Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About aferone
aferone
Builder
Member since:
05-19-2011
03-03-2023
Community Statistics
| Posts | 250 |
| Solutions | 7 |
| Karma Given | 36 |
| Karma Received | 39 |
| Member Since | 05-19-2011 |
Activity Feed
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 06:50 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:58 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:51 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:41 AM
- Posted Re: Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:38 AM
- Posted Can't Extract CEF Fields in Distributed Environment on Getting Data In. 02-15-2023 05:34 AM
- Posted Re: Forwarder Management troubleshooting client errors on Deployment Architecture. 08-25-2021 06:31 AM
- Karma Re: Forwarder Management troubleshooting client errors for akocak. 08-25-2021 06:31 AM
- Posted Re: How can I find out what the deployment errors are? on Deployment Architecture. 08-25-2021 06:30 AM
- Posted Re: How can I find out what the deployment errors are? on Deployment Architecture. 08-25-2021 06:28 AM
- Karma Re: How can I find out what the deployment errors are? for whrg. 08-25-2021 06:27 AM
- Karma Re: Software versioning format for _d_. 02-11-2021 03:57 PM
- Posted Re: Software versioning format on Dashboards & Visualizations. 02-11-2021 03:56 PM
- Posted Re: Yes / No Column if EventCode Found in Lookup on Splunk Search. 11-05-2020 01:14 PM
- Posted Yes / No Column if EventCode Found in Lookup on Splunk Search. 11-05-2020 09:31 AM
- Got Karma for Why is the Splunk App for Unix and Linux generating multiple "yum" source types?. 06-05-2020 12:50 AM
- Karma Re: Still lost - Where do props and transforms go?? for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Appendcols Search Doesn't Work if No Event in Main Search? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Using a field within a log for the true timestamp for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Why is fill_summary_index failing to get list of scheduled times? for jsilverbears. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-07-2016
09:48 AM
Thanks for the answer! But how would I setup the link to a normal search like the example I have above?
... View more
04-07-2016
07:21 AM
I looked through the docs and other Splunk Answers, but it still isn't making sense to me, so please bear with me. 🙂
I have a simple "top" chart on a dashboard that lists web categories, their count, and percentage. I would like to be able to click on one of those categories and open a new search, in a new window (or tab), and insert that clicked category into a new search like this:
index=index type=type subtype=subtype action=action category=**CLICKED CATEGORY** | table _time srcip level dstip SourceZone reqtype service hostname url referralurl sentbyte rcvdbyte action msg catdesc crscore crlevel
How would I go about doing this?
Thanks for your continued, great help!
... View more
03-18-2016
09:36 AM
Every once in a while, we will get this message, and I understand it.
I would like to run a periodic search, add it to a summary index, and chart against it so that I can see when it happens historically.
I have read through some of the answers here, but I am wondering if there is just a Splunk search that will spit out the number of concurrent searches happening at that time. Does that exist? Since the error shows a number, I am assuming it is possible?
Thanks!
... View more
- Tags:
- concurrentsearch
03-08-2016
06:53 AM
Thanks for replying, but I don't think this is entirely correct. A user can see all jobs within each app they have access to. I just tested on a user. They could see jobs in "search" and a couple of other apps they have access to, but they couldn't see jobs in apps they do not have access to.
... View more
03-07-2016
09:31 AM
How is this done? I didn't see anything obvious in user access and roles.
Thanks!
... View more
03-07-2016
09:19 AM
I would like to ask the same question.
... View more
03-01-2016
07:59 AM
I added |head 1, and everything is just fine.
Thanks!
... View more
03-01-2016
07:39 AM
Thanks! This works! It just seems to take a long time to run for some reason.
... View more
03-01-2016
07:13 AM
In relation to this post:
https://answers.splunk.com/answers/209329/how-do-i-display-the-current-date-month-and-year-i.html
How would I display the PREVIOUS month on a dashboard? I have report panels that run for the previous month, and I want to show that month and year in a single value panel above each report.
Thanks!
... View more
10-22-2015
08:08 AM
I found the issue, but I am not sure why it is the answer.
These dashboards are built on summary indexes. I was using "search_name"= for the report that generates the data. I switched it to "source=", and now everything works. I had forgotten that we had this issue before, and that was the fix.
Thanks!
... View more
10-22-2015
08:07 AM
But these are dashboards that are almost a year old. They've worked with no issue until this morning.
... View more
10-22-2015
07:35 AM
That is part of the problem. There are results. When you click on 0, there are results. There wouldn't be 4 entries listed if there were 0 results.
... View more
10-22-2015
07:26 AM
All of a sudden, on only some of the charts in this dashboard, I am seeing what's in the pics attached. The data is there, and the logs are there, but the slices are not rendering in the pie charts. Has anyone seen this before?
Thanks!
... View more
10-07-2015
08:52 AM
Did this ever get resolved? I had the same question here:
https://answers.splunk.com/answers/108958/inconsistent-behavior-with-timechart-and-today-timeframe.html
Thanks.
... View more
10-01-2015
01:38 PM
Thank you! I actually did read that documentation, but it wasn't clear to me if it was referring to heavy forwarders. Thank you!
... View more
10-01-2015
01:23 PM
1 Karma
We have a relatively closed network in which we plan to collect logs from. This network resides on a larger "open" network that we don't want to have directly communicating to our internal network.
Is it possible to send logs to a Heavy Forwarder on this "open" network, to another Heavy Forwarder in our DMZ, to our indexer? I know this seems really odd (and it probably is), but I wanted to know if this is technically possible. We are trying to work around policies in our network.
Thanks!
... View more
05-08-2015
09:38 AM
Those are already set correctly.
... View more
05-08-2015
09:13 AM
It is just one lookup table. It's a csv. file. I set it up the exact same way on the search head as I did the indexer.
... View more
05-08-2015
08:41 AM
I'm not quite following.
I normally do all searches from the search head. The reason I seem to not be able to this time is because I am trying to populate a summary index that exists on our indexer.
... View more
05-08-2015
08:29 AM
I am trying to run a search that populates a summary index using a lookup.
The lookup works just fine on the search head, but the summary index I am populating resides on the indexer. So I am trying to run the search, using the lookup, from the indexer. However, the indexer is not seeing the lookup. I get the following errors:
Error in 'lookup' command: The lookup table 'nameax' does not exist.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
The permissions for both the file and the lookup definition are set to global. And I can't populate the summary index that resides on the indexer from the search head.
Any ideas?
Thanks!
... View more
04-30-2015
10:45 AM
1 Karma
This is exactly what I have for my code:
<panel>
<chart>
<title>Title</title>
<search ref="Splunk - Search"></search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.fieldColors">{"Available":0x336633,"Used":0xE60000}</option>
<option name="height">450px</option>
<option name="charting.chart.showPercent">true</option>
</chart>
</panel>
... View more
04-29-2015
07:54 AM
I am trying to use:
<option name="height">450px</option>
However, that increases the size of the panel and not the pie chart itself.
How do I increase the size of the pie chart itself?
Thanks!
... View more
03-19-2015
06:54 AM
The user does have access to the data that populates the dashboard.
... View more
03-17-2015
10:04 AM
Thanks for the answer. I;ve confirmed that the user can "open in search" and run the search, however, he only gets results in "verbose mode". He cannot see the chart being displayed, which makes this really weird.
Also, they do have enough searches in their role to run all of the panels and then some.
... View more
