About Leo

Leo · ‎01-28-2013

thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.

Leo · ‎12-20-2012

It should work the same way. I've added a single value field to the previous example: http://pastebin.com/BmW96WmQ

Leo · ‎12-20-2012

Try this example and see if it helps with your situation.

Leo · ‎12-19-2012

oshi, try using $form.< token>$ instead: form.token1=$form.name$&form.token2=$form.ip$ also, you can use values from the row on which you clicked: form.value1=$row.field1$&form.value2=$row.field2$

Leo · ‎12-10-2012

If you put that regex command in the search query populating your table, then you should be able to get the value of threadno by putting $row.threadno$ into the drilldown link.

Leo · ‎12-06-2012

I'm sorry, 5.0.2 is not released yet, but will be out soon.

Leo · ‎12-05-2012

This is a known issue that was earlier reported here: http://splunk-base.splunk.com/answers/64273/about-dynamic-drilldown-in-50. It will be resolved in 5.0.2 release.

Leo · ‎12-03-2012

Would this doc be helpful? http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms#Dashboard_linking_to_a_multivalue_field

Leo · ‎12-03-2012

You can add $form.< token>$ to your search query to get the value of the dropdown. In your case it would be $form.sources$ For click value there are two options: $click.value$ would return the value of X axis or the first column, $click.value2$ would return the value of Y axis or the value in the column you clicked upon.

Leo · ‎11-05-2012

Also, note that this will only work on Splunk 5.0 If you're on an older version, you should use advanced xml drilldown.

Leo · ‎11-05-2012

try this: ... index=|chart values(source) **as source* by index /app/search/flashtimeline?q=index=$row.index$ source=$row.source$|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP Duration ...

Leo · ‎11-03-2012

This app is not maintained by Splunk. But it uses SCOM Powershell API, which should've been compatible with the 2007 API, however I'm not really sure about this. Did you try to run it with SCOM 2012 and saw any errors?

Leo · ‎11-03-2012

<?xml version='1.0' encoding='utf-8'?> <dashboard> <row> <table> <searchTemplate> ...search returning list of your sources... </searchTemplate> <drilldown> <link>/app/search/flashtimeline?q=source=$row.source$|trnsaction TaskAction startswith=START endswith=Succeeded|table TaskAction Duration</link> </drilldown> </table> </row> </dashboard>

Leo · ‎11-02-2012

seed was the original default parameter used only for text fields until the new 'default' parameter has been introduced and made common for all inputs. The bug has been filed.

Leo · ‎11-02-2012

Unfortunately, there's no encoding capabilities in simple xml drilldown in 5.0, but as a workaround it might be possible to create a custom search command that would encode the username value to UTF-8 and use in the search. Drilldown doesn't support opening target views in a popup at this moment. We will investigate these issue for one of the future releases.

Leo · ‎11-02-2012

The seed parameter is ignored due to a bug in 5.0. However, < default > accepts the same value you've used in < seed > to prepopulate the field, and can be used instead as a workaround.

Leo · ‎04-03-2012

Show me some statistics on trending topics among my friends. Show me when my friends were online over the past week. Pinpoints on Geolocation view should be clickable and show the corresponding post. Same for the Friends view. Grid layout would look better. Home view is not really home. Refresh, maybe? Should it be on the menu bar?

Leo · ‎02-28-2012

The correct endpoint to use is /apps/appinstall. please try: curl -u "user:pass" -k "https://1.2.3.4:8089/services/apps/appinstall" -d name="http://1.2.3.4/test.spl"

Leo · ‎05-10-2011

This is not supported by the php sdk. If you're willing to extend it, you'll want to use this endpoint https://localhost:8089/services/alerts/fired_alerts/ as your source. It lists all the fired alerts and their properties. Make an authenticated http request by example of the existing sdk and parse the resulting xml to get the data.

Leo · ‎03-10-2011

On the same page of your Netgear router there should be another option called "Send to this syslog server IP address" followed by space where you should type the IP address of your machine with Splunk. Then on Splunk go to Data Inputs/UDP and type 514 as the port number. Your syslog data should start flowing in.

Leo · ‎03-09-2011

Perhaps, bwenge wants to run an antivirus when Splunk fires an alert..

Leo · ‎02-26-2011

To avoid Splunk prepending it's url before yours, type $!url$. This defeats escaping and will open your url just fine.

Leo · ‎01-14-2011

Before version 4.2 you can run the second Splunk instance in the user mode (as opposed to the service mode it's running by default). Copy your Splunk installation directory to where your 2nd instance will be. Open two command prompt windows. In the first one run: \splunk start splunkd --nodaemon In the second one: \splunk start splunkweb --nodaemon To stop them, type Ctrl+C in both windows. Such instance will run while your user session is active.

Leo · ‎01-14-2011

It will be possible in 4.2

Leo · ‎11-14-2010

curl -k -u admin:changeme -d "name=%2Ftmp%2Fthelog.log%0A" https://localhost:8089/services/data/inputs/monitor After this request Splunk should index '/tmp/thelog.log'. Note that the argument is url-encoded.

Posts	72
Solutions	15
Karma Given	95
Karma Received	103
Member Since	‎01-13-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How to monitor a directory for file changes?

Get auth token in alert script

How can I access app's static content via Splunk e...

Best way to create a custom config for an app

How can I create a setup page for a custom app?

Safely storing credentials inside Splunk apps

How to open a log file with Splunk from Windows Ex...

Saving alert triggerred scripts inside apps

Powershell scripted input

Re: drilldown not using correct time range

Re: passing a variable/token through link search

Re: passing a variable/token through link search

Re: Basic drilldown to pass multiple values

Re: passing a field_value through drilldown search...

Re: (Simple XML) Drilldown to another form

Re: (Simple XML) Drilldown to another form

Re: drill down with drop down output and clicked c...

Re: drill down with drop down output and clicked c...

Re: drilldown of the values

Re: drilldown of the values

Re: Splunk and SCOM 2012 integration

Re: drilldown

Re: Seed deprecated in SimpleXML on Splunk 5.x?

Re: About dynamic drilldown in 5.0

Re: Seed deprecated in SimpleXML on Splunk 5.x?

Re: Features you want implemented in Splunk for Fa...

Re: App install using REST api and URL

Re: REST API fired alerts php sdk

Re: Data Inputs / TCP or UDP

Re: run antivirus with splunk

Re: Is it possible to launch a browser window from...

Re: Installing multiple instances on Windows

Re: Installing multiple instances on Windows

Re: Help to create a new data input via REST API, ...

Join the Conversation