Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About subtrakt
subtrakt
Contributor
Member since:
09-02-2012
06-05-2020
Community Statistics
| Posts | 136 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 24 |
| Member Since | 09-02-2012 |
Activity Feed
- Got Karma for eval isnull. 11-02-2020 01:51 AM
- Got Karma for Sideview Utils: Is there a way to add an 'arg.earliest' param to the HTML module for a drilldown timerange token?. 06-05-2020 12:48 AM
- Got Karma for default search * being dispatched unintentionally. 06-05-2020 12:48 AM
- Karma Re: How to create a module that has a "+" symbol to expand and display inputlookup results under a chart panel? for sideview. 06-05-2020 12:47 AM
- Karma Re: How to write a search that automatically compares volume for this year against the same day of the week last year? for musskopf. 06-05-2020 12:47 AM
- Karma Re: Are there plans to get autorefresh and hidden post process nested in a hidden saved search module? for sideview. 06-05-2020 12:47 AM
- Karma Re: Query help with search using sum(count) and 2 subsearches using count for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to convert epoch to local time? for ramdaspr. 06-05-2020 12:47 AM
- Karma Re: Rex Question for woodcock. 06-05-2020 12:47 AM
- Karma Re: If summary searches run every 5 minutes, can a non-summary search be merged with the summary to fill-in the most recent 5 minutes? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Make one column in table module have hyperlinks but leave the rest non-link for sideview. 06-05-2020 12:47 AM
- Karma Re: Sideview Utils: How to redirect, but not dispatch a search? for sideview. 06-05-2020 12:47 AM
- Got Karma for How to write a search that automatically compares volume for this year against the same day of the week last year?. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: How to redirect, but not dispatch a search?. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: How to redirect, but not dispatch a search?. 06-05-2020 12:47 AM
- Got Karma for Re: When redirecting from a drilldown, why is testfield in redirect not correct on tables with multiple rows?. 06-05-2020 12:47 AM
- Got Karma for Query help with search using sum(count) and 2 subsearches using count. 06-05-2020 12:47 AM
- Got Karma for Are there plans to get autorefresh and hidden post process nested in a hidden saved search module?. 06-05-2020 12:47 AM
- Got Karma for How to write a search that automatically compares volume for this year against the same day of the week last year?. 06-05-2020 12:47 AM
- Got Karma for autorefreshmodule and hiddensavedsearches. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
10-25-2016
10:46 AM
1 Karma
I would like to remove earliest=-7d@d from the drilldown search below, but keep a drilldown token to 7d@ d via a param. I have to keep this as an HTML module. Is there a way I can add an 'arg.earliest' param to the HTML module?
<module name="Paginator">
<param name="count">5</param>
<param name="entityName">results</param>
<module name="Table">
<module name="HTML" group="row.fields.TEST">
<param name="html"><![CDATA[
<a href="flashtimeline?q=index=$row.fields.orig_index$ **earliest=-7d@d** $row.fields.TEST$" target="_blank">$row.fields.TEST$</a>
]]></param>
</module>
</module>
</module>
... View more
09-28-2016
02:24 PM
Understood...
The idea would be to have the dashboard refresh every 5 minutes in monitor mode by using the scheduled search history. And if a user changes the timerange selector it goes into inline mode.
I guess I could have two dashboards, one for monitoring and one for historical research..
Either way, appreciate your help.
... View more
09-28-2016
01:39 PM
I don't think its using the scheduled search history - I'll live with it for now.
... View more
09-28-2016
12:29 PM
standby, it might be working properly. testing.
... View more
09-28-2016
12:26 PM
That works, however the default savedsearch is "waiting for input" until timerange is selected. Its no longer instantly loading the savedsearch history.
<input type="time" token="field1" searchWhenChanged="true">
<label></label>
<default>
<earliest></earliest>
<latest></latest>
</default>
</input>
</fieldset>
<search id="BaseSearch1" ref="ALERTcht">
<query>| savedsearch ALERTcht</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
... View more
09-28-2016
11:15 AM
Thanks -
Good news: is it makes the panels refresh when i choose a time.
Bad news: The charts still display the time defined in the 'Start time' and 'Finish time' under 'Time range' settings in the saved search form.
The underlying query in the saved search does not have earliest=-1h@h latest=now
<fieldset submitButton="false">
<input type="text" token="FindHost" searchWhenChanged="true">
<label>HOST FILTER</label>
<default></default>
</input>
<input type="time" token="field1">
<label>Timerange Under Development</label>
</input>
</fieldset>
<search id="BaseSearch1" ref="ALERTcht">
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
... View more
09-28-2016
09:46 AM
Hi
I like the simple xml post process and how fast it is when filtering data on a savedsearch.
However, on my dashboard, sometimes i want to override the saved search and expand the time range.
Is there any way to override saved search timerange and execute an inline search on the basesearch? This view is using simple xml postprocess and timerange button. Can a time token manually override the basesearch query?
fieldset submitButton="false">
<input type="text" token="FindHost" searchWhenChanged="true">
<label>HOST FILTER</label>
<default></default>
</input>
<input type="time" token="field1">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
</fieldset>
<search id="BaseSearch1" ref="ALERTcht"></search>
<row>
<panel>
<table>
<title>TEST</title>
<search base="BaseSearch1">
<query>
<![CDATA[| search host="*$FindHost$*" ]]>
</query>
</search>
<option name="displayRowNumbers">true</option>
<option name="height">300px</option>
<option name="wrap">false</option>
<option name="earliest">$field1$</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">100</option>
<option name="refresh.auto.interval">300</option>
<format type="sparkline" field="TREND">
<option name="type">bar</option>
<option name="height">20px</option>
<!-- Use colorMap to map specific values to selected colors -->
<option name="colorMap">
<option name="1:">#FF0000</option>
<option name=":0">#9ac23c</option>
</option>
<option name="barWidth">5px</option>
</format>
</table>
</panel>
</row>
<row>
... View more
09-20-2016
02:53 PM
Thank you sir!
... View more
09-20-2016
11:16 AM
<view autoCancelInterval="1" decomposeIntentions="false" isPersistable="true" isSticky="true" isVisible="true" nativeObjectMode="viewconf" objectMode="SimpleDashboard" onunloadCancelJobs="true" template="dashboard.html" type="module">
<label>test</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="DashboardTitleBar" layoutPanel="viewHeader" />
<module name="URLLoader" layoutPanel="viewHeader" autoRun="true">
<module name="HTML" layoutPanel="panel_row1_col1">
<param name="html"><![CDATA[<b>Item:</b> $ERROR$ <br><br/><b>APP:</b> $APP$]]></param>
</module>
<module name="Button" layoutPanel="panel_row3_col1">
<param name="allowSoftSubmit">False</param>
<param name="allowAutoSubmit">False</param>
<param name="label">SUBMIT</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">DESCRIPTION</param>
<param name="label">Description:</param>
<param name="width">602px</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">EXPERIENCE</param>
<param name="template">$EXPERIENCE$</param>
<param name="label">EXPERIENCE</param>
<param name="width">602px</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">TICKET</param>
<param name="label">Ticket:</param>
<param name="width">60px</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">FLOW</param>
<param name="label">Flow:</param>
<param name="width">200px</param>
<module name="ValueSetter">
<param name="name">WAIT</param>
<param name="value">Please wait...</param>
<module name="HTML" layoutPanel="panel_row4_col1">
<param name="html"><![CDATA[<font color="green"><b>$WAIT$</b></font>]]></param>
</module>
</module>
<module name="Radio" layoutPanel="panel_row2_col1" autoRun="false">
<param name="name">IMPACT</param>
<param name="staticRadios">
<list>
<param name="label">Impact</param>
<param name="value">Impact</param>
</list>
<list>
<param name="label">Ignore</param>
<param name="value">No Impact</param>
</list>
<list>
<param name="label">Monitor</param>
<param name="value">Monitor</param>
<param name="selected">true</param>
</list>
<list>
<param name="label">Impact Pending Review</param>
<param name="value">Impact Pending Review</param>
</list>
<list>
<param name="label">Other</param>
<param name="value">Other</param>
</list>
</param>
<!--appends token values to the lookup-->
<module name="Search" layoutPanel="panel_row4_col1">
<param name="search">
<![CDATA[| stats count
| eval ERROR=$ERROR$
| eval APP=$APP$
| eval EXPERIENCE="$IMPACT$ - $EXPERIENCE$"
| eval DESCRIPTION="$DESCRIPTION$"
| eval ENTRY_DATE=now() | eval ENTRY_DATE=strftime(ENTRY_DATE,"%D %T")
| eval TICKET="$TICKET$"
| eval FLOW="$FLOW$"
| table ERROR APP EXPERIENCE DESCRIPTION TICKET FLOW WHO ENTRY_DATE
| join [| rest /services/authentication/users splunk_server=local | rename email AS WHO | fields WHO]
| outputlookup append=true known_errors.csv
]]>
</param>
<module name="Table">
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>
... View more
09-20-2016
07:50 AM
1 Karma
Hi Everyone,
Everything works as intended with this view including the radio selections. However, i'm having a problem with second search * being dispatched on top of the regular search module..
Is this because the radio module is a dispatch module? Can i stop the radio module from dispatching search * ? If i take out the radio module the search * doesn't occur.
<module name="Button" layoutPanel="panel_row3_col1">
<param name="allowSoftSubmit">False</param>
<param name="allowAutoSubmit">False</param>
<param name="label">SUBMIT</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">DESCRIPTION</param>
<param name="label">Description:</param>
<param name="width">602px</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">EXPERIENCE</param>
<param name="label">EXPERIENCE</param>
<param name="width">602px</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">TICKET</param>
<param name="label">Ticket:</param>
<param name="width">60px</param>
<module name="TextField" layoutPanel="panel_row3_col1">
<param name="name">FLOW</param>
<param name="label">Flow:</param>
<param name="width">200px</param>
<module name="Radio" layoutPanel="panel_row2_col1" autoRun="false">
<param name="name">TEST</param>
<param name="staticRadios">
<list>
<param name="label">TEST1</param>
<param name="value">TEST1</param>
</list>
<list>
<param name="label">TEST2</param>
<param name="value">TEST2</param>
</list>
</param>
<module name="Search" layoutPanel="panel_row4_col1">
<param name="search">...
... View more
04-16-2016
11:26 AM
Another option?
| inputlookup MASTER_LOOKUP.CSV | inputlookup LOOKUP_A.CSV append=t | inputlookup LOOKUP_B.CSV append=t | inputlookup LOOKUP_C.CSV append=t | outputlookup RESULT_LOOKUP.csv
... View more
03-28-2016
04:17 PM
Hi,
I was able to fix Truncation Error by increasing resultTruncationLimit:
<module name="HiddenChartFormatter">
<param name="charting.chart.resultTruncationLimit">2000</param>
... View more
09-05-2015
10:38 AM
map [search index=test earliest=-2d testERROR =$testERROR $ | timechart fixedrange=F count by testERROR ]
Any idea how to make the Y axis less jumbled?
looks like its overwriting w/ each map loop
... View more
09-05-2015
10:27 AM
Yes the query worked - thanks again!
... View more
09-05-2015
08:54 AM
Hi,
Anyone know what's the best way to count by minute the error exists, and not by the count of the number of errors?
I'm looking for the duration of errors and don't care about the volume. Each minute = 1 count
So an issue lasting 7 minutes has a count of 7.
Would that be with the eventstats command?
... View more
08-17-2015
09:42 AM
no map ? This looks like its just running a subsearch for the same thing.
I was hoping to take the output from a search and map it to individual searches w/ timecharts.
... View more
08-17-2015
08:54 AM
Hi,
I have a search w/ a stats function that illustrates multiple individual errors. Once that search completes, I would like to see a 7 day the timechart for each individual error. Sometimes the report could generate 1 timechart in the PDF, or sometimes multiple errors in the pdf. Depending on what comes out of the stats.
This is the concept:
... | stats count by testERROR | where count > 10 | map timechart count by testERROR
create pdf and email with timecharts
... View more
08-17-2015
06:56 AM
test string 123:test test test123
this is what i want to capture.
... View more
08-17-2015
06:21 AM
rex "(?i)(?P<testERROR>(\:[^\:]*){2})$"
output
:test string 123:test test test123
I have to keep the the 2nd : match from the end of the line but i don't want it to be displayed in the output.
*when i say second match from the end, that means i would like to remove the colon from ":test"
Is this something where a lookahead/lookbehind is needed?
... View more
05-19-2015
02:29 PM
2 Karma
Anyone have suggestions on how To Redirect but not dispatch the search? I want the user to be able to enter a ticket before hitting search so it updates the lookup. Right now it works but searches and updates the lookup because the search is dispatched
<module name="SimpleResultsTable">
<param name="entityName">results</param>
<param name="drilldown">row</param>
<module name="Redirector">
<param name="url">flashtimeline</param>
<param name="popup">True</param>
<param name="arg.q"><![CDATA[| stats count | eval testfield="$click.fields.testfield$" | eval ticket="enter ticket number here" | outputlookup append=true testlookup ]]></param>
</module>
</module>
Or, are there any dashboard examples that i can redirect testfield to that would auto populate a form on the new dashboard, leave a ticket form blank, then have a submit button for the user once they had the ticket form filled?
... View more
03-07-2015
03:43 PM
Hello, does anyone have suggestions on accomplishing the following?
I have 2 identical dashboards that work perfectly
Dashboard "A" refreshes every 100s with underlying scheduled searches. For the underlying XML modules, useHistory is set to true and autorun="true"
Dashboard "B" has a timerangepicker and uses the same scheduled searches but useHistory is set to false and autorun="false"
Is there any way to put a dormant timerange picker on Dashboard "A" that uses a nested redirector module so once the user selects a timerange on the dormant timerange picker, a popup to dashboard "B" is performed with the predefined timerange?
Here's where i'm at w/ the dormant timerange picker on dashboard "A"
<module name="TimeRangePicker" layoutPanel="viewHeader" autoRun="False">
<param name="default">Last 60 minutes</param>
<param name="searchWhenChanged">True</param>
<module name="Redirector">
<param name="url">dashboardB</param>
<param name="arg.earliest">-$search.timeRange.earliest$</param>
<param name="arg.latest">$search.timeRange.latest$</param>
<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
</module>
</module>
</module>
Would dashboard "B" need the URLLoader module to accept the URL with a timerange selected from DASHBOARD "A" ?
<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
<param name="keepURLUpdated">True</param>
... View more
02-25-2015
03:14 PM
Hi!
I have log entries with a timestamp embedded for expiration inside the log event.
What's the best way to convert the newly generated epoch to local time?
log sample
EXPIRES Feb 11 17:11:15 2015 GMT
Search:
... | rex "(?i)EXPIRES (?P.*) | eval epochtime=strptime(TEST, "%b %d %H:%M:%S %Y") | eval ET=strftime(epochtime,"%b %d %H:%M:%S %Y")
Output sample:
TEST epochtime ET
Feb 11 17:11:15 2015 GMT 1423674687.000000 Feb 11 17:11:15 2015
... View more
02-23-2015
04:10 PM
Any suggestions on how to timechart an unusual timestamp that comes inside the log entry.
These logs come in every night at midnight.
I want to run a scheduled search at 6pm that same day every day which charts the 'EXPIRES' field below as Time by CONTRACT
Here's the functional stats query:
index=contracts | rex "(?i)Contract (?P<CONTRACT>.*on+)(?P<EXPIRES>.*)" | stats count by CONTRACT, EXPIRES
log example:
Contract Honda Civic 144433 expires on Sun Feb 23 21:16:55 2015 GMT
Here's the EXPIRES field value that i would like to timechart:
Sun Nov 2 21:16:55 2014 GMT
Dysfunctional timechart search:
index=contracts | rex "(?i)contract (?P<CONTRACT>.*on+)(?P<EXPIRES>.*)" | timechart EXPIRES AS _time by CONTRACT
... View more
12-16-2014
01:51 PM
1 Karma
You are right. $click.fields.user$ is the solution. Many Thanks!
... View more
