Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About arkadyz1
arkadyz1
Builder
Member since:
09-08-2014
08-28-2025
Community Statistics
| Posts | 184 |
| Solutions | 28 |
| Karma Given | 85 |
| Karma Received | 66 |
| Member Since | 09-08-2014 |
Activity Feed
- Karma Re: replace multivalue field values for ITWhisperer. 08-27-2024 11:44 AM
- Posted Re: Custom search command (v2/chunked): Script is called twice on Splunk Dev. 08-11-2024 08:55 PM
- Posted Re: Custom search command (v2/chunked): Script is called twice on Splunk Dev. 08-11-2024 08:48 PM
- Got Karma for Re: Custom search command called multiple times. 01-05-2023 12:40 PM
- Karma Re: Securing HTTP Event Collector for ischoenmaker. 04-27-2022 05:56 AM
- Posted Re: Is it possible to access _internal index of a search peer? on Splunk Search. 08-25-2021 08:51 AM
- Posted Is it possible to access _internal index of a search peer? on Splunk Search. 03-22-2021 11:57 AM
- Got Karma for Re: How to remove the "| Splunk" addition and the green arrow icon from the title in our browser tab in Splunk 6.2?. 02-11-2021 05:48 PM
- Got Karma for Re: How do you use value or capture groups as regex's curly bracket number parameter?. 09-30-2020 05:12 AM
- Karma Re: How come our tstats with datamodel does not group by field? for woodcock. 06-05-2020 12:50 AM
- Karma Re: Splunk not picking up on timezone set within props for FrankVl. 06-05-2020 12:50 AM
- Karma Re: Is there a function that randomly shuffles results? for martinpu. 06-05-2020 12:50 AM
- Karma Re: Is there a function that randomly shuffles results? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How do you use value or capture groups as regex's curly bracket number parameter? for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use value or capture groups as regex's curly bracket number parameter?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use value or capture groups as regex's curly bracket number parameter?. 06-05-2020 12:50 AM
- Karma Re: Running one of two searches based on time picker selection for niketn. 06-05-2020 12:49 AM
- Karma Re: multivalue in a sub search not working as expected. for maraman_splunk. 06-05-2020 12:49 AM
- Got Karma for How to stop custom search command from calling multiple times?. 06-05-2020 12:49 AM
- Got Karma for How to stop custom search command from calling multiple times?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-26-2015
12:11 PM
2 Karma
We've recently experienced a very strange situation: vmstat from Splunk_TA_nix, running on a Splunk universal forwarder, stopped showing the numbers among the events - just the headers ("memTotalMB memFreeMB memUsedMB"...). We tried looking around in all kinds of conf files, but in the end, restarted the forwarder - and the events started coming again just fine!
Has anyone experienced such a loss of information? Since it's working for us now, I don't need an immediate action, but would like some insight into how it might have happened.
... View more
03-23-2015
12:26 PM
That fully satisfies it. I tried uploading my file and then using LOOKUP command and it worked perfectly. My only remaining question would be "How to modify the CSV file I'm using". For example, when the company opens a new branch, we would want to add it to that CSV file. Is it as easy as uploading its modified version under the same name?
... View more
03-13-2015
10:34 AM
I'm curious whether there is a preferred way of getting the geolocation data in and using it in the searches. We are talking about a company which has many (several dozen) different branches all over the country. The list of those branches will change every now and then, but it will be a rare event.
Right now, just for the sake of getting something working, I created a CSV file of branches containing their longitude and latitude, imported it once and created a couple of maps with underlying searches joining the resulting list of "events" on the location ID before going into 'geostats' command. However, I have a feeling that JOIN is a cumbersome way of doing it. Is there anything better suited for the task?
... View more
03-13-2015
08:17 AM
Can you log in from a different browser? I had the problem under IE11, but could come in with Chrome. A strange thing, though, was that my session would just end out of the blue despite the activity - even on Chrome.
... View more
03-13-2015
07:41 AM
We have the same problem. I've seen a different question here, back from Splunk 5.0, and the answer was to clear the browser cache. The OP there, however, had to restart the computer (not the Splunk Head, but the one with the browser).
... View more
03-05-2015
11:29 AM
1 Karma
Thanks to all who replied! I'm also in the camp of maintainability, so 1-59/15 seems like a preferred solution to me.
... View more
03-03-2015
02:10 PM
Great, saved me time and doubts! Thanks!
... View more
03-03-2015
01:58 PM
1 Karma
I did solve the problem of the document.title (by the way, it does not work at $(document).ready time). It is quite a hacking approach, but we, as an OEM, really had to hide Splunk mentions from everywhere.
There are three files which need changing (actually just two, because we, as an OEM, also have to hide Searching & Reporting from our end users). $(static_dir) below refers to the folder we define as static_dir in web.conf:
$(static_dir)/js/build/bundles/common.js : find "| Splunk %s" there and replace it with our text. %s is used to display the Splunk version, so it does need removing. This, though, affects only the Search screens and is not exactly relevant to our end product.
$(static_dir)/js/build/accountpage.js : find "| Splunk" and replace it. Affects the login page.
$SPLUNK_HOME/ share/splunk/search_mrsparkle/templates/dashboards/dashboard.html : find "| Splunk" and replace it. I found out the hard way that setting template_dir in web.conf does not work - one needs to go to the original search_mrsparkle tree.
... View more
03-03-2015
12:49 PM
I'm trying to create the following hierarchical structure of the summary searches:
1st search:
... | collect index=summary marker="search_type=type1"
2nd search:
... | collect index=summary marker="search_type=type2"
3rd search:
index=summary search_type=type2 | ... | join type=inner commonField [ search index=summary search_type=type1 ] | ...
I'd like to schedule all three to run every 15 minutes. Naturally, I'd like the first two to finish running before the third one even starts. Is there a way to achieve that?
One of the ideas I had was this: schedule the first two (independent) searches at :00, :15, :30, :45 and set the time range for them as "-15m@m" and "@m", while the third one will be scheduled at :01, :16, :31, :46 (hope cron supports that) and will have the range of "-16m@m" through "-1m@m". This does not necessarily make them dependent but gives me some chances.
Is there a better way of achieving my goal?
... View more
03-03-2015
12:22 PM
7 Karma
I collect some events into a summary index with something like this:
... some search ... | rex ... | eval ... | fields ... | fields - _raw | collect index=summary marker="search_type=mysearchtype"
Surprisingly, _time saved into summary index loses its milliseconds (they become zeroes). If I add something like | eval start_time = time | fields ..., start_time ... , that collected start_time does contain the milliseconds while the collected _time doesn't! This is happening in 6.2.1.
Not urgent since I have the workaround - just weird...
... View more
02-25-2015
08:30 AM
I did solve the selective hiding of stuff (including .navbar): take a look at my question and answer here:
http://answers.splunk.com/answers/218039/what-to-import-require-in-my-custom-javascript-to-1.html
... View more
02-24-2015
06:57 AM
"Find More Apps" link (or, rather, the list item containing the link) has an id of findMoreAppsNav (as of 6.2) - you can find that out by right-clicking the link and choosing 'Inspect Element' in most modern browsers.
In order to make that list item invisible for all users of your application, you can add
#findMoreAppsNav {
display:none !important;
}
to your CSS. Have all your forms and dashboards have stylesheet="yourdashboard.css" in their form/dashboard tag, create yourdashboard.css in etc/apps/yourappname/appserver/local and put that style there.
However, it seems that this link is permission-based - my non-admin users do not see "Find More Apps" at all! I looked through the list of capabilities but none rings the bell. The JavaScripts I looked at check for some canManageRemoteApps flag, but I'm not sure how it is generated.
Anyway - try creating a user based on user role and see whether you still see that link.
... View more
OK, I decided to look at other apps. I took a look at $SPLUNK_HOME/etc/apps/search/appserver/static/status_dashboard.js and went on to mimic the approach.
Here is what I have in my dashboard.js right now - hides Settings, Activity and Help dropdowns in the navigation bar from all users but admin:
var allowedUsers = ["admin"];
require(["jquery", "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!"], function(){
if (allowedUsers.indexOf(Splunk.util.getConfigValue("USERNAME")) ==-1) {
$(document).ready(function() {
var x = document.createElement("STYLE");
var t = document.createTextNode(".shared-splunkbar-activitymenu{display:none !important;}.shared-splunkbar-systemmenu{display:none !important;}.shared-splunkbar-helpmenu{display:none !important}");
x.appendChild(t);
document.head.appendChild(x);
});
}});
I still don't know which of the splunkjs/mvc and splunkjs/mvc/simplexml/ready! is responsible for defining that Splunk object, but it's working for me now.
... View more
02-23-2015
12:27 PM
Hello,
I'm trying to customize my page depending on the user. I found an example (hiding the navbar selectively - needed something else but wanted to start somewhere) with this code:
// show the jobs and alerts links for the given usernames.
var allowedUsers = ["admin"];
if (allowedUsers.indexOf(Splunk.util.getConfigValue("USERNAME")) !=-1) {
$(".navbar").show();
// $(".AccountBar .job_manager_opener").show();
}
//otherwise finish the job started by the css, and hide the little divider
//lines too.
else {
$(".navbar").parent().next().hide();
// $(".AccountBar .job_manager_opener").parent().next().hide();
}
Unfortunately, this code fails with "Uncaught reference: Splunk is not defined" message. What should I add to my script to define it? The script is in $SPLUNK_HOME/etc/apps/myapp/appserver/static . I'm using Splunk 6.2.1.
... View more
02-13-2015
12:38 PM
From the documentation (Getting Data In, v6.2.1):
Restart Splunk for your changes to take effect
Changes to configuration files such as props.conf and transforms.conf won't
take effect until you shut down and restart Splunk on all affected components.
What does it mean "on all affected components"? For example, if I change something on a forwarder, should I restart not just the forwarder, but the forward-server where the data are sent?
... View more
02-04-2015
10:16 AM
Try the standard
http://192.168.32.128:8000/en-US/app/tuessdv/Detail?keyId=001&keyId=002
Should work.
... View more
Thanks! This is quite hackish, but should help those people with free license. The path is slightly different, though (at least in my Windows Splunk 6.2 installation) - $SPLUNK_HOME/Python-2.7/Lib/site-packages/splunk/pdf/pdfrenderer.py .
... View more
01-20-2015
11:32 AM
Thanks again. I will try to add it where I can. I'm concerned about login screen - will probably end up editing login.html for that (again - not concerned much about updates at the moment).
I only hope that the perioding refreshing of the page (definitely happening on the real-time dashboards, probably on others) will not stomp my puny efforts to re-brand the title.
... View more
01-20-2015
11:08 AM
Thanks for the quick answer. Yes, I'm aware of that icon. I also found out that our particular installation uses favicon.ico and not favicon_enterprise, favicon_hunk or favicon_lite.
Of course, the "will not survive an update" part is very important but manageable. Since our particular instance will be on the computers with no Internet access, the update will be conducted by us and we can include the icon replacement into our update procedure.
Anyway, I'm more concerned about what can be done to eliminate that '| Splunk' in the title. It must be produced by the JavaScript, since the initial title value is 'Loading...' and it's not what I see :).
... View more
01-20-2015
07:31 AM
In our company, we have to remove all Splunk mentions from our applications. I succeeded in hiding or removing most or all of that from the screen. However, if I look at the top of the browser, the tab still shows the title of "Our dashboard name | Splunk" and a green "arrow" icon.
Is there any setting to change this? Maybe some .css, .js, .conf or .py to modify?
... View more
01-16-2015
10:54 AM
2 Karma
I figured it out. The folder you specify in web.conf as static_dir ( share/splunk/search_mrsparkle/exposed by default) is referred from within Splunk screens as /static . What I did was put our company's logo in img/skins/default under it and refer to it from login_content as background: url(/static/img/skins/default/ourCompanyLogo250x250.png) no-repeat .
... View more
01-16-2015
10:25 AM
2 Karma
I'm trying to customize our Splunk installation to remove all links to and mentions of splunk.com (this is a part of our OEM agreement). I managed to "neutralize" the login screen using the suggestion from this great comment in the docs (look for the comment by Kbains of January 12, 2015):
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomizeLogin
However, the background image example isn't working - and I have a feeling I know why: at login time, you are not yet logged in (duh!), and the access to the application resources is granted only to the users with read permission. Not being a user yet, one cannot load the image.
What is the "public" folder for Splunk images and the external URL pointing there?
... View more
01-07-2015
09:45 AM
1 Karma
You can definitely hide the whole black navigation bar on top from view (though you'll need to figure out how to show the 'Logout' button if you want it to be available) by adding hideSplunkBar="true" to your form's/dashboard's XML. For example, one of my dashboards contains the following:
<form refresh="600" stylesheet="dashboard.css" script="dashboard.js" hideSplunkBar="true" hideFooter="true">
in its XML ('Edit'->'Edit Source'). Look for more information here.
Unfortunately, I don't know yet how to hide just the specific drop-down menu items from view. See if any real expert can chime in.
... View more
01-06-2015
07:18 AM
5 Karma
Solved this: in 6.2, there are all kinds of attributes I can specify in dashboard's XML ( form tag). The one I needed is hideSplunkBar - just set it to true (default false ). I decided to hideFooter as well while I'm at it :). It needs to be properly set in each dashboard - those which do not have hideSplunkBar set will briefly display the navigation bar when you switch to them.
In fact, hiding .navbar in CSS is no longer necessary once hideSplunkBar is specified.
The question of hiding that stuff selectively still remains, of course. I'll need some JavaScript for that, it seems.
... View more
01-05-2015
02:09 PM
I'm quite a newbie, so I'm not sure what you mean by "rebranding" the nav bar. Could you please elaborate a little bit? Just a push in the right direction :).
Thanks in advance!
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-28-2025
10:19 AM
|
Karma from
Karma given to
