Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About RiccardoV
RiccardoV
Communicator
Member since:
05-06-2013
06-05-2020
Community Statistics
| Posts | 70 |
| Solutions | 7 |
| Karma Given | 119 |
| Karma Received | 26 |
| Member Since | 05-06-2013 |
Activity Feed
- Got Karma for is there a way to retrieve splunk server installation date from internal or audit index?. 10-13-2020 06:41 PM
- Karma Re: Where do I have to install my Splunk ES addon? for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk enterprise security add-on nomenclature for esix_splunk. 06-05-2020 12:47 AM
- Karma Re: is there a way to retrieve splunk server installation date from internal or audit index? for MuS. 06-05-2020 12:47 AM
- Karma Re: Using wildcards in a search string for laithmurad. 06-05-2020 12:47 AM
- Karma How to add an external link reference into a Splunk /services/message using the Splunk REST API? for alauri. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Enterprise Security: If I add a new custom threatlist, will it match old events too or only new events after creating the threatlist? for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: How can I cache search results to avoid data recalculation? for jrodman. 06-05-2020 12:47 AM
- Karma Re: How can I cache search results to avoid data recalculation? for musskopf. 06-05-2020 12:47 AM
- Karma Re: Splunk for Enterprise Security: How can I force Splunk to check for a new version of my CSV threat lists? for bjoernjensen. 06-05-2020 12:47 AM
- Karma Re: Is my (big) csv lookup file indexed in memory by Splunk? for sowings. 06-05-2020 12:47 AM
- Karma How to use Eventgen as a security event generator for Splunk App for Enterprise Security? for dimitryz. 06-05-2020 12:47 AM
- Karma Re: How to use Eventgen as a security event generator for Splunk App for Enterprise Security? for jcoates_splunk. 06-05-2020 12:47 AM
- Karma After upgrade to Splunk Enterprise 6.3 we are receiving "Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/licenser/slaves?count=0 from server=https://127.0.0.1:8089" for peter5687. 06-05-2020 12:47 AM
- Got Karma for is there a REST API to check the Splunk system status?. 06-05-2020 12:47 AM
- Got Karma for Re: Is there any online regex tool to create regular expressions for given sample data ?. 06-05-2020 12:47 AM
- Got Karma for Re: Is there any online regex tool to create regular expressions for given sample data ?. 06-05-2020 12:47 AM
- Got Karma for Re: how to retrieve saved search properties via javascript?. 06-05-2020 12:47 AM
- Got Karma for how to retrieve saved search properties via javascript?. 06-05-2020 12:47 AM
- Got Karma for Splunk enterprise security add-on nomenclature. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 1 |
09-12-2014
04:21 AM
I need to retrieve the value from a search
... View more
09-12-2014
02:41 AM
thanks @MuS, it helps very much! I hoped in a different (and most "unique" solution) 🙂
... View more
09-12-2014
02:12 AM
1 Karma
Hi guys,
I should retrieve installation date and some other splunk server informations directly from a standard search. Is it possible?
... View more
08-28-2014
02:30 AM
2 Karma
I think that it is more a Stack Overflow question, it isn't so much related to Splunk 🙂
BTW, you can take a look here: http://www.txt2re.com/index.php3
... View more
08-26-2014
06:17 AM
1 Karma
create a searchmanager with a call to the rest api:
| rest /servicesNS/user/app_name/properties/savedsearches/saved_search_name/cron_schedule | append [ | rest /servicesNS/user/app_name/properties/savedsearches/saved_search_name/disabled ]
and it will return the two results I need
... View more
08-25-2014
08:17 AM
1 Karma
Hi,
i'm writing a SimpleXML dashboard and i want to print some properties of a saved search that I have in my app.
I import a javascript file in my dashboard that create a new savedsearchmanager:
var mySavedSearch = new SavedSearchManager({
id: "example-saved-report",
searchname: "savedsearch_name",
app: "myapp"
});
and it works fine, if I print the object in the js console I can see all the information:
console.log(mySavedSearch);
But I am not able to find two basic informations that I need:
1) is the saved search enabled or disabled? - (in the savedsearches.conf file I have disabled = 1, I want to retrieve that value)
2) How is the search scheduled? - (in the savedsearches.conf file I have cron_schedule = 0 */12 * * *, I want to retrieve that value)
... View more
07-29-2014
04:46 AM
thanks for your answer.
I tried with your solution but I see no log on the console.
When the search is done I print the properties.content and I can see here the messages array with all my errors 😞
... View more
07-29-2014
02:01 AM
Hi,
I have a dashboard like that:
<dashboard script="doSearch.js">
<label>test query</label>
<row>
<html>ciao</html>
</row>
</dashboard>
and the js file is the following, taken from the searchmanager reference:
require([
'splunkjs/mvc',
'splunkjs/mvc/utils',
"splunkjs/mvc/searchmanager",
"splunkjs/ready!"
], function (mvc) {
var deps = [
"splunkjs/ready!",
];
require(deps, function (mvc) {
var SearchManager = require("splunkjs/mvc/searchmanager");
var mysearch = new SearchManager({
id : "updatetthreatdb",
search : "| script python test_command"
});
mysearch.on('search:failed', function (properties) {
// Print the entire properties object
console.log("FAILED:", properties);
});
mysearch.on('search:progress', function (properties) {
// Print just the event count from the search job
console.log("IN PROGRESS.\nEvents so far:", properties.content.eventCount);
});
mysearch.on('search:done', function (properties) {
// Print the search job properties
console.log("DONE!\nSearch job properties:", properties.content);
});
mysearch.on('search:change', function(properties) {
console.log(properties.content);
});
});
});
the python command launches is:
import sys
import time
sys.stderr.write("hi 1\r\n")
time.sleep(5)
sys.stderr.write("hi 2\r\n")
time.sleep(5)
sys.stderr.write("hi 3\r\n")
time.sleep(5)
sys.stderr.write("hi 4\r\n")
time.sleep(5)
sys.stderr.write("hi 5\r\n")
Is there a way to get (javascript side) the stderr messages printed by the script?
thanks a lot!
... View more
thanks, I'll try asap!
... View more
07-14-2014
07:18 AM
Hi,
i'm using splunk6 and I want to add a link to the /setup page into my default.xml.
the only way I found is to add this line into the xml file:
<a href="/manager/APP_NAME/apps/local/APP_NAME/setup?action=edit">Configuration</a>
But in this way I have the app name hardcoded into the file. Does it exist a way to make the name dynamic?
I tried something like
<a href="${make_url('app/%s/?setup=1' % APP['id'])}">Configuration</a>
but with no success.
thanks
... View more
06-03-2014
01:34 AM
2 Karma
Finally I understand why it didn't working 🙂
I have to use absolute path:
import os
filepath = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP_NAME, TARGET_DIR, "test.txt")
with open(filepath, 'wb') as handle:
handle.write("test")
and it works like a charm 🙂
... View more
06-03-2014
01:04 AM
Thanks for your reply, but I still don't understand how to write a file from a python script. Where can I find my script's output?
... View more
05-30-2014
03:39 AM
Hi,
I have to schedule a script execution in my splunk app with Splunk 6.1.
I think to do that with a scheduled query, something like
| script python my_script
adding in my commands.conf file:
[my_script]
filename = my_script.py
stderr_dest = message
here is my_script.py:
with open('example.txt', 'wb') as handle:
handle.write("this is a test")
I tried to launch manually the query. It returns no errors but I can't find example.txt file. What am I doing wrong?
... View more
05-28-2014
02:16 AM
thanks for your answer, but maybe the app will be used on some splunk 6.0, I don't know exactly which version they will use!
... View more
05-27-2014
06:49 AM
grouping="2" made my day, thanks!
... View more
05-27-2014
02:03 AM
1 Karma
Hi, I am building a dashboard using Splunk 6.1.1 and Simple Xml.
I have a table like this:
<table>
<title>IP grouped by country</title>
<searchPostProcess>| stats count by country</searchPostProcess>
<option name="link.visible">false</option>
<drilldown>
<set token="categories">$row.country$</set>
</drilldown>
</table>
I have a drilldown here, and I would like to add a line saying "click on a row for more details". How can I add a text line (like a subtitle) under the title of the table? I tried with the tags <label> and <description> with no success.
thanks!
... View more
05-26-2014
01:07 AM
thanks! it works like a charm 🙂
... View more
05-23-2014
07:16 AM
Hi, I have something like this:
<form>
<label>test</label>
<searchTemplate>index=* sourcetype=$sourcetype$</searchTemplate>
<fieldset>
<input type="time">
<label>1. Select a time range</label>
<default>Always</default>
</input>
<input type="dropdown" token="sourcetype">
<label>2. Select a sourcetype</label>
<choice value="*">All</choice>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
| metadata type=sourcetypes index=* | fields sourcetype
</populatingSearch>
</input>
</fieldset>
<row>
<table>
<title>test table</title>
<searchPostProcess>
| stats count by ID
</searchPostProcess>
</table>
</row>
</form>
How can I pass the field ID to a child element, ie a graph?
I took a look at the simple drilldown table into the splunk example app but I cannot understand.
With splunk 5 I did something like
<table>
<title>test table</title>
<searchPostProcess>
| stats count by ID
</searchPostProcess>
<option name="drilldown">cell</option>
<html>
<h1>$row.ID$</h1>
</html>
</table>
but now in splunk 6 it doesn't work, it pass the value to the search app (changing the current page) and not to the HTML child element.
... View more
05-19-2014
08:43 AM
Hi,
I'm using Splunk 6.1 and I have two sourcetype for my data:
the first contains a list of events of this type
id category
the second contains events from a forwarder, and they have those fields:
id field1 field2 etc
I have to join those sourcetype, I want to draw some graphs counting how much id on the second sourcetype belong to the various categories.
Right now I have this query:
sourcetype="source2"
| table Id
| join type=inner Id [search sourcetype="source1" | table Id, category]
| table Id, category
How can I avoid to use join to improve performance?
Please note that source1 contains 12 millions of row, and it is updated daily (more or less), on the contrary source1 is updated constantly.
... View more
- Tags:
- join
- performance
02-12-2014
12:36 AM
thanks again for you answers @lguinn!
... View more
02-03-2014
07:40 AM
Edit #2: I updated again my inizial search with only streamable commands and I accelerated my search..please have a look!
... View more
02-03-2014
01:49 AM
thanks again for your reply @lguinn!
I modified my search and now I'm 100% transaction-free 🙂
I updated the search in first post!
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
