About kmattern

kmattern · ‎08-23-2012

What does this mean and how do I get rid of it? Could not find writer for: /admin/BHPortalStats/history/.dummy_history [0] [C:\Program Files\Splunk\etc]

kmattern · ‎08-21-2012

I have three CSV files. One is a list of all customers that have logged into my system in the past 24 hours. The second is the master list of all of my customers. I want to list the difference between the two CSV files or, if you prefer, I want to list the customers that have not logged in in the past 24 hours. CSV file 1: AllCustomers.csv, a static list containing more fields than CSV file 2. CSV file 2: InactiveCustomers.csv, a static list of all customers and reasons why they might be inactive. This file has two columns, cs_username, Reason CSV file 3: SynchedCustomers.csv, a list of customers who have logge4din in the past 24 hours. This file has one column, cs_username. First Search, this returns an accurate list of all active customers into SynchedCustomers.csv : sourcetype="iis" cs_uri_stem=*configs.xml | lookup AllCustomers.csv cs_username | dedup cs_username | fields cs_username | table cs_username | outputlookup SynchedCustomers.csv Using a second search all I want to do is to list the two fields in InactiveCustomers.csv if they are NOT found in SynchedCustomers.csv. This search returns more than the inactive customers: | inputlookup InactiveCustomers.csv | search NOT [search SynchedCustomers.csv | fields cs_username] What am I doing wrong.

kmattern · ‎08-01-2012

I found the answer myself. Using a new utility I wrote I was able to search all the HTML files to find the links I needed to block. This utility has become invaluable in customizing Splunk. In $SPLUNK_HOME$\Splunk\share\splunk\search_mrsparkle\modules\jobs\JobStatus.html I commented out the lines referencing links with "Save" and "Create". Lines numbered 15 and 19. For more info on the utility contact me at [email protected]

kmattern · ‎07-27-2012

I found it in Splunk\share\splunk\search_mrsparkle\templates\view\404_app.html I commented out the following code

kmattern · ‎07-26-2012

I need to have strict access control to the apps we have written. If a user removes enough of the path to an existing app, or enters a bogus app url in the address bar, a web page will display saying that the app does not exist but here are the apps that do. Having a user see and have access to this will be disasterous and will probably result in Splunk getting shut down. How do I prevent the "App not found" page from displaying? I would much prefer a simple 404 web page than giving the user options they are not authorized. Better yet, they should be redirected to the login page. This is a DoD site and needs to be secure.

kmattern · ‎07-26-2012

In $SPLUNK_Honme/share\splunk\search_mrsparkle\modules\search Edit ViewRedirectorLink.html. Change "View results" to a period as shown below. (I actually commented out the original line and inserted the new one.) This effectively hides the link by changing it to the period. The good thing is that you know that it is there. It is hard to see. You could also edit the css to change the forecolor to white. <%page args="module"/>  <a href="#">${module.get("label", _(".")) | h}</a> </fieldset>

kmattern · ‎07-26-2012

I have to severely limit my end users to exactly what they see on the screen. No options other than help or logout (both of which I have) They are also allowed to export and print. Nothing else. A "Create" dropdown appears on interactive forms. I have to have this dissappear. Does anyone know which module generates this artifact and/or how to disable it?

kmattern · ‎05-25-2012

I would think it uses fewer clocks than the eval.

kmattern · ‎05-24-2012

There is one way that does work and it's pretty simple. Place a rename function at the very end of the search and put all your comments in one long string inside double quotes. Here is the end of a 21 line search followed by a comment: | table Servers,Access_Status,Access,TM,TD,TDB,MB | rename comment AS "This is a comment. 1. The search should run 2. none of this comment should show" The search runs but the comment does not show.

kmattern · ‎04-19-2012

In your etc/system/local/props.conf add the following stanza [host::$YOUR_SERVER_NAME$] TZ=$YOUR_TIME_ZONE$ for example I have my server set to GMT. My stanza looks like this [host::Win2k8-Splunk] TZ=GMT

kmattern · ‎04-19-2012

As usual Splunk’s documentation does not do anything to clarify how to use the export module. After a little trial and error I discovered the best way to use it. Here is a snippit of Advanced XML showing how I use it. I put exports on all my interactive forms, charts and table views. For the most part I put the Export Module immediately before the Paginator module. The important things to bear in mind is to place the Export Module layoutPanel in the same layoutPanel that the paginator lives. In your case you would make the layoutPanel the same as your JobProgressIndicator layoutPanel, panel1_row2_col1. Also it is important to insure that the exportType is the same as the entityName, either results or events. I have used results almost exclusively but a couple of my Simple XML conversions to Advanced XML have converted to events instead of results. Just check your code and you should be OK. After placing a few Export Modules you will get the hang of it. <module name="JobStatus"> <module name="Export" layoutPanel="panel_row1_col1"> <param name="exportType">results</param> </module> <module name="Paginator" layoutPanel="panel_row1_col1" group="Data Received"> <param name="count">20</param> <param name="entityName">results</param>

kmattern · ‎04-06-2012

It suddenly hit me! I checked web.conf and found a second instance of insecurelogin set to false. As soon as I removed that it worked. Sometimes things are too simple.

kmattern · ‎04-05-2012

Been there done that. I've tried everything.

kmattern · ‎04-05-2012

It is in etc/system/local And I did stop and restart Splunk.

kmattern · ‎04-05-2012

I followed the instructions found in http://docs.splunk.com/Documentation/Splunk/latest/Developer/3rdParty to set up insecurelogin so that I can embed views in our web portal. I placed the following in web.conf: [settings] enable_insecure_login = true My sample web page looks like this <html> <head> <meta HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252"> <title ID=titletext>Splunk Test</title> </head> <body> <h1>Splunk View Test</h1> <iframe src="http://192.168.50.135:8000/en-US/account/insecurelogin?username=admin&password=changeme&return_to=/app/FMS/FMS_Test_Stats"> Your browser does not support IFrames </iframe> </body> </html> I see the headline when I call the page but in Firefox I get this: File not found Firefox can't find the file at http://192.168.50.135:8000/en-US/account/insecurelogin?username=admin&password=changeme&return_to=/app/FMS/FMS. Internet Explorer throws a message box with this: Internet Explorer cannot download insecurelogin from 192.168.50.135 Internet Explorer was not able to open the Internet site. The requested site is either unavailable or cannot be found. Please try again later. If I log directly into Splunk I can see the view. It is in advanced XML

kmattern · ‎02-21-2012

There is another way that I use. do the following with the ViewRedirectorLink.html file. Comment out the line with "View results" and replace it with <a href="#">${module.get("label", _("> ."))}</a> The file should then look like this: <%page args="module"/>  <a href="#">${module.get("label", _(" ."))}</a> </fieldset> The result is a barely noticible dot, or period, that is still clickable if you know it is there. That allows me and my admins to access the search itself while the end user isn't aware that it exists.

kmattern · ‎01-31-2012

And here is the final piece of the puzzle. Add this to the end of the hidden search | outputlookup TransferredPubs.csv Then change your viewtarget to a new view <param name="viewTarget">TMDownloads</param> Then create a view called TMDownloads that looks like this <?xml version='1.0' encoding='utf-8'?> <dashboard> <label>TM Downloads</label> <row> <table> <searchName>TMDownloads</searchName> <title>Downloads</title> <option name="count">20</option> <option name="showPager">true</option> </table> </row> </dashboard> And lastly create a saved search called TMDownloads that contains this | inputlookup TransferredPubs.csv

kmattern · ‎01-31-2012

I discovered that I needed a hidden search in order to make this work, that and using stringreplace. Here is the relevant Advanced XML. sourcetype="iis" earliest=-0d@d latest=+6h jkcs1 /tm/ .pdf | makemv delim="/" cs_uri_stem | eval Publication=mvindex(cs_uri_stem,3) | stats count(Publication) by Publication | fields Publication results Technical Manuals (%(count)s) totalCount desc Publication Publication Accounts count(Publication)  <module name="Paginator" > <param name="count">10</param> <param name="entityName">settings</param> <param name="maxPages">10</param> <module name="SearchLinkLister"> <param name="settingToCreate">list1</param> <param name="search">sourcetype="iis" earliest=-0d@d latest=+6h jkcs1 /tm/ .pdf | makemv delim="/" cs_uri_stem | eval Publication=mvindex(cs_uri_stem,3) | stats count(Publication) by Publication | fields Publication</param> <param name="searchFieldsToDisplay"> <list> <param name="label">Publication</param> <param name="value">Publication</param> </list>  </param>   <module name="HiddenSearch"> <param name="search"> sourcetype=iis earliest=-d@d sc_status=200 cs_uri_stem=*$pub$ | lookup NATEC_Mid-Tiers.csv cs_username OUTPUT Unit as Account | rename cs_uri_stem as Publication | stats list(Publication) by Account | fields Account </param> <module name="ConvertToIntention"> <param name="settingToConvert">list1</param> <param name="intention">  <param name="name">stringreplace</param> <param name="arg"> <param name="pub"> <param name="value">$target$</param> </param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module>

kmattern · ‎01-19-2012

Please note that I am confined to using version 4.0.11. I’m aware that much of what I want to do can be accomplished with later versions but I am not permitted to upgrade. I’m working with the SearchLinkLister in hopes that I can generate lists of publications that the user can click on in order to see which accounts have downloaded the selected publication. I’ve taken the basis of my XML from the Search Summary dashboard and have been successful in generating a clickable list. The search that is generated is correct in every manner except that it wraps most of the search in double quotes which, of course, makes the search invalid. My question is how can I either remove the double quotes before the search is dispatched, or prevent them altogether? The parameter being passed to the search is, 01-75gah-4-6.pdf Here is the important portion of the advanced XML I am using: <module name="Paginator" > <param name="count">10</param> <param name="entityName">settings</param> <param name="maxPages">10</param> <module name="SearchLinkLister"> <param name="settingToCreate">list1</param> <param name="search">sourcetype="iis" earliest=-0d@d latest=+6h jkcs1 /tm/ .pdf | makemv delim="/" cs_uri_stem | eval Publication=mvindex(cs_uri_stem,3) | stats count(Publication) by Publication | fields Publication</param> <param name="searchFieldsToDisplay"> <list> <param name="label">Publication</param> <param name="value">Publication</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">list1</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="sourcetype">iis earliest=-d@d sc_status=200 cs_uri_stem=*$target$ | lookup PubsAccounts.csv cs_username OUTPUT Unit as Account | rename cs_uri_stem as Publication | stats list(Publication) by Account | fields Account </param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> This is the resulting search, note the double quotes after sourcetype and at the very end: sourcetype="iis earliest=-d@d sc_status=200 cs_uri_stem=*01-75gah-4-6.pdf | lookup PubsAccounts.csv cs_username OUTPUT name as Account | rename cs_uri_stem as Publication | stats list(Publication) by Account | fields Account" As an aside, I would like to ultimately direct this search to something that does not have a search bar.

kmattern · ‎12-30-2011

I'm totally lost when it comes to arguments in macros. Here is what I want to do. I have three partial searches that are almost identical. sourcetype="iis" cs_username!="-" /TM/ .pdf sourcetype="iis" cs_username!="-" /TD/ .pdf sourcetype="iis" cs_username!="-" /TDB/ .pdf I would like to turn this into a macro where I can pass the argument for the values between the slashes. For the life of me I can't figure out what my macro should look like or how to call it. The documentation on macros really stinks.

kmattern · ‎12-01-2011

Ayn, I followed up on your suggestion and have a search that works perfectly, it returns only branches that have not accessed the system. It looks like this: | inputlookup rfrnInactive.csv | search NOT [search sourcetype="iis" /branch*/phar*/*pdf | dedup cs_username | fields cs_username] | fields Branch, Reason I added a new column to the lookup called Reason. This simply tells the user why some of the rfrn branches are off line. I needed a similar search for a different group and use a different lookup. The lookup follows the same structure and uses the same field names as the first. The second search looks like this: | inputlookup urasInactive.csv | search NOT [search sourcetype="iis" configs.xml | dedup cs_username |fields cs_username] | fields Branch, Reason The second returns branches that have accessed the system as well as those that did not. If both searches are basically the same, I cannot understand why the first one works while the second one does not. Can you explain how the NOT function works? Thanks

kmattern · ‎11-16-2011

Can you give an example? I have three logs that have a common field for a help desk. I want to present data from all three logs when the user enters the ticket number on a form. I want the data to show in three different tables.

kmattern · ‎11-09-2011

Yep! Been there and done that. I always remember to stop and restart Splunk.

kmattern · ‎11-09-2011

It sounds to me like you want to break out the path into multiple fields. The handy way to do that is to use multivalue field extraction. Assuming that this field, "/service/12/CLIENTA/logo.gif" is named Path, try something like this | makemv delim="/" Path | eval cli=mvindex(Path,2) | stats count(cli) as Client_Count Remember that the index starts with 0 and not 1. You can also say something like | eval WebPage=mvindex(Path,3) This will extract just the page from the longer string so you can count the web pages. You can even say something like | stats count(cli) as ClientCount by WebPage to get the count of each web page by client. I use this method all the time to show the top web pages hit on my portal. Ken

kmattern · ‎11-09-2011

Splunk Version 4.0.11 I’m working on getting Splunk to consume “log” files that I have dumped from a SQL Server helpdesk database. There are a lot of date and time fields in the events as well as dates and times that are included in the free-form text fields. I have managed to extract fields for my journal logs. My assignment log looks like this 2011-10-03^09:15:37^ ^ ^00021361^Brandon^ ^ ^ 2011-10-03^08:10:35^2011-10-03^14:51:43^00021584^Bonnie^Completed^15^ 2011-10-03^08:25:28^2011-10-04^07:17:13^00021585^Bonnie^Completed^20^ 2011-10-03^08:40:19^2011-10-05^13:40:38^00021587^Bonnie^Completed^30^ 2011-10-03^08:59:21^2011-10-04^07:15:03^00021588^Bonnie^Completed^20^ 2011-10-03^09:14:46^2011-10-03^14:05:20^00021589^Patrick^Completed^15^ 2011-10-03^09:24:33^2011-10-04^07:02:54^00021591^Stephanie^Completed^10^ 2011-10-03^10:21:26^2011-10-03^14:25:04^00021592^Jeff^Completed^15^ 2011-10-03^10:42:09^2011-10-03^10:42:25^00021593^Robert^Completed^10^ transforms.conf looks like this [AsgLog] DELIMS="^" FIELDS="DateAssign",TimeAssign","DateResolv","TimeResolv","CallID","Assignee","Resolution","TotalAsgnmntTime" Splunk consumes the data and I can search it but the fields defined in transforms.conf are not available. I’ve tried extracting the fields but with two date fields and two time fields Splunk doesn’t seem able to discriminate between them. What am I doing wrong?

Posts	206
Solutions	11
Karma Given	31
Karma Received	83
Member Since	‎04-14-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

case_sensitive_match = false does not appear to wo...

How to edit my search to populate select fields in...

Does infobutton work with advanced XML?

How do you get Matplotlib to work with Splunk SDK ...

Access Splunk through ColdFusion

Python SDK real time search results in web page

Why is the python SDK throwing Bad Gateway errors ...

How to drill down from a clicked parameter in a Dj...

Why Django drop-down selected value is not passed ...

Login Failure with SDK for PHP and TLS

Could not find writer

List difference between two csv files

Re: Disable the Create dropdown/button

Re: Disable "App not found"

Disable "App not found"

Re: can i disable viewresults link on the dashboar...

Disable the Create dropdown/button

Re: Add a comment to a search?

Re: Add a comment to a search?

Re: Timezone issue with Splunk on Windows

Re: Export Link

Re: insecurelogin fails

Re: insecurelogin fails

Re: insecurelogin fails

insecurelogin fails

Re: How do I make a view that includes the "View R...

Re: Argument passing with SearchLinkLister

Re: Argument passing with SearchLinkLister

Argument passing with SearchLinkLister

Macro Arguments

Re: LookUp Table: Show event if lookup table value...

Re: multiple searches in form view

Re: Defining fields in transforms.conf

Re: Field Extraction

Defining fields in transforms.conf

Join the Conversation