I am trying to set up the Splunk DB Connect app to connect to my Avamar database using the PostgreSQL database option. When I try to save the connection it tells me that the password is bad for the user I'm using. I know the user can connect because if I connect to the database using this same user on the Avamar utility node it works fine. Anyone else have this issue? Thanks. ... View more

I'm trying to load one of my logs from my phone server into Splunk. Splunk will read the log file and break the events correctly. My problem is with the date that Splunk places on the event. The event in my log has a time but no date however the date is in the filename. When I look at the loaded events in Splunk the time is extracted properly however the date is the next day (which is because of the modified date on the file). I've copied the existing datetime.xml into /etc/system/local and added an extraction for my date from my filename. How can I pull the date from the filename into Splunk as the date on my event? File name: d:...\VMail-110212-000000.Log Raw event looks like from (d:...\VMail-110212-000000.Log but shows date as 2/13/11 because of file modified date): 23:59:57.334 ( 4172: 5540) [MS] Entering Process MWI loop 23:59:57.334 ( 4172: 5540) [MS] Process MWI loop return, no more entries left Datetime.xml: <datetime> <define name="_masheddate3" extract="year, month, day"> <text><![CDATA[source::.*?\\Vmail-\d{2}\d{2}\d{2}.*\.Log]]></text> </define> ... <datepatterns> ... <use name="_masheddate3"/> </datepatterns> </datetime> Props.conf [ShoreTel_VMail] SHOULD_LINEMERGE = FALSE DATETIME_CONFIG = \etc\system\local\datetime.xml TRANSFORMS-shoretel-comment = shoretel_comment Inputs.conf [monitor://D:\Sample Logs\Shoretel_Current] disabled=false host=Shoretel sourcetype=ShoreTel_VMail crcSalt=<SOURCE> index=shoretel ... View more

How can I get the TimeRangePicker to always default to the value specified in my dashboard? I've read two different posts on this website and they both recommend using "isSticky=false" in the tag on the dashboard. I have tried this and it will not work. I've got the default set to "Last 4 hours" but it always shows "Last 24 hours" since that's what I used for a previous dashboard search (different dashboard). Here's the code I have: <view template="dashboard.html" stylesheet="three_panel_custom_width.css" isSticky="false"> <label>Cisco IPS Overview</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="SearchBar" layoutPanel="mainSearchControls"> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <module name="TimeRangePicker"> <param name="searchWhenChanged">true</param> <param name="default">Last 4 Hours</param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </view> Thanks. ... View more

I have a view that is displaying cumulative port information. One of the charts on the view is a pie chart with the port breakdown. I have set up the code to convert the port the user clicks on to an intention to be passed to a second view. Code snippet from first view: <module name="TimeRangePicker" layoutPanel="splSearchControls-inline"> <param name="default">Last 7 days</param> <param name="searchWhenChanged">true</param> <module name="ServerSideInclude" layoutPanel="panel_row2_col1" group="BotNet Port Breakdown"> <param name="src">botnetsummaryports.html</param> <module name="ConvertToIntention"> <param name="settingToConvert">port_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="group">$target$</param> </param> </param> <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row2_col1"> <param name="search">eventtype="BotNet_Traffic" | eval proto_port=protocol." ".dest_port | fields dest_port, protocol, proto_port, dest_ip, botnet_list_type | chart count by dest_port </param> <module name="HiddenChartFormatter"> <param name="chart">pie</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="popup">True</param> <param name="viewTarget">botnet_dashboard_individual_port_breakdown</param> </module> </module> </module> </module> </module> </module> </module> </module> I have the second view set to use a plot intention to create searches that will populate various pie charts and graphs based on the port selected. One graph is a bar graph that will display the destination IPs associated with the port selected on the first view and the count by dest_ip. I have set up the plot intention as followed in the code snippet below. Problem is that I want to do "stats count by dest_ip" not "stats count(dest_ip)". How can I configure the plot intention so that it does a splitby (or group by)? <module name="TimeRangePicker" layoutPanel="splSearchControls-inline"> <param name="default">Last 7 days</param> <param name="searchWhenChanged">true</param> <module name="StaticContentSample" layoutPanel="panel_row1_col1"> <param name="text">&lt;h1&gt;Botnet Traffic Summary&lt;/h1&gt; &lt;p&gt; You may click on any value to drill down into the detail of the results. If you press Ctrl-Click the detailed search will open in a new window. &lt;/p&gt; </param> </module> <module name="HiddenIntention" layoutPanel="panel_row2_col1" group="Top 10 Malware Sites for Port"> <param name="intention"> <param name="name">plot</param> <param name="arg"> <param name="mode">stats</param> <param name="fields"> <list> <list>count</list> <list>dest_ip</list> </list> </param> </param> </param> <module name="JobProgressIndicator"></module> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="legend.placement">none</param> <param name="primaryAxisTitle.text">Malware Site</param> <param name="secondaryAxisTitle.text">Number of Connections</param> <param name="charting.seriesColors">[0xFF6600]</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">300px</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> ... View more

I've got a dashboard with a pie chart that breaks down port information. When the user clicks on a specific port I want to redirect the user to a new view that will break down the port information (site accessed, etc...). I'm having some problems getting the second dashboard to display properly. If I redirect to flashtimeline I see that the query sent to Splunk is the query from my original dashboard + the port the user clicked on. So I'm getting the correct subset of data. I have even traced the query getting set to my second dashboard via Firebug and the query looks the same as the one sent to flashtimeline. How can I use the data from the query getting sent to my second dashboard and create my charts? The first snippet of code in this is from my first dashboard and the second is from my second dashboard. Thanks for any guidance. <module name="ServerSideInclude" layoutPanel="panel_row2_col3" group="BotNet Port Breakdown"> <param name="src">botnetsummaryports.html</param> <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row2_col3"> <param name="search">eventtype="BotNet_Traffic" | eval proto_port=protocol." ".dest_port | fields dest_port, protocol, proto_port | stats count by dest_port </param> <module name="HiddenChartFormatter"> <param name="chart">pie</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">HLC_botnet_dashboard_individual_port_breakdown</param> </module> </module> </module> </module> </module> </module> <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row2_col1" group="Top 10 Malware Sites for Port"> <param name="search"> | top limit=10 dest_ip | fields dest_ip, count | sort -count</param> <module name="JobProgressIndicator"></module> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="legend.placement">none</param> <param name="primaryAxisTitle.text">Malware Site</param> <param name="secondaryAxisTitle.text">Number of Connections</param> <param name="charting.seriesColors">[0xFF6600]</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">300px</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> ... View more

I would like to create a dashboard (using advanced xml) that has more than two panels (singlevalue charts and pie charts) per row. I have added this to my application.css file on my app: .panel_row2_col .layoutCell { width: 33% !important; } This works but that will mean that every dashboard in the app will use this layout and I don't want that. Is there a way to specify the panel layout at the dashboard level? I've played with the "width" parameter inside "Flashchart" but that changes the size of the pie chart or singlevalue not the panel itself. Thanks. ... View more

I've got a dashboard I'm building that has a column flashchart displaying port counts for a time range. I need to have the ability to click on a time range and then populate a new chart on the same dashboard with the breakdown of port information for the time range clicked. Can I use HiddenPostProcess to achieve this behavior or is there a better way? Thanks. ... View more

I have a summary index that contains the following information for my Windows event logs: host, sourcetype, and count. I want to group the records so that when they are displayed they show like this: datetime hostname sourcetype count -------- -------- ------------------------- ----- 10/27/10 9:00 am hostname WinEventLog:Application 9 WinEventLog:Security 17034 WinEventLog:System 3 My search looks like: index="winos_event_summary" | transaction orig_host maxpause=59m | table _time,orig_host,orig_sourcetype,count This shows the following table 10/27/10 9:00 am hostname WinEventLog:Application 17034 WinEventLog:Security 3 WinEventLog:System 9 The count field isn't being put with the proper host/sourcetype combination. When I take out the transaction statement I get: 10/27/10 9:00 am hostname WinEventLog:Application 9 10/27/10 9:00 am hostname WinEventLog:Security 17034 10/27/10 9:00 am hostname WinEventLog:System 3 Why does the transaction statement move the count and associate it with the wrong host/sourcetype? The count field is part of the summary record. Thanks. ... View more