Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About feickertmd
feickertmd
Communicator
Member since:
11-08-2013
06-05-2020
Community Statistics
| Posts | 75 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 24 |
| Member Since | 11-08-2013 |
Activity Feed
- Got Karma for Re: Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-08-2023 01:56 PM
- Got Karma for How to change color or style of a single line in line graph. 02-28-2023 09:10 AM
- Got Karma for How to delete a lookup table file and definition?. 02-15-2022 07:46 AM
- Got Karma for Re: Is there a guide or map to understand Splunk's internal indexes and their log content?. 02-23-2021 12:39 PM
- Got Karma for Re: Is there a guide or map to understand Splunk's internal indexes and their log content?. 10-02-2020 12:03 AM
- Got Karma for Why are conditional tokens one change behind for time picker changes?. 06-05-2020 12:48 AM
- Got Karma for Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-05-2020 12:47 AM
- Got Karma for Can you use token values in HTML module for dashboards?. 06-05-2020 12:47 AM
- Got Karma for Re: stats list() command will not display items after fieldformat. How can I resolve it?. 06-05-2020 12:47 AM
- Got Karma for How to delete a lookup table file and definition?. 06-05-2020 12:47 AM
- Got Karma for Get Perfmon drive info for specific disks Splunk 6.1. 06-05-2020 12:47 AM
- Got Karma for Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-05-2020 12:47 AM
- Got Karma for Is there a guide or map to understand Splunk's internal indexes and their log content?. 06-05-2020 12:47 AM
- Got Karma for Re: How to hide an HTML label from a dashboard when the token is not set?. 06-05-2020 12:47 AM
- Got Karma for Re: How to hide an HTML label from a dashboard when the token is not set?. 06-05-2020 12:47 AM
- Got Karma for How to hide an HTML label from a dashboard when the token is not set?. 06-05-2020 12:47 AM
- Got Karma for Re: Convert epoch time from drilldown parameter. 06-05-2020 12:47 AM
- Got Karma for How to drilldown from a timechart to another dashboard by clicking on the legend value?. 06-05-2020 12:47 AM
- Got Karma for How to drilldown from a timechart to another dashboard by clicking on the legend value?. 06-05-2020 12:47 AM
- Got Karma for Is the information in the search job inspector stored in Splunk internally so I can query this data and set up dashboards?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 2 |
11-21-2014
07:49 AM
dar104,
I tried what you suggested, and I am not seeing results by drive letter. Can you contact me to discuss? I'd like to know better what to expect.
[email protected]
... View more
11-20-2014
09:22 AM
So while this report is nice, It shows only 31 hosts as belonging to the series field. We have 57 hosts overall. Why would I not see them all in this report?
... View more
11-19-2014
01:20 PM
This is good, but it gives the average per event. I need aggregate average per day.
I combined yours with the elements here: http://answers.splunk.com/answers/79026/average-count-by-day.html
That worked out nicely. Final query looks like this:
index=_internal sourcetype=splunkd group=per_host_thruput earliest=-1mon@mon latest=@mon | bucket _time span=1d | stats sum(kb) as total by series,_time | stats avg(total) as average by series
|eval averageMB=round(average/1024,2)
|fields - average
|rename series as "Host Server",averageMB as "Average size per day in MB"
... View more
11-19-2014
12:08 PM
How can I use Splunk to tell me how much data per day each host is forwarding to Splunk? Basically, I need a report that shows the host name and how much data it passed through the Splunk forwarder in bytes.
... View more
11-18-2014
12:16 PM
I originally did, but this worked even better.
... View more
11-18-2014
11:16 AM
2 Karma
Thanks for pointing me to the example. It appears that things are easier now in 6.1.x. Here's the code from the example:
<!-- depends is the way we tell the content to only show when the token has a value.
Hint: use comma separated values if the element requires more than one token. -->
<chart id="detail" depends="$sourcetype$">
<title>Detail: $sourcetype$</title>
<searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</chart>
</row>
Just need a depends attribute!
... View more
11-18-2014
11:11 AM
1 Karma
I tried that with this:
<input type="time" token="time_token">
<label />
<default>
<earliestTime>$earliest$</earliestTime>
<latestTime >$latest$</latestTime>
</default>
</input>
I had done that, but I realize now that I had to redefine how I was passing tokens. I was getting
http://apsrd3084:8000/en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1393999200&latest=1394600400#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1393999200&latest=1394600400&form.time_token.earliest=%24earliest%24&form.time_token.latest=%24latest%24
I needed to change the sending form to send the tokens in the proper format.
Thanks again!
... View more
11-18-2014
10:57 AM
1 Karma
I have a few dynamic dashboards in which some panels take click values from others to populate. On each one I have put HTML labels with tokens syntax so that the value of the click displays in the next panel. Problem is, the literal token string appears until the value is clicked.
Before click it displays
Filtered by Level: $level$
After a click:
Filtered by Level: Critical
Is there any way to either hide the token syntax or just hide the entire HTML section until after the user clicks an option to populate the token?
... View more
11-18-2014
10:50 AM
Got it working! but now I want to display it in something other than Epoch time. I have a separate question on the matter at https://answers.splunk.com/answers/188890/convert-epoch-time-from-drilldown-parameter.html. Look forward to any help on it!
... View more
11-18-2014
10:48 AM
I have set up a drilldown to jump from a timechart graph to another dashboard.
<link>
<![CDATA[
/app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
The resulting URL for the target dashboard displays like this:
/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000
Note that the earliest and latest params are set to Epoch time. I would like to have a HTML label above the chart that uses tokens to update ("$status$ from $earliest$ to $latest$"). My problem is that it comes up like:
Abandoned searches from 1395205200 to 1395810000
Is there any way I can format those epoch timestamps to be able to display them to the user in a readable format?
... View more
11-18-2014
07:26 AM
Understood, but like I said, the name of the field is "Status", yet the click returns the value, which is "Abandoned". Oh , I think I get it. The "by Status" casts the status values as fields that contain counts as values.
My brain has expanded.
... View more
11-18-2014
07:23 AM
Another thing, if you would be so kind.
In the main dashboard I have this drilldown code:
<link>
<![CDATA[
/app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>
My intent is to also send the timestamp.
The receiving form looks like this:
`
Drilldown Search and Results
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="Abandoned">Abandoned</choice>
<choice value="Clicked">Successful</choice>
</input>
<panel>
<table>
<searchString>sourcetype=sp:2013:search host=apset0725 Status=$status$ |eval lowerQuery=lower(Query) |stats values(ResultsEncoded) as Results by lowerQuery
|rex field=Results max_match=10 "(?<encoded>\d.+?)|"
|fields - Results
|mvexpand encoded
|rex field=encoded "(?<rank>\d+)##\d+..+(?<doc>http.+?)#"
|fields - encoded
|eval rank=rank+1
|sort lowerQuery rank
|dedup lowerQuery doc rank
| stats list(rank) as Rank,list(doc) as Documents by lowerQuery
|rename lowerQuery as "Query String (normalized)"
`
When I click the timechart, my $status$ variable is set just fine, but $earliest$ and $latest do not work properly.
Advice?
... View more
11-18-2014
07:16 AM
That worked great, thanks, but I don't understand how it worked. I had read the document you referred me to before posting this, and it was my understanding that click.name returned the name of the field ("Status"). Yet in this case it has returned the value ("Abandoned").
Can you help me understand the workings in this case? Thanks.
... View more
11-17-2014
01:18 PM
2 Karma
I have a timechart created with this search
sourcetype=sp*search host=apset0725 Status!=A | timechart span=1w count by Status usenull=f
I would like to create a drilldown to another dashboard. I want it so that, when clicked, the token will populate with Status. Currently, if I choose "click.value2", then the token populates with the value of count.
... View more
11-12-2014
01:01 PM
Since what I'm after will be two fields from each part of the string, I plan to run rex to extract and , then use mvzip() and and mvexpand to create new columns of data.
Thanks for the answer!
... View more
11-12-2014
10:10 AM
The string "docURL" is a placeholder for a real URL
... View more
11-12-2014
09:31 AM
Right now there is no separation of the value in that field. It exists in the form I showed you above as a value in a single event.
... View more
11-12-2014
07:25 AM
Here's a puzzler for you all.
I have SharePoint search logs coming in. The results field has a value like this:
4##18.3953018188477##docURL##False##False##True##False##||0##18.5134868621826##docURL##False##False##True##False##||2##18.4921894073486##docURL##False##False##True##False##||... etc.
Note that there exist TWO delimiters: || to separate the results sets and ## to separate the values within the result set.
I know I can use split to separate at || and create a MV field. But is it possible from that point to do this:
Hit each of the new values.
Split them to MV files on ##.
Extract the value for display.
Or, of course, is there a different way to extract those doc URLs? I want to display them in a report of search string and returned results.
Thanks!
... View more
- Tags:
- split
11-10-2014
07:00 AM
Okay, that explains it. We have 6.12
... View more
11-10-2014
06:51 AM
How weird, my glob of code has disappeared! Yes, I have it defined in a previous piece of code.
... View more
11-10-2014
06:32 AM
Is it 6.x compatible? The app page says 5.0
... View more
11-10-2014
06:30 AM
Yes, its is defined in the code I posted
... View more
11-07-2014
01:43 PM
I have some dynamic drilldown charts where the clicked value of the first is sent to the next, and so on. Is it possible to add an html line or a label that will utilize the token value.
Example:
Chart 1 called "Errors by Severity"
click a value in chart 1, and it goes to chart 2 called "Area (filtered by Level)"
The label for chart 2 should read "Area (filtered by Level $Level$)"
`
<title>Errors by Severity</title>
<searchString>sourcetype=*uls* host=apset0725 | stats count by Level</searchString>
<earliestTime>$time_tok.earliest$</earliestTime>
<latestTime>$time_tok.latest$</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<drilldown>
<set token="Level">$row.Level$</set>
</drilldown>
</chart>
</panel>
<panel>
<chart>
<title>Errors by Area $Level$ (filtered by Level)</title>
<html>
Level = $Level$
<searchString>sourcetype=*uls* host=apset0725 Level=$Level$ | stats count by Area</searchString>
<earliestTime>$time_tok.earliest$</earliestTime>
<latestTime>$time_tok.latest$</latestTime>
<option name="charting.legend.placement">right</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.drilldown">all</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart">pie</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<drilldown>
<set token="Area">$row.Area$</set>
</drilldown>
</chart>
</panel>
`
... View more
11-07-2014
01:30 PM
1 Karma
I have heard that the HTML module would render token values. I can find nothing on how to do it. I tried this:
<h1>I KNOW WHO YOU ARE $Area$</h1>
</html>
What I get is this:
I KNOW WHO YOU ARE $Area$
... View more
- Tags:
- html-module
- token
11-07-2014
09:26 AM
Does a schema file exist for simple xml? I'd love to plug it in to my XML tool so I can validate my forms without splunk just crashing mercilessly.
... View more
- Tags:
- schema
- simple-xml
- xsd
- « Previous
- Next »
