About smolcj

smolcj · ‎01-23-2013

change the same in default.css. it will reflect in all the app in the instance

smolcj · ‎01-23-2013

7000 when i am trying this option under showsource module i am getting a statement like Show source not available for this event.. Any thoughts please help

smolcj · ‎01-22-2013

hi, i am trying to open the drilldown link of the chart to another window. but it is drilling own as a normal drilldown idex=main sourcetype=mylog $foo$| chart count over severity | eval dred=if(severity=="FATAL",count,0)| eval red=if(severity=="ERROR",count,0)| fields - count column stacked {"dred":0xFF0000,"red":0xF62217} none 100% /app/myApp/flashtimeline?q=index=main sourcetype=mylog $foo$|search severity=$click.value$ | sort - _time flashtimeline True please help Thank you

smolcj · ‎01-22-2013

can be done in advanced XML <![CDATA[ hr br ]]>

smolcj · ‎01-22-2013

Version 5.0.1..

smolcj · ‎01-21-2013

It is sid=$results.sid$ in side view 🙂 check out host:port/en-US/app/sideview_utils/custom_keys Thanks for your valuable time

smolcj · ‎01-21-2013

hi, the default number of events displayed in show source are 25,50,100,200,500,1000. Can i change it so that i can see all the events in my source file,there are nearly 7000 events in my source file. i tried changing the static options defined in Show_source view. but is of no change, can somebody help me. Please help Thank you

smolcj · ‎01-21-2013

HI , Even if i just started my splunk instance, my views are loading with this error. I am sure that only one search is currently running. How can i troubleshoot this? Please help Thank you

smolcj · ‎01-17-2013

hi, is it possible to keep a link to the raw log file in splunk? if user want to see the file in it's exact format. How to show the url source file in showsource option? how to get sid of the file? Scenario is like, i have a dshboard with a pull down box that populating sourcefilenames and the dshboard is in sideview advanced XML. i have created an Html module like this <module name="HTML" layoutPanel="panel_row1_col1"> <param name="html"> <![CDATA[<p> View Your Source File <a href="http://myhostname:8000/en-US/app/myapp/show_source?sid="$.info_search_id.$"&offset=0"> here </a></p>]]> </param> </module> the issue i am facing is .info_search_id. is not passing any value to the url, i tried info_id also.. Please help Thank you

smolcj · ‎01-17-2013

both are giving same rsult. how to remove that checkox input from there?

smolcj · ‎01-17-2013

so a wildcard idea is not possible here?

smolcj · ‎01-17-2013

hi, how can i disable the option displayRowNumbers in simpleresulttable. i am able to do it in simple xml but not in advanced xml. am i missing something. i was using this code for the same, but i am getting a check box with it. i dont want a check box in my view... please help . <module name="RowNumbers"> <module name="SimpleResultsTable"> <param name="displayRowNumbers">False</param> <param name="count">14</param> <param name="entityName">results</param> <param name="drilldown">row</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> Please help Thank you

smolcj · ‎01-16-2013

hi, for changing the color of a field we can change the css to .Table tr.informational td { background-color:#72c72d; color:#fff; } what if the field name is having some space or if we have to add a wild card in the field value like .Table tr.informational 1 td { background-color:#72c72d; color:#fff; } why i need wildcard because it can be informational 2 informational 3... etc.. something like info*.. is it possible? Please help Thank you

smolcj · ‎01-16-2013

what if the field name is having some space or if we have to add a wild card in the field value like .Table tr.informational 1 td { background-color:#72c72d; color:#fff; } why i need wildcard because it can be informational 2 informational 3... etc.. something like info*.. is it possible?

smolcj · ‎01-10-2013

hi is it possible for me to monitor and index a file situated in remote unix server in my windows7 5.x splunk instance. thank you

smolcj · ‎01-09-2013

hi , Nick's sideview have an answer for this . here is the answer thanks for all your assistance

smolcj · ‎01-09-2013

database that consists of uploaded log files which are cetegorized using perl script

smolcj · ‎01-08-2013

hi if i have my datainputs stored in a repository how can i index those files to my splunk instance automatically,i.e. whenever a new file is added to repository ?. do i have to use real time search panels? pls help thank you

smolcj · ‎01-08-2013

hi, how to create an automatic sourcetype, which is not there in the splunk list ? how we can define the regex so that automatically splunk identifies the sourcetype and index. pls help thanks

smolcj · ‎01-04-2013

i have taken a backup of my app and uploaded in another splunk instance(free license). when i am ttrying to add datainputs it is not listing the sourcetype, when i am trying to create the same sourcetype, it is specifying as already existing. i am not able to add data inputs. how to resolve this issue? Please help Thank you

smolcj · ‎01-04-2013

Ya, you are right nick, in simple XML we have an option like THREAD DURATION: this is what i meant

smolcj · ‎01-04-2013

thank you Nick,Really helped me. is it possible to add a table name in side view table modules? or do i have to use html panel for the same? Thank you

smolcj · ‎01-02-2013

hi , i want to rename the sourcetype of my app. when i searched splunk docs i came to know that there is an option called rename to do this, but "The indexed events still contain the original source type name. The renaming occurs only at search time. " i dont want to keep old name of the sourcetype. how can i completely replace oldsourcetypename to newsourcetypename. please help thank you

smolcj · ‎12-30-2012

thanks jonuwz, but the size of the result value of single value panel is 28px, how to change it to 14px.

smolcj · ‎12-28-2012

yes i did that also. actually the application.css file was not new . but no change

Posts	279
Solutions	10
Karma Given	92
Karma Received	46
Member Since	‎10-02-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Is it possible in Splunk to trigger a search, gene...

Comparing data from two log files and displaying ...

Full outer join

Dynamic column name

Diff dashboard

convert date time to epoch time for sorting

PRINT AND SAVE AS PDF SKIPS HALF THE OUTPUT

Remove empty panels after a search

coloring pie chart

can we use semicolon instead of comma in MVZIP

Re: how do I change the Splunk logo in Splunk Web?

Re: no of events in show_source view

Popup option not working for chart

Re: Horizontal line

Re: no of events in show_source view

Re: raw log link in Splunk dashboard

no of events in show_source view

The maximum number of historical concurrent system...

raw log link in Splunk dashboard

Re: displayRowNumbers in SimpleResultsTable

Re: coloring a row based on field value(with a wil...

displayRowNumbers in SimpleResultsTable

coloring a row based on field value(with a wildcar...

Re: Colorize SimpleResultsTable rows based on fiel...

monitor a folder in remote unix server

Re: Connecting more than one view

Re: reading from a repsitory

reading from a repsitory

creating automatic sourcetype

sourcetype is not listing

Re: How to have one or more Pulldown or TextField ...

Re: How to have one or more Pulldown or TextField ...

renaming sourcetype

Re: overriding certain values in default.css with ...

Re: overriding certain values in default.css with ...

Join the Conversation