Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About tamduong16
tamduong16
Contributor
Member since:
08-02-2017
06-05-2020
Community Statistics
| Posts | 121 |
| Solutions | 3 |
| Karma Given | 77 |
| Karma Received | 7 |
| Member Since | 08-02-2017 |
Activity Feed
- Got Karma for Re: How can I do sum of a time field?. 10-20-2023 11:05 AM
- Karma Re: If else condition for dashboard for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Splunk real-time data input from a HTML page? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: How to import data to Splunk via HTTP GET request? for sjalexander. 06-05-2020 12:49 AM
- Karma Re: How can I do sum of a time field? for sbbadri. 06-05-2020 12:49 AM
- Karma Re: How can I do sum of a time field? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: How can I do a sum of count for if statement? for cmerriman. 06-05-2020 12:49 AM
- Karma Re: How can I do a sum of count for if statement? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How can i set different timeline for my search? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: If else condition for dashboard for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Single value with trend for duration? for niketn. 06-05-2020 12:49 AM
- Karma Re: REST API option for compressed file? Can I index a zip file? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Does Splunk have an option to only index part of a JSON file? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Does Splunk have an option to only index part of a JSON file? for skoelpin. 06-05-2020 12:49 AM
- Karma Re: Hide and Show Input Dropdown Based Upon Another Input Drop Down for niketn. 06-05-2020 12:49 AM
- Karma Hide and Show Input Dropdown Based Upon Another Input Drop Down for handsomehari. 06-05-2020 12:49 AM
- Karma Re: How do I unzip a file when pulling it from REST API? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: How do I unzip a file when pulling it from REST API? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Is there an option to do an event break at the end of file (txt file)? for cpetterborg. 06-05-2020 12:49 AM
- Karma Re: Custom timestamps for csv format? for Genti. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-23-2018
08:47 PM
@niketnilay I'm a little lost. What do you mean by configuring the execution of Scripted input. I thought all I have to do is place the file into search/bin folder and it should run. What could I do to configure this? Thanks!
... View more
03-23-2018
08:44 PM
@Elsurion I think that's what I'm missing. Since I don't know anything about this. All I did was placing the file inside of the search/bin and expecting it to run on it own. How can I do this? What do I have to do in my input.conf file? I'm very new to this. Thanks for the help
... View more
03-22-2018
02:17 PM
This is my first time dealing with script input. I tried to place my python script in both of these directories (C:\Program Files\Splunk\bin\scripts, C:\Program Files\Splunk\etc\apps\search\bin) and it hasn't work. I run in python idle and the scripts actually index data into my splunk enviroment. But when I want to add it as a script input, I don't get anything back. It looks like python script never been run. Did I have it in the right file? I didn't create a splunk app for this. What can I do inorder for it to be run in splunk? Here is my python script. Thanks so much!
... View more
03-19-2018
07:58 AM
[rest://Vbrick api/v1/user/login]
auth_type = none
endpoint = https://xxxxxxx.rev.vbrick.com/api/v1/user/login?username=abc&password=def
http_method = POST
index = vbrickreport
index_error_response_codes = 1
response_type = text
sequential_mode = 0
sourcetype = _json
streaming_request = 1
url_args =
response_handler = JSONArrayHandler
disabled = 1
I tried the same with default response handler but still don't have data in
... View more
03-16-2018
08:10 AM
Where can i find splunk rest configs?
... View more
03-15-2018
03:42 PM
HI Damien, Here is the error:
03-14-2018 23:44:33.428 -0500 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\rest_ta\bin\rest.py"" Exception performing request: HTTPSConnectionPool(host='reqres.in', port=443): Max retries exceeded with url: /api/users?page=2 (Caused by : [Errno 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond)
I used postman to make this request and it works fine. I don't know what I did wrong in splunk. Thanks for the help!
... View more
03-14-2018
08:09 AM
Hi, here are the input and output data from the api call.
POST /api/v1/user/login
request parameters:
{
"username" : "john.smith",
"password": "Password123"
}
Request response:
{
"token": "T9-GJqSH7dQSBqcUUVP0la6IHEyc9cR00Mj2ysD_fPwdKv0JMOcsJ9Sf2jR8nSvwgRgaZasExlH1xd5-XeqmUg2",
"issuer": "VBrick",
"expiration": "2017-08-31T15:00:10.599Z",
"email": "[email protected]",
"id": "5b8f0285-7627-4ee7-b67b-e2e9e8944279",
"username": "john.smith",
"firstName": "John",
"lastName": "Smith",
"language": "English"
}
... View more
03-13-2018
11:38 PM
I'm running python 3 on my computer. Could this be the reason to my problem?
... View more
03-13-2018
11:13 PM
I'm setting up REST API to index Json to splunk but for some reasons, it doesn't index anything to splunk at all. I have tried to set the response type to all of the formats in the list, also change the response handler class to JSONArrayHandler & default Handler and still couldn't get it to work. For the purpose of debuging it, I check the box to index error responses and still get nothing. I tried to use Postman to make an api call to it and receive a json file. What did I do wrong? Thank you!
... View more
02-08-2018
08:47 PM
It is exactly what I got the code from. But it doesn't work for me so far. And I don't know what could be the problem. 😞
... View more
02-07-2018
08:31 PM
Sorry here is my code:
<iframe src="http://myserver:8000/en-US/app/search/mydashboard"></iframe>
... View more
02-07-2018
08:30 PM
I'm trying to embed a dashboard into my site using iframe but the message in my iframe displayed: "This content cannot be displayed in a frame. To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame."
This is my code for the displaying the dashboard:
Did i do it right? For now, I'm using splunk free. Could this be the reason why it doesn't work?
Thanks
... View more
12-22-2017
10:48 AM
@greggz. Thanks for answering my question. Do you know where I could add this code in Splunk? Which file would it be? I'm new to javascript in Splunk so please excuse my ignorance.
... View more
12-15-2017
02:09 PM
I just rerun it with the asterisk in values function but have the same result. Thanks again for helping me!
... View more
12-15-2017
11:13 AM
yes, it works before the subsearch!
It also works with the subsearch if I delete all of the eval expression from the search.
... View more
12-15-2017
09:51 AM
please ignore $result0sec$ $result$. I left them out in the search
... View more
12-15-2017
09:46 AM
@someoni2,
Thanks for the answer. It worked but when I throw the rest of the search with it, I have error like expected AND. Here is the search:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","")
| eval "Name" = upper(Name)
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name
| eval "Avg_Voice"=tostring($$Avg_Voice$$,"duration") | eval Avg_Voice=if(isnull(Avg_Voice), "00:00:00", replace(Avg_Voice,"(\d+):(\d+):(\d+).(\d+)","\1:\2:\3"))
| eval "Avg_Video"=tostring($$Avg_Video$$,"duration") | eval Avg_Video=if(isnull(Avg_Video), "00:00:00", replace(Avg_Video,"(\d+):(\d+):(\d+).(\d+)","\1:\2:\3"))
| eval "Sum_Voice"=tostring($$Sum_Voice$$,"duration") | eval Sum_Voice=if(isnull(Sum_Voice), "00:00:00", replace(Sum_Voice,"(\d*)+(\d+):(\d+):(\d+)","\1D \2:\3:\4"))
| eval "Sum_Video"=tostring($$Sum_Video$$,"duration") | eval Sum_Video=if(isnull(Sum_Video), "00:00:00", replace(Sum_Video,"(\d)+(\d+):(\d+):(\d+)","\1D \2:\3:\4"))
| append [search index=monthlycdr earliest=0 | eval "Name"=replace('Name',"\"","") | stats count by Name | table Name]
| stats values() as * by Name
For simplicity, I left out the eval portion but I didn't know it would create problem. Sorry!
... View more
12-15-2017
09:18 AM
this is my full search which it only gives me the same result if I run the above search.
index="monthlycdr" "Call Duration"= Name=\"**\" | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","")
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$") OR match(transporttype, "^(?i)sip$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video by Name
| join Name
[search index=monthlycdr earliest=0
| eval "Name"=replace('Name',"\"","")
| table Name]
thanks!
... View more
12-15-2017
08:51 AM
I have the following search:
index="monthlycdr" "Call Duration"=* Name=\"***\" | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","")
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$") OR match(transporttype, "^(?i)sip$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video by Name
Which only bring up the name of my units within the time frame that I set. But I want to also view other units that haven't been use in the selected time frame. These units would exit in all time. How can I join them in my search? When I do a subsearch for all time, it only displays the name of units within the general time frame that I select. I want to bring up the name of those units that haven't been use as well.
... View more
12-15-2017
08:06 AM
I have a very complicated dashboard which contains probably more than 20 tokens if I decide to do it this way. I want splunk to run search base on user dropdown value. For example: I have panel 1 which run query abc and panel 2 which run query bcd, panel3, etc. And all of this are different search base on token1. I tried to use (panel depends=token) for 3 panels but it already complicated and slow with 3 panels. I can't imagine having 20 like this. Is there an alternative to using token, like if else, or javascript?
... View more
12-14-2017
11:30 AM
2 Karma
How can I do an if token=something then run this query for the panel and else to run another query for that same panel?
So I have the following query:
query 1:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "Name" = substr(Name,1,3)
| eval "Name" = upper(Name)
| rex field=Name mode=sed "s/AAA/APAC/g"
| rex field=Name mode=sed "s/ABC/ABCD3/g"
| rex field=Name mode=sed "s/CDF/CDF123/g"
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name
query2:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name
How can I make my dashboard panel to run query 1 if the token value is "All", and if else for query 2, else for maybe other query? Can I do this with splunk?
Thanks
... View more
12-11-2017
12:07 PM
@DalJeanis, how can I do this in xml do you know? This is my xml:
<label>Select a time range:</label>
<default>
<earliest>-1mon@mon</earliest>
<latest>@mon</latest>
</default>
<change>
<eval token="timelineearliest">case($field1.earliest$ = </eval>
<eval token="timelinelatest">$field1.latest$</eval>
</change>
</input>
I want to find that out and put that for timelineearliest line. Is this durable? Thanks!
... View more
12-11-2017
11:14 AM
So for the dashboard time dropdown, I want to determine whether the To: date that user select is the last date of that month. Could I do that with today Splunk? If not, can I determine the last date of that month base on the epoch time?
... View more
12-06-2017
01:38 PM
So the $unit$ token could be anywhere from * to a string like "abc", "cdf123". I have 2 other token name $campus$ and $building$. I want $result$ to be "Name=$campus$$building$*" if $unit$ equal * , and $result$ to be "Name=$unit$" if $unit$ equal something else (for example, "Name=abcd345" when the value of $unit$ is "abcd345"). Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
