Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About SathyaNarayanan
SathyaNarayanan
Path Finder
Member since:
04-29-2015
06-05-2020
Community Statistics
| Posts | 94 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 5 |
| Member Since | 04-29-2015 |
Activity Feed
- Karma Re: Dendrogram chart not showing results for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How to get the on time and off time over a category with place for renjith_nair. 06-05-2020 12:50 AM
- Got Karma for Re: Landing Page with All Apps and Dashboards based on the user role. 06-05-2020 12:50 AM
- Karma Re: Need to change the color of bar when one field is greater than other field in bar chart for niketn. 06-05-2020 12:49 AM
- Karma Re: How to change the panel title depending on the time range selected in the time picker? for poete. 06-05-2020 12:49 AM
- Got Karma for Unknown error for peer xxx. Search Results might be incomplete,If this occurs frequently, please check on the peer. 06-05-2020 12:49 AM
- Karma Re: How to search for newly added servers by comparing today's log with the previous week's logs? for dwaddle. 06-05-2020 12:48 AM
- Karma Re: compare 2 different search results and list out the missing data from search 1 result for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to find all the searches having "index=*" in the search or Alert or Reports for alemarzu. 06-05-2020 12:48 AM
- Got Karma for How to search for newly added servers by comparing today's log with the previous week's logs?. 06-05-2020 12:48 AM
- Got Karma for compare 2 different search results and list out the missing data from search 1 result. 06-05-2020 12:48 AM
- Got Karma for Re: list out saved searches which are used index=* instated of using index fully qualified name. 06-05-2020 12:48 AM
- Karma Re: Search waiting for input... no chart is displayed when running Dashboard for tom_frotscher. 06-05-2020 12:47 AM
- Posted Re: Need to combine nearest _time values for each field on Splunk Search. 01-26-2020 12:19 AM
- Posted Need to combine nearest _time values for each field on Splunk Search. 01-22-2020 10:02 PM
- Posted Re: Show column depends on the role on Splunk Search. 01-09-2020 04:00 AM
- Posted Show column depends on the role on Splunk Search. 01-09-2020 03:26 AM
- Posted Re: Why does the map command shows results only when the second query have value? on Splunk Search. 10-15-2019 04:38 AM
- Posted Why does the map command shows results only when the second query have value? on Splunk Search. 10-14-2019 11:10 PM
- Posted Few users getting Dispatch Error in dashboard but works fine in Adhoc searchs on Dashboards & Visualizations. 10-01-2019 04:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-04-2019
03:50 AM
To join both the search with a common fields use the below syntax:
| join [ search ]
To append the 2nd search with the first search
| append maxout=0 [ search ]
... View more
06-27-2019
02:09 AM
how you want to combine both the search,
we have append , join, commands
To join both the search with a common fields use the below syntax:
| join [ search <search 2>]
To append the 2nd search with the first search
| append maxout=0 [ search <search 2> ]
... View more
05-15-2019
12:17 AM
Thank you.
... View more
05-14-2019
04:33 AM
I added the below lines and fixed the issue
.dashboard-row .dashboard-panel {
background-color: transparent;
}
... View more
05-02-2019
03:41 AM
Hi Team,
I added the below css sysntax in the dashboard. The background color is changed as mentioned but each panel still have white background for the charts.
Can anyone help me making all panels transparency, so tat the background color of the dashboard will be visible.
.dashboard-body {
background-image: radial-gradient(#98d6e9,#05173f);
}
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
04-25-2019
12:57 AM
@niketnilay
It works perfectly as expected.
Thank you very much.
... View more
04-23-2019
09:24 PM
@niketnilay
Wow Niketnilay, its working fine. Thanks.
I want to create drilldown panel for it.
The value is getting passed but why the depends, is not working.
Below is the xml for the drill down
<row depends="$tokClickedValue$" >
<panel>
<title>Detail</title>
<table>
<search>
<query>index=main source="LampFailures.csv" host="DC2VPLSPSH4"
| rename "Fixture ID" as FixtureID
| table Timestamp FixtureID "MH No" "Fitting Type" Color "Lamp Power" Location Remarks
| join FixtureID
[| inputlookup RETIL_lookup
| fields - "X-Position" "Y-Position" Description]
| sort - Timestamp
| search FixtureID="$tokClickedValue$"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
... View more
04-21-2019
11:36 PM
Hi @niketnilay
Below is the complete code.
Am trying to show the status of each light, So the colour will change to green and red per the range map.
Now i need to click the icon to drill down to which light went down.
I created a Panel and need to pass tok_id to get the results.
Hope now am clear in my requirements.
<form>
<label>AGLCMS v3</label>
<search id="taxi">
<query> | inputlookup RETIL_lookup
| dedup FixtureID
| join type=left FixtureID
[ search index=main host="DC2VPLSPSH4" source="AGLCMS.csv"
| rename "Field 1" as "FixtureID"
| rename "Field 2" as Name
| table "FixtureID" "Name"]
| eval Status=if(isnull(Name), "0","1")
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<search base="taxi">
<query>| search FixtureID="4TXC18-087AB" | rangemap field=Status low=0-0 severe=1-10| table FixtureID Status range</query>
<progress>
<set token="M12A_1">$result.range$</set>
<set token="M12A_11">$result.FixtureID$</set>
</progress>
</search>
<search base="taxi">
<query>| search FixtureID="4TXC18-085AB" | rangemap field=Status low=0-0 severe=1-10 | table Status range</query>
<progress>
<set token="M12A_2">$result.range$</set>
</progress>
</search>
<search base="taxi">
<query>| search FixtureID="4TXC18-086AB" | rangemap field=Status low=0-0 severe=1-10 | table Status range</query>
<progress>
<set token="M12A_3">$result.range$</set>
</progress>
</search>
<search base="taxi">
<query>| search FixtureID="3TXC17-086AB" | rangemap field=Status low=0-0 severe=1-10 | table Status range</query>
<progress>
<set token="M12A_4">$result.range$</set>
</progress>
</search>
<search base="taxi">
<query>| search FixtureID="3TXC17-087AB" | rangemap field=Status low=0-0 severe=1-10 | table Status range</query>
<progress>
<set token="M12A_5">$result.range$</set>
</progress>
</search>
<search base="taxi">
<query>| search FixtureID="3TXC17-088AB" | rangemap field=Status low=0-0 severe=1-10 | table Status range</query>
<progress>
<set token="M12A_6">$result.range$</set>
</progress>
</search>
<row depends="$hide$">
<panel>
<html>
<style>
.custom-result-value {
font-size: 35px;
margin: 35px auto;
text-align: center;
color: rgb(85, 85, 85);
display: inline-block;
padding:0px;
margin:0px;
}
.severe.custom-result-value:before {
content: "\25cf";
}
.severe.custom-result-value {
color: rgb(255, 0, 0);
}
.low.custom-result-value {
color: rgb(0, 247, 0);
}
.low.custom-result-value:before {
content: "\25cf";
}
.custom-result-value.icon-only {
}
.view---pages-enterprise---6-6-3---14_Tp{color:#fbca25;}
.dashboard-row .dashboard-panel h2.panel-title {
font-size: 25px;
font-weight: 600;
padding: 12px 20px 7px 12px;
text-align: center;
}
.dashboard-header h2 {
font-weight: bold;
}
.dashboard-panel {
border: 1px solid black;
border-radius: 6px;
}
.dashboard-body {
padding: 0 20px 20px;
color: #2f2c59;
background-color: #aea8bd;
min-height: 150px;
}
.highcharts-container {
border-radius: 6px;
}
.panel-head {
border-top-left-radius: 6px;
border-top-right-radius: 6px;
}
.dashboard-header h2 {
font-weight: bold;
}
#icon {
text-align:center;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<title>M12A</title>
<html>
<div id="icon">
<div class="custom-result-value $M12A_1$"> </div>
<div class="custom-result-value $M12A_2$"> </div>
<div class="custom-result-value $M12A_3$"> </div>
<div class="custom-result-value $M12A_4$"> </div>
<div class="custom-result-value $M12A_5$"> </div>
<div class="custom-result-value $M12A_6$"> </div>
</div>
</html>
</panel>
</row>
<row depends="$tok_id$">
<panel>
<title>Detail</title>
<table>
<search>
<query>index=main source="LampFailures.csv" host="DC2VPLSPSH4"
| rename "Fixture ID" as FixtureID
| table Timestamp FixtureID "MH No" "Fitting Type" Color "Lamp Power" Location Remarks
| join FixtureID
[| inputlookup RETIL_lookup
| fields - "X-Position" "Y-Position" Description]
| sort - Timestamp
| search FixtureID="$tok_id$"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<html>
<script>
require(
[
'jquery',
'splunkjs/mvc'
],
function ($, mvc) {
var unsubmittedTokenModel=mvc.Components.get("default");
$(document).on('click','div[id^="custom-result-"]',function () {
unsubmittedTokenModel.set("tokClickedValue",$(this).html());
});
});
</script>
</html>
</row>
</form>
Thanks in advance.
I have added the image for sample
... View more
04-21-2019
12:41 AM
Hi,
I created a Dashboard with status indicator, now i need to drill down on the icon.
The icon will be green and red depends on the value.
<search base="taxi">
<query>| search FixtureID="4TXC18-087AB" | rangemap field=Status low=0-0 severe=1-10| table FixtureID Status range</query>
<progress>
<set token="M12A_1">$result.range$</set>
<set token="M12A_11">$result.FixtureID$</set>
</progress>
</search>
<panel>
<title>N3A</title>
<html>
<div id="icon">
<div class="custom-result-value $N3A_1$" style="display: inline-block;padding:0px;margin:0px"> </div>
<div class="custom-result-value $N3A_2$" style="display: inline-block;padding:0px;margin:0px"> </div>
<div class="custom-result-value $N3A_3$" style="display: inline-block;padding:0px;margin:0px"> </div>
<div class="custom-result-value $N3A_4$" style="display: inline-block;padding:0px;margin:0px"> </div>
<div class="custom-result-value $N3A_5$" style="display: inline-block;padding:0px;margin:0px"> </div>
<div class="custom-result-value $N3A_6$" style="display: inline-block;padding:0px;margin:0px"> </div>
</div>
</html>
</panel>
Thanks in advance
... View more
04-11-2019
01:38 AM
@adonio
I need to be keep on posting the data to the 3rd party so that they publish to there customers
... View more
04-08-2019
12:10 AM
Hi,
I need to expose my Splunk Data to a 3rd party tool, It can collect data through REST API.
I dont want to send the raw data or the entire data, i just need to send the results after i do the all calculation.
For eg: Just to need to send the results of table.
Thanks in advance
... View more
- Tags:
- splunk-enterprise
03-24-2019
10:43 PM
1 Karma
I modified as per my requirements and it worked for me.
thanks @niketnilay
... View more
03-19-2019
01:51 AM
@niketnilay
Thanks for your comments, am trying out . will get back to you once am done
... View more
03-18-2019
01:37 AM
Hi @niketn
I have got the list of dashboard with the below query.
| rest splunk_server=local /servicesNS/-/-/data/ui/views
| search (isVisible=1 isDashboard=1 "eai:type"="html" OR "eai:type"="views" ) ("eai:acl.perms.read"="" OR "eai:acl.perms.read"="$tokRoles$") ("eai:appName"="" OR "eai:appName"="$env:app$")
| eval label= label." (".'eai:appName'.")"
| search "eai:appName"=Test_Sathya OR "eai:appName"="twitter"
| table "eai:appName" "eai:acl.perms.read" title
But now the landing page is not only show the list of dashboard, it should also link the dashboards.
Like your previous answer in the below link .
https://answers.splunk.com/answers/711988/customized-landing-page-for-splunk-applications.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
(It helped in showing the static apps and dashboard, i too created a pre build panel showing all my app and dashboards. now i need to show the apps and dashboards based on the user who login to this page)
as i mentioned earlier eg;, when a user have access to 2 apps. he should only see those 2 app in the landing page and his respective dashboards links below it .
Thanks
... View more
03-18-2019
12:28 AM
Hi Splunkers,
I Need a Landing page will show all my customized apps and the respective dashboards in it based on the user login. (role based user).
I created a Prebuild panel, which was showing all the apps and dashboard. but it doesn't show based on the role.
For eg: when a user have role for 2 apps. he should only see those 2 app in the landing page and his repective dashboards in it.
Note : Role was created each apps. few users will have 2 roles to see 2 apps.
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
03-18-2019
12:16 AM
I will suggest you to use " | fields - _raw" in your search to remove the raw data on the search time .
... View more
03-12-2019
09:23 PM
In the above link, DB connect didnt get any data and he want to Output it ,
In my scenario, am getting 80% data and 20% data getting missed
... View more
03-12-2019
02:56 AM
Hi ,
Splunk DB Connect to a oracle database and fetching the data.
When I execute the query in Splunk DB Connect it shows 30 rows as result. but in splunk search head it showing only 10 rows.
Any idea.
Note : Splunk DB Connect V2.4.1
Thanks in advance
... View more
01-31-2019
12:56 AM
Hi,
I tried but no use.
<html>
<div id="dendrogram_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{
"search": {
"type": "token_safe",
"value": "| tstats count where index=main AND source="ops_master.csv" by "Type Of Service" , "Service Name" ,"Service Name Sub Category""
},
"preview": true,
"earliest_time": {
"type": "token_safe",
"value": "$$earliest$$"
},
"latest_time": {
"type": "token_safe",
"value": "$$latest$$"
}
}'>
</div>
<div id="dendrogram" class="splunk-view" data-require="app/custom_vizs/components/dendrogram/dendrogram" data-options='{
"managerid": "dendrogram_search",
"root_label": "Index",
"margin_left": 200,
"margin_right": 0
}'>
</div>
</html>
... View more
01-31-2019
12:32 AM
Hi,
Error "No search set "
My Modified XML, -
I created the Test Dahsboard in the same Custom Viz app but still its not taking the dendrogram,js and dendrogram.css.
Help me wat i missed in it.
<form script="custom_vizs:autodiscover.js">
<label>Dendrogram test</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" searchWhenChanged="true">
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html>
<div id="dendrogram_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{
"search": {
"type": "token_safe",
"value": "| tstats count where index=main AND source="ops_master.csv" by "Type Of Service" , "Service Name" ,"Service Name Sub Category " },
"preview": true,
"earliest_time": {
"type": "token_safe",
"value": "$$earliest$$"
},
"latest_time": {
"type": "token_safe",
"value": "$$latest$$"
}
}">
</div>
<div id="dendrogram" class="splunk-view" data-require="app/custom_vizs/components/dendrogram/dendrogram" data-options="{
"managerid": "dendrogram_search",
"root_label": "Type Of Service",
"margin_left": 200,
"margin_right": 0
}">
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Dendrogram Search Results</title>
<search base="dendrogram_search"></search>
</table>
</panel>
</row>
</form>
Thanks,
... View more
- Tags:
- splunk-enterprise
11-29-2018
12:00 AM
Hi,
You can use the below regex.
systemGuid=(?.*),
It will regex till comma.
... View more
11-22-2018
04:20 AM
I checked that too, it is five years. if the retention period was problem other csv also should have been deleted
... View more
11-21-2018
10:32 PM
Hi,
I have uploaded 15 csv files in splunk from local by Add data option and view in the search.
After some days in 15 files, 4 files got deleted, I re-uploaded the files once again but still it got deleted in few days.
I couldn't find the reason. i searched whether the data got deleted in _audit but i couldn't find anything.
Thanks in Advance
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
