Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- About smanojkumar
smanojkumar
Contributor
Member since:
07-16-2021
Friday
Community Statistics
| Posts | 171 |
| Solutions | 0 |
| Karma Given | 46 |
| Karma Received | 0 |
| Member Since | 07-16-2021 |
Activity Feed
- Posted Re: Back fill of data in timerange on Splunk Search. a week ago
- Posted Re: Back fill of data in timerange on Splunk Search. a week ago
- Posted Back fill of data in timerange on Splunk Search. a week ago
- Posted Re: Display Dashboard in Stacked row on Splunk Search. a month ago
- Posted Display Dashboard in Stacked row on Splunk Search. a month ago
- Posted Re: How to use substr or regex to extract part of text on Splunk Search. 02-07-2025 03:34 AM
- Karma Re: Adding zoom in option to timeline chart for ITWhisperer. 02-07-2025 02:11 AM
- Posted Re: Passing a mutiple values of label in input dropdown on Splunk Search. 12-08-2024 11:05 PM
- Posted Re: Passing a mutiple values of label in input dropdown on Splunk Search. 12-05-2024 08:43 PM
- Posted Passing a mutiple values of label in input dropdown on Splunk Search. 12-04-2024 08:11 PM
- Posted Issues in multiselect input dropdown on Splunk Search. 12-04-2024 02:03 AM
- Karma Re: Adding zoom in option to timeline chart for bowesmana. 11-14-2024 08:55 PM
- Posted Re: Adding zoom in option to timeline chart on Splunk Search. 11-14-2024 01:17 AM
- Posted Adding zoom in option to timeline chart on Splunk Search. 11-13-2024 04:11 AM
- Posted Dowloading results of table to .csv file on Splunk Search. 11-12-2024 04:01 AM
- Karma Re: unset the inputput dropdown to default for ITWhisperer. 11-11-2024 07:11 PM
- Posted unset the inputput dropdown to default on Splunk Search. 11-11-2024 03:18 AM
- Karma Re: Finding the length of multivalue/singlevalue field for zksvc. 11-11-2024 03:14 AM
- Posted Re: Finding the length of multivalue/singlevalue field on Splunk Search. 11-04-2024 10:23 PM
- Posted Re: Finding the length of multivalue/singlevalue field on Splunk Search. 11-04-2024 07:25 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-02-2023
02:52 AM
Hi @ITWhisperer , <form stylesheet="dashboard.css,infobutton.css" script="multiselect_functions.js,infobutton.js" version="1.1" theme="dark"> Yes, its CSS. Thanks! Manoj Kumar S
... View more
11-01-2023
10:24 PM
Hi @ITWhisperer ,
Thanks for your response!
Version : 9.0.5
App - Endpoint Cockpit
The dashboard is from
<row>
<panel id="global">
<title>Global Compliance</title>
<html>
<style>
.dashboard-body {
background: #0000FF !important;
}
.dashboard-header h2{
color: #0000FF !important;
}
</style>
<div class="infobutton" parent="global_status_op" type="collapse" style="display: none">
<p style="font-size:15pt;">
The compliance is calculated as follow:</p>
<p style="font-size:9pt;">
- If ENS version AND Agent version complinat</p>
<p style="font-size:9pt;">
- If one among ENS, compliant</p>
</div>
</html>
</panel>
</row>
Thanks!
... View more
11-01-2023
05:15 AM
Hi Splunkers!
How to change the color of info button in dashboard.
<panel id="global_status_op">
<title>Global Compliance</title>
<html>
<style>
</style>
<div class="infobutton" parent="global_status_op" type="collapse" style="display: none">
<p style="font-size:15pt;">
The compliance is calculated as follow:</p>
<p style="font-size:9pt;">
- If compliant, the asset is considered as complinat</p>
<p style="font-size:9pt;">
- If not compliant, the asset is considered as not compliant</p>
</div>
</html>
</panel>
Thanks!
... View more
Labels
- Labels:
-
CSS
10-31-2023
05:04 AM
Hi Splunkers! I would like to know how to define a .evtx file, I had defined in this way, but it didn't works [monitor://C:\Windows\System32\Winevt\Logs\Data Security.evtx] Thanks!
... View more
Labels
- Labels:
-
inputs.conf
10-26-2023
11:22 PM
Hi @danspav , Thanks for your response! It works, Thanks for your brief and clear explanation. It means a lots. Thanks! Manoj Kumar S
... View more
10-26-2023
03:42 AM
Hi @danspav/ @bowesmana , Thanks for your response, I has tried this way, still getting different values in URL Here is my URL after selection of pie chart, &%26form.office_filter%3DFront%20Office=& I'm getting %26, %3D instead for = , %20 instead of space i had tried this way in actual info,
<input type="multiselect" token="office_filter" searchWhenChanged="true">
<label>Front/Back office</label>
<choice value="Front Office">Front Office</choice>
<choice value="Back Office">Back Office</choice>
<default>Front Office</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>Front Office</initialValue>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>
<change>
<eval token="office_filter_drilldown">replace($form.office_filter$ + "","([^,]+),?","&form.office_filter=$1")</eval>
</change>
</input>
<drilldown>
<link target="_blank">/app/antivirus_details?form.compliance_filter=$click.value$&$office_filter_drilldown$&form.machine=$machine$&form.origin=$origin$&form.country=$country$&form.cacp=$cacp$&form.scope=$scope$</link>
</drilldown>
Can you please ensure this! Thanks! Manoj Kumar S
... View more
- Tags:
- @
10-19-2023
05:38 AM
Hi @ITWhisperer I'm just passing the token in link $office_filter$ <link target="_blank">/app/SAsh/details?form.compliance_filter=$click.value$&form.timerange=$timerange$&form.antivirus_filter=*&$office_filter$&form.machine=$machine$&form.origin=$origin$&form.scope=$scope$</link>
... View more
10-19-2023
04:44 AM
Hi there! In inputs.conf whitelist, how do I create a regex expression for whitelisting files which contain a certain number (101-109, 201, 205, 301-303)?
... View more
Labels
- Labels:
-
regex
10-19-2023
04:36 AM
Hi @ITWhisperer , It is fine but the prefix "form.office_filter=" is affecting the token that is used in search and the link is not expected. Here is the link &form.office_filter%3DBack%20Office%26form.office_filter%3DFront%20Office=& If I'm using this instead, it works &form.office_filter=Back%20Office&form.office_filter=Front%20Office=& = is replaced by %3D in first link, & is replaced by %26 Can you please help me in this! Thanks!
... View more
10-18-2023
06:46 AM
Hi There! I'm having the case, If present day is "Monday" and if user selects the option "Exclude weekend", the time range picker should looks for the data on friday If user selects the option "Include weekend", the time range picker should be yesterday
<input type="radio" token="weekends" searchWhenChanged="true">
<label>Weekends</label>
<choice value="exclude">Exclude Weekends</choice>
<choice value="include">Include Weekends</choice>
<default>exclude</default>
<initialValue>exclude</initialValue>
</input>
thanks!
... View more
10-18-2023
06:22 AM
Hi @ITWhisperer I tried few way, I didn't got it.
<condition match="isnull($office_filter$) == "Front_Office*"">
<set token="office_filter_drilldown">form.office_filter=Front%20Office</set>
</condition>
<condition match="isnull($office_filter$) == "Back_Office*"">
<eval token="office_filter_drilldown">form.office_filter=Back%20Office</eval>
</condition>
<condition match="isnull($office_filter$) == "Front_Office*" AND == "Back_Office*"">
<eval token="office_filter_drilldown">form.office_filter=Front%20Office&form.office_filter=Back%20Office</eval>
</condition>
can you please share that as well. Thanks in Advance!
... View more
10-17-2023
06:30 AM
Hi @somesoni2 , Thanks for your response! It works, Also is that possible to change the time range picker value as a token based on some conditions If present day is "Monday" and if user selects the option "Exclude weekend", the time range picker should looks for the data on friday If user selects the option "Include weekend", the time range picker should be yesterday Thanks in Advance!
... View more
- Tags:
- i
10-17-2023
04:58 AM
Hi @yuanliu I just renamed some fields, here is the exact one, I had modified few things based your reply.
<input type="checkbox" token="index_scope" searchWhenChanged="true">
<label>Choose console</label>
<choice value="1T*">Standard</choice>
<choice value="2A*">Scada</choice>
<choice value="2S*">AWS</choice>
<default>1T*</default>
<initialValue>1T*</initialValue>
</input>|
Here is the search
`compliance($index_scope$, now(), $timerange$, $scope$, $origin$, $country$, $cacp$)`
It's not working as expected in multiselect, earlier for dropdown its working good. Thanks!
... View more
10-17-2023
04:16 AM
Hi @ITWhisperer ! Thanks for your response! It is working fine, it always selected two values in dashboard 2 even if we are selecting one value in dashboard 1, For Eg. If we are selecting "Front Office" in Dashboard 1, It shows both values "Front Office" and "Back Office" in Dashboard 2. Thanks!
... View more
10-17-2023
01:11 AM
Hi There! I need to pass a token form one dashboard to another dashboard when clicking its pie chart Input in dashboard 1
</input>
<input type="multiselect" token="choose_office" searchWhenChanged="true">
<label>Front/Back office</label>
<choice value="Front Office">Front Office</choice>
<choice value="Back Office">Back Office</choice>
<initialValue>Front Office,Back Office</initialValue>
<default>Front Office,Back Office</default>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>, </delimiter>
</input>
one of the searches in dashboard 1
`compliance_op`
| search office IN ($choose_office$)
| chart count by $scope$global
| sort $scope$global
My link to next dashboard is
<drilldown>
<link target="_blank">/app/SAsh/operational_beautiful?form.choose_office=$choose_office$&form.machine=$machine$&form.origin=$origin$&form.country=$country$&form.cacp=$cacp$&form.scope=$scope$</link>
</drilldown>
Multiselect in dashboard 2
<input type="multiselect" token="office_filter" searchWhenChanged="true">
<label>Front/Back Office</label>
<choice value="Front Office">Front Office</choice>
<choice value="Back Office">Back Office</choice>
<choice value="Unknown">Unknown</choice>
<prefix>office IN (</prefix>
<suffix>)</suffix>
<initialValue>Front Office,Back Office,Unknown</initialValue>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>, </delimiter>
<change>
<eval token="office_filter_drilldown">mvjoin('form.office_filter',"&form.office_filter=")</eval>
</change>
</input>
search in dashboard 2
`compliance_ap`
| search office IN ($choose_office$)
| chart count by $scope$global
| sort $scope$global
I'm facing error in search of dashboard 2. Thanks!
... View more
10-17-2023
12:39 AM
Hi There! I would like to pass multiselect values to macros, earlier it was dropdown. The values in multiselect itself an macros which we need pass as a token to search, <input type="checkbox" token="index_scope" searchWhenChanged="true"> <label>Choose console</label> <choice value="1T*">Standard</choice> <choice value="2A*">Scada</choice> <choice value="2S*">AWS</choice> <default>1T*</default> <initialValue>1T*</initialValue> </input>| Here is the search `compliance($index_scope$, now(), $timerange$, $scope$, $origin$, $country$, $cacp$)` It's not working as expected in multiselect, earlier for dropdown its working good. Thanks in Advance! Manoj Kumar S
... View more
10-16-2023
08:06 AM
Hi There! I would like to include/exclude weekend in the search, So i had created the dropdown for that, I'm getting error in the searches, My Time format is 2023-10-15T13:11:20.000+05:30 My dropdown is <input type="radio" token="weekends" searchWhenChanged="true"> <label>Weekends</label> <choice value="NOT (day_of_week="saturday" OR day_of_week="sunday")">Exclude Weekends</choice> <choice value="day_of_week="*"">Include Weekends</choice> <default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default> <initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday")</initialValue> </input> My search is `compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)` | eval day_of_week = lower(strftime(_time,"%A")) | where NOT (day_of_week="saturday" OR day_of_week="sunday") | chart count by virus_global | sort virus_global Thanks!
... View more
10-15-2023
11:13 PM
Hi @yuanliu , Sorry for the mistake! `macros1(`$macros2$`, now(), -15d@d, *, virus, *, *, *)` The values to be passed in macros2 is multiselect, I get error if i passed two values at a time, because each values passed is an individual macros which has different search in it. I need OR condition to be performed on that case. Thanks in Advance! Manoj Kumar S
... View more
10-13-2023
04:40 AM
Hi There! I'm having the dropdown "office" in dashboard 1 as a multiselect (full office, half office), based on the selection it should display the results in dashboard 1, In the dashboard 1, I have a pie chart, If i click the pie chart It need to take to dashboard 2 which consists of same dropdown "office" as multiselect (full office, half office, non-compliant office), If in case I'm clicking pie chart of dashboard 1 when office value is full office, half office, if should shows the same in dashboard 2 and in dashboard 2 has some panels, its should the using the value. I had configured the link already, the problem is if we are adding prefix value as " and postfix " and delimiter , it will pass the same to next dashboard 2 dropdown, so that I didn't get the result of panels in dashboard 2. I need solution for this? Thanks, Manoj Kumar S
... View more
10-13-2023
12:50 AM
Hi Splunkers, I'm having the multiselect value that results need pass to a macros, Can you please help for that? The need is to pass the multiselect values to token $macros2$, where multiselect values is an macros itself, multi select values 1. value 1 2. value 2 3. value 3 4. All search: `macros1(`$macros2$`, now(), -15d@d, *, virus, *, *, *)` Thanks in Advance! Manoj Kumar S
... View more
10-10-2023
06:20 AM
Hi Splunkers! How to assign the pie chart in same vertical if we are having dropdown in one specific pie chart. Having dropdown in one pie chart because of that other pie chart in same row got misaligned, need to have same height of pie charts in the row Thanks in Advance!
... View more
10-09-2023
04:39 AM
Hi Splunkers, I'm having a drodown for index_value with console, standard and aws as options, also having separate pie charts for standard, console and aws, when we click the pie chart in any one of these 3, it will take to another dashboard, over there i need to mark the value of index_valrue of drilldown as standard if we select the standard pie chart in the drilldown of new dashboard that is same for all other two selections. Thanks in Advance, Manoj Kumar S
... View more
10-06-2023
04:39 AM
Hi Splunkers! I would like to extract detection_method value, "Access Protection" file_name="HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\", detection_method="Access Protection", vendor_action="IDS_ACTION_WOULD_BLOCK", Thanks, Manoj Kumar S
... View more
Labels
- Labels:
-
field extraction
10-06-2023
03:23 AM
Hi, I have total four fields lets say a,b,c and d. i want to show 'a' as a separate column and 'b','c' and 'd' as stacked and beside 'a' along with the sum of fields ('b'+'c'+'d') so that the count of these fields would come on the top of their column so that we can easily compare field 'a' with the count of rest. Note:- I don't want separate column which would give sum of these three field. Click visualization select column chart Click format and enable the stack mode. select show data values as on Click chart overlay and Click the text box and select Total field. makeView as Axis as off Click Apply. After the above steps that i had mentioned, I can see the total on the top along with the line, I don't need line, Can you please help me in this. Thanks in Advance! Manoj Kumar S
... View more
Labels
- Labels:
-
chart
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
