, but as a filter when used in this context. There are a couple ways to pass in the actual field, one involves using another subsearch to pass in the field after an eval and another way would be to do it with a join on that subsearch to append that data to your resulting event(s).
Here's the subsearch method:
| savedsearch IPresolver src=$clientIP$
[ search sourcetype=DNSlogs
[ search sourcetype=intel
| stats values(intelstuff) as queried_domain
| format]
| return clientIP queried_domain _time]
| eval
[ search sourcetype=DNSlogs $clientIP$
[ search sourcetype=intel
| stats values(intelstuff) as queried_domain
| format]
| return queried_domain]
| eval
[ search sourcetype=DNSlogs $clientIP$
[ search sourcetype=intel
| stats values(intelstuff) as queried_domain
| format]
| return _time]
| table user queried_domain _time
I'm making an assumption that the intel sourcetype contains the clientIP with this query. If that's not the case, feel free to let me know and I can help you adjust it so it uses whatever field that is used to join the events.
If you want to do it with a join, we just need to know what field is being used to join the DNSlogs to the intel logs.
Edited to include the solution to the time should be DNS time problem statement as well.
... View more
04-08-2019
08:55 AM
1 Karma
Urldecode decodes with the url encoding that starts with a precentage sign. You can manipulate the data a bit to force it to work. Using the most recent example by @Boopalan I got it to work, but I had to manually account for the HTML Encoded Line Feed character
Run anywhere example:
| makeresults count=1
| eval data="- 
-- Start of getter Meods
retiremevice.io.ReturnCd: 0
retiremevice.io.RtSCd:"
| eval test=data
| rex mode=sed field=test "s/
/\n/g"
| rex mode=sed field=test "s/&#x?([^\;]+);/%\1/g"
| eval test2=urldecode(test)
It makes it look like this when it runs:
-
-- Start of getter Meods
retiremevice.io.ReturnCd: 0
retiremevice.io.RtSCd:
... View more
04-08-2019
05:34 AM
Depending on the speed to retrieve the data from the other sourcetype this can work as a streaming option by using a join to that data:
index="x" sourcetype="y" EventCode=6008
[| inputlookup host.csv]
| table _time host EventCode
| join type=left host
[search index=master-data-lookups sourcetype="view_splunk_assets"
| stats count by HOSTNAME ROOM SITE
| fields - count
| rename HOSTNAME as host]
The stats count by HOSTNAME ROOM SITE will elminate duplicates if you have any in that sourcetype. If that sourcetype is static data, it may make more sense to make that a seperate lookup file and use a lookup command like below:
index="x" sourcetype="y" EventCode=6008
[| inputlookup host.csv]
| table _time host EventCode
| lookup view_splunk_assets.csv HOSTNAME as host output ROOM, SITE
... View more
04-05-2019
01:32 PM
Can you please provide a couple of test examples of how this data appears in the raw events? This will make it easier for us to see the specific issue you are running into.
... View more
04-05-2019
01:24 PM
@JohnGilmour if this answer or the other one assisted you, please make sure to accept either of them as the accepted answer. Thank you!
... View more
04-05-2019
01:21 PM
Give this a try. It's very straight forward:
| rex max_match=0 "(?<linebreaks>\n+)"
| eval adjustedlinecount=mvcount(linebreaks)
It is extracting every line break in the event and then the adjustedlinecount field is counting how many linebreaks get returned on each event since the max_match is causing the linebreaks field to be multivalued.
... View more
04-05-2019
01:14 PM
I have a query that will perform that nesting calculation, but I'm failing to see how you will use it in a drop down. I have a run anywhere example that may answer your question, but I'd need some clarification on how you will use the token it generates as that dictates how the query needs to be constructed. Take a look at this as a first pass on this:
<form>
<label>Run Anywhere nested directory drop down</label>
<fieldset submitButton="false">
<input type="dropdown" token="directorytoken">
<label>Tier Selector</label>
<default>mvindex(directoryanalysis, 2)="splunklog"</default>
<fieldForLabel>displayname</fieldForLabel>
<fieldForValue>token</fieldForValue>
<search>
<query>| makeresults count=1
| fields - _time
| eval data="/opt/test/splunklog/testing/directory1/test1.log
/opt/test/splunklog/testing/directory1/test2.log
/opt/test/splunklog/testing/directory1/test3.log
/opt/test/splunklog/testing/directory1/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test2.log
/opt/test/splunklog/testing/directory1/directory2/testing1.log
/opt/test/splunklog/testing/directory1/directory2/testing2.log
/opt/test/splunklog/testing/directory1/directory2/testing3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test3.log"
| makemv data tokenizer="(?<data>[^\n\e]+)"
| mvexpand data
| eval data=trim(data)
| dedup data
| eval databackup=data
| makemv data delim="/"
| eval data=mvfilter(NOT match(data, "\.log"))
| eval Tiers=mvcount(data)
| mvexpand data
| streamstats count as Tier by databackup
| eval calc=Tier-1
| eval token="mvindex(directoryanalysis, ".calc.")=\"".data."\""
| stats count values(token) as token by Tier
| where Tier>=3 AND Tier<7
| eval displayname=if(Tier<6, "level ".Tier, "Greater than equal to 6")
| sort 0 + Tier
| eval token=mvjoin(token, " OR ")
| table displayname token</query>
<earliest>-5m</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults count=1
| fields - _time
| eval directory="/opt/test/splunklog/testing/directory1/test1.log
/opt/test/splunklog/testing/directory1/test2.log
/opt/test/splunklog/testing/directory1/test3.log
/opt/test/splunklog/testing/directory1/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/test2.log
/opt/test/splunklog/testing/directory1/directory2/testing1.log
/opt/test/splunklog/testing/directory1/directory2/testing2.log
/opt/test/splunklog/testing/directory1/directory2/testing3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/directory9/directory10/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test3.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test4.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test1.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test2.log
/opt/test/splunklog/testing/directory1/directory2/directory3/directory4/directory5/directory6/directory7/directory8/test3.log"
| makemv directory tokenizer="(?<directory>[^\n\e]+)"
| mvexpand directory
| eval directory=trim(directory)
| eval directoryanalysis=directory
| makemv directoryanalysis delim="/"
| eval directoryanalysis=mvfilter(NOT match(directoryanalysis, "\.log"))
| eval Tiers=mvcount(directoryanalysis)
| where $directorytoken$
| fields - directoryanalysis - Tiers</query>
<earliest>-5m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
... View more
04-05-2019
09:58 AM
This regex should grab all of your use cases when I tested it in regex101:
| rex "(Fatal data error processing file '[^\']+'\.\n?\s?|General failure \(\d+\): )(?<Exception>[^\n\$]+)"
Here's the link to the regex101 test example: https://regex101.com/r/0V46z8/1
It captures a little more than you want on your last three examples which can be trimmed off by adding this after your extraction:
| rex mode=sed field=Exception "s/FILE_(READER|WRITER)[^\e]+//g"
There's probably a little better way to prevent that extra FILE_READER/WRITER data at the end. Let me know if this works for you.
... View more
04-05-2019
07:26 AM
5 Karma
Do you have any timestamps on the events in the KV or a way to calculate what events were written when? If so it would be easy to setup a scheduled search that runs once a day that filters out events that are > 30 days ago. Conceptually it would be this if you have it attached to a lookup definition:
| inputlookup KVStoreLookupDefinition
| where epochtimefield>=relative_time(now(), "-30d@d")
| outputlookup KVStoreLookupDefinition
... View more
03-06-2019
12:52 PM
5 Karma
Run this search and then export into a csv:
| union maxtime=300 timeout=300
[| rest splunk_server="local" "/servicesNS/-/-/data/props/extractions"
| eval type="extractions"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/views"
| eval type="view" ]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/calcfields"
| eval type="calculated fields"]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/fieldaliases"
| eval type="field aliases"]
[| rest splunk_server="local" "/servicesNS/-/-/data/transforms/extractions"
| eval type="field transformations"]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/sourcetype-rename"
| eval type="sourcetype renaming"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/workflow-actions"
| eval type="Workflow actions"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/times"
| eval type="Time Ranges"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/searches"
| eval type="Saved Searches/Alerts/Reports"]
[| rest splunk_server="local" "/servicesNS/-/-/data/models"
| eval type="Data Models"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/eventtypes"
| eval type="Event Types"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/fvtags"
| eval type="List by Field value pair"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/ntags"
| eval type="List by tag name"]
[| rest splunk_server="local" "/servicesNS/-/-/admin/tags"
| eval type="Tags"]
[| rest splunk_server="local" "/servicesNS/-/-/data/lookup-table-files"
| eval type="lookup table files"]
[| rest splunk_server="local" "/servicesNS/-/-/data/transforms/lookups"
| eval type="Lookup Definitions"]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/lookups"
| eval type="Automatic lookups"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/nav"
| eval type="App UI"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/panels"
| eval type="Pre-built panels"]
[| rest splunk_server="local" "/servicesNS/-/-/messages"
| eval type="Bulletin Messages"]
[| rest splunk_server="local" "/servicesNS/-/-/admin/macros"
| eval type="Search Macros"]
| table type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write
I believe this gets most of the knowledge objects. Let me know if it misses anything.
... View more
01-14-2019
11:58 AM
I meant to include @cleroux_splunk in the question.
... View more
01-14-2019
11:53 AM
Hello,
We are considering installing this application (JellyFisher) on our production search heads, but have a concern that the custom python search commands on there will be using CPU resources on our indexers. Can you confirm if the the custom python search commands are executed in the indexer or search head tier?
... View more
12-12-2018
11:13 AM
This should provide better performance depending on the size of the lookup file:
| where
[| inputlookup regexlookup.csv
| eval matcher="match(subject,\"".regex."\")"
| stats values(matcher) as search
| eval search=mvjoin(search. " OR ")]
You can append that to any search and it will add a where statement that is populated by a serious of matches from the regex in your lookup file. If it's a massive lookup file this may cause some issues, but if it's not too big it should work alright. You'll need to substitute the name of the lookup file where I have regexlookup.csv and the name of the field you want to match on where I have subject.
Edit: I forgot to mention that you'll also need to make sure to update the regex field in the match statement to match the field name of your regex in the lookup file too.
... View more
12-12-2018
07:03 AM
Can you provide a bit more information such as an example of the data in the csv and how you are attempting to use it in a dashboard/query?
... View more
12-12-2018
06:07 AM
1 Karma
Without having an equivalent lookup to play with, I found a couple syntax issues with the first part of search you wrote. Can you give this a try to see if this produces the same table as your first screen shot?
| inputlookup hierarchy_lookup.csv
| where
[| rest /services/authentication/current-context
| where username!="splunk-system-user"
| rename username as EnterpriseID
| table EnterpriseID
| format]
| fields Scope, Module, EnterpriseID
| join Scope, Module type=inner
[| inputlookup hierarchy_lookup.csv
| stats count by Scope,Module]
As for the second part, the request is to have a table automatically display the same scope and model for all users that share the Scope and Module as that user. I believe the below search would accomplish that to produce the table you listed out:
| inputlookup hierarchy_lookup.csv
| where
[| inputlookup hierarchy_lookup.csv
| where
[| rest /services/authentication/current-context
| where username!="splunk-system-user"
| rename username as EnterpriseID
| table EnterpriseID
| format]
| table Scope Module
| format]
| fields Scope, Module, EnterpriseID
| join Scope, Module, EnterpriseID type=inner
[| inputlookup hierarchy_lookup.csv
| stats count by Scope Module EnterpriseID]
... View more
12-11-2018
12:26 PM
I have moved this from a comment to an answer. Please accept the answer when you get a moment. Thank you!
... View more
12-11-2018
10:33 AM
1 Karma
This can be accomplished by having a search in the background process your inputs to generate the query token based on the results of that search. Here's a run anywhere example using the exact same concept you originally posted:
<dashboard>
<init>
<set token="query">| makeresults count=1 | eval x= "Yes" | table x</set>
</init>
<label>demodash</label>
<fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="Input1">
<label>Input1</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
</input>
<input type="dropdown" token="Input2">
<label>Input2</label>
<choice value="C">C</choice>
<choice value="D">D</choice>
</input>
</fieldset>
<search>
<query>| makeresults count=1
| eval search=if("A"=$Input1|s$ AND "C"=$Input2|s$, "| makeresults | eval x=\"No\" | table x", "| makeresults | eval x=\"Yes\" | table x")
| table search</query>
<done>
<condition match="$job.doneProgress$=1">
<set token="query">$result.search$</set>
</condition>
</done>
</search>
<row>
<panel>
<table>
<search>
<query>$query$</query>
</search>
</table>
</panel>
</row>
</dashboard>
I added a second part to the if statement so it would fall back to the query you had in your init section if Input1 does not equal A and Input2 does not equal C. Let me know if you have any questions.
... View more
11-27-2018
12:10 PM
Are you stating you have a iframe of a scheduled searches results on a Splunk dashboard or is this iframe in another non-Splunk page using an embedded url link to the saved report populating the data in the iframe? If it's a dashboard, can you copy/paste the xml from your dashboard into the question?
... View more
- « Previous
- Next »
Contact Me
Karma given to
