Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About smolcj
smolcj
Builder
Member since:
10-02-2012
06-05-2020
Community Statistics
| Posts | 279 |
| Solutions | 10 |
| Karma Given | 92 |
| Karma Received | 46 |
| Member Since | 10-02-2012 |
Activity Feed
- Got Karma for An error occurred while rendering the page template. See web_service.log for more details. 06-18-2020 03:04 PM
- Karma Re: Is there any application through which a .doc file can be generated for abhayneilam. 06-05-2020 12:46 AM
- Karma Re: How to decrease the Size of a single value panel? for sideview. 06-05-2020 12:46 AM
- Karma Re: sourcetype is not listing for emiller42. 06-05-2020 12:46 AM
- Karma Re: Monitor a folder for indikaw. 06-05-2020 12:46 AM
- Karma Re: How to have one or more Pulldown or TextField selections be sticky across all the views in an app for sideview. 06-05-2020 12:46 AM
- Karma Re: CLI Search is NOT exactly the same in WEB GUI for jonuwz. 06-05-2020 12:46 AM
- Karma Splunk Server performance poor for meenal901. 06-05-2020 12:46 AM
- Karma Re: renaming sourcetype for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Can we disable the inspect link from the search results ?? for jonuwz. 06-05-2020 12:46 AM
- Karma Re: Can we disable the inspect link from the search results ?? for jonuwz. 06-05-2020 12:46 AM
- Karma Re: overriding certain values in default.css with application.css for jonuwz. 06-05-2020 12:46 AM
- Karma Re: Is there any application through which a .doc file can be generated for abhayneilam. 06-05-2020 12:46 AM
- Karma Re: Diff dashboard for BobM. 06-05-2020 12:46 AM
- Karma Re: URLLoader Parameters for sideview. 06-05-2020 12:46 AM
- Karma Re: Connecting more than one view for jonuwz. 06-05-2020 12:46 AM
- Karma Re: A Quick question about Application.js for sideview. 06-05-2020 12:46 AM
- Karma Re: passing a variable/token through link search for Leo. 06-05-2020 12:46 AM
- Karma can we fill the Field Values basing on the Other Field Value ? for rakesh_498115. 06-05-2020 12:46 AM
- Karma Get full join result of two logs for foloyo1314. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
11-28-2012
04:36 AM
i am sorry for this late update,, but if there is only one value per event , then it is working,, wats wrong when extracting multiple values from same event
... View more
11-28-2012
03:55 AM
index=main source=bbb.txt field1=*| eval btime=round(b1time,2)|table field1 btime b1time
now btime firld is empty
i extracted it using MV_ADD option because all these field value come under one event i.e
[get_b1time]
REGEX=""
MV_ADD=true
it worked fine and b1time valuees are correct.
... View more
11-28-2012
03:44 AM
thanks for the response.. but how can i do drilldown for a table entry? how will i get the value for another search or link
thank u
... View more
11-28-2012
03:38 AM
hi all,
i just want to round some values in secs. i tried with round and floor options. but it is not working. i extracted this field by sing MV_ADD option..
please help
thank u
... View more
11-27-2012
11:19 PM
Hi all,
is there any option to directly list the events for a particular table entry..
after a search in dashboard using table option,,i got a table like
tablename
entry1
entry2
entry3
if i want to get the events under entry3 , obviously i will click on entry3, but it will take me to another page listing the same and again i have to click on entry 3 then the table looks like
tablename
entry3
and one more click on entry3 result in listing the events.. can't i get this in one click?
please help
thank you
... View more
11-26-2012
04:15 AM
i got the answer 🙂 i used the regex in both props.conf and transform.conf.. the field extraction defined in props.conf resulted that repeated field output.. now it is workin fine.. thanks for all the comments..
... View more
11-26-2012
03:53 AM
but only the first field in an event is repeating. all other values are fine
... View more
11-26-2012
03:23 AM
extraction is almost the same as in the other answer...
Thread\sEvent\d.[\r\n]\s+Idletime:(? \d+.\d{2})
modified transforms.conf with
[get_Busytime]
REGEX = (?im) Thread\sEvent\d. [\r\n]\s+Idletime:(? \d+.\d{2})
MV_ADD = True
and props.conf with
REPORT-Busytime = get_Busytime
hope this post will clarify it.
thank you
... View more
11-26-2012
02:52 AM
actually this link
helped.. Now my first field value is repeating twice.. can u help me to debug it..
my search | table events blabla ideletime
result is
Event1 blabla 45.56
Event1 blabla 45.56
Event4 blabla 45.58
Event1 details are repeating twice for every source file
please help
thank you
... View more
11-26-2012
12:05 AM
i am sorry ,if the question wasn't detailed. i ll explain with an example.. instead of table outputs i need my output looking like text. so what i did is, i changed background color, line color, min-width etc and it looks fine in chrome. but when i opened the same link in firefox,, the changes i made is not visible... i used inspect element option in chrome and changed default.css and view.css of the application.
... View more
11-25-2012
11:58 PM
can u explain the option FORMAT.. how to define that if we have more than one multivalued fields to extract from one event
thank you
... View more
11-25-2012
08:56 PM
i have multiple values for the same field in an event line... and only the first value is read by splunk.. why is it so?
... View more
11-25-2012
08:41 PM
Hi all,
i have changed certain html properties of my splunk page using
dashboard.html
default.html and view.html
But if i am opening them in other browsers, all the changes are not in a manner i expected.
i am using chrome and tested in firefox
please help
thank you
... View more
- Tags:
- html
11-22-2012
12:30 AM
All these values are in same event? can u give an outline of your log?
... View more
11-22-2012
12:25 AM
Sorry Rob, this is not i want. dedup is to ignore duplicate results, but what i want is the property in splunk which is the reason for IGNORING THE REPEATING RESULTS IN ONE EVENT.... i want those values in my reults, i don.t have an idea of ignoring those values.
... View more
11-21-2012
04:05 AM
Do i have to disable something to prevent ignoring multiple values from same event in splunk?
... View more
11-21-2012
03:53 AM
what is the splunk property that ignores the multiple occurences of fieldvalues in splunk.. i think that is the reason for my issue
anybody please help
thank you
... View more
11-21-2012
03:08 AM
i think the rex (?i)dataSetListCountInfo(?P [^=]+)=(?P [^ ]+)
will work
so update the search as
rex field=raw "(?i)dataSetListCountInfo(?P [^=]+)=(?P [^ ]+)" | top dataset,datacount|table dtatset datacount
Thank you
... View more
11-21-2012
02:42 AM
hi all,
i am using several single value results in my dashboard and i am using the tags.
the code sample is like this and repeated several times.
blabla
ServerName:
so my output is like
labe1:value
labelllll2:value2
la:value3
how to align it like
label : value1
labelllll2 : value2
la : value3
please help..
thankyou
... View more
- Tags:
- singlevalue
11-21-2012
02:34 AM
aleem, how u did that ? actually i am stuck with aligning those single value fields,, please help
thank you
... View more
11-20-2012
11:26 PM
Thank you bmacias84 ... it worked well
... View more
11-20-2012
12:15 AM
in dashboard also it is dispalying in different panels, how to do it in a single table.. i tried using table properties like table border='0' so that it looks as a single table. but it is not happening
... View more
11-19-2012
10:15 PM
1 Karma
hi all,
i am doing an splunk app to reduce the complexity in reading a log file. I am done with the field extractions. Now if i want to display the results of several searches in a single list or table, what shall i do? As because all these informations ae scattered in the file, t will help ohers if it is co-ordinated so,
User:username
Permission:admin
Foldername:foldername1
Servicetype:blabla
is there any way to display result extracted in different searches in a single table or list
Now i am using the search query as
index=main source=sourcename.txt|top user | table user
index=main source=sourcename.txt|top Permission | table Permission
So i am getting a number of tables, how can i make the reult view much more better..
please help
thanks for your time
... View more
- Tags:
- multiple
11-19-2012
04:20 AM
Hi all,
I am trying to extract certain fields in a log to make it easy to read. i was using and to produce it in a simple way, then i felt like using ODTS add on to create a simpler doc with very sensitive information from the logs, but whan i am trying to use the command docgen, i am getting the result as no result inspected, i tried with a simple search like index=main sourcetype=mytype | top source |docgen
anyone please help..
thank you
... View more
11-19-2012
03:28 AM
cool, now you can write a gex to replace the front slash to backslash |rex mode=sed field=source "s/\///g" i.e. "sfrontslashbackslashfrontslashfrontslashfrontslashg"
because of the formatting done by splunkbase backslash in second place i skipped.. read it and replace those words with corresponding slashes
thank you
... View more
