About mawomommoh

mawomommoh · ‎05-29-2018

Great! Thanks for the insightful explanation. Much appreciated. 🙂

mawomommoh · ‎05-27-2018

Thanks for the feedback @xpac . So from what you stated I presume the 'TO' field will contain the address of the AD group. I know Splunk has 'Email settings'. Do you know if any configurations are to be made there or it's mainly to be setup from the AD/Exchange side of things?

mawomommoh · ‎05-27-2018

I know it is possible to install a UF on the same machine as my Splunk instance as stated in these posts: 1. https://answers.splunk.com/answers/131245/running-a-universal-forwarder-on-the-same-server-as-the-enterprise-server.html 2. https://answers.splunk.com/answers/471936/install-both-universal-forwarder-and-splunk-enterp.html but I will like to know if there are notable reasons why to do so or not. - Are there any benefits to having both on the same machine or otherwise? - What is the best practice and why is that so? - Which approach is most prone to errors? Thanks in advance! 🙂

mawomommoh · ‎05-24-2018

When setting up an alert, for 'Send email' Trigger actions, is there a way to send emails to all members of an Active Directory group at once when filling out the 'To' field? Must I manually enter emails into the 'To' field or there is a way to setup sending to a list of emails?

mawomommoh · ‎03-26-2018

I tried this query again this morning and it now works in the dropdown: host=XXXX sourcetype=XXXX | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source,BuildAndDate I can't really pinpoint what exactly the solution was, but before now I deleted the BuildID field in Field Extractions, and re-extracted it from the xml file. I still tested out the query above after doing this but it did not work, but it surprisingly works this morning. The dropdown now produces the BuildAndDate field values as expected, and the new dashboard is being generated when a value is selected from the dropdown. Side note: At some point I opened two tabs of the Search & Reporting app and ran the following query: host=WP3L2M6VNX1 sourcetype=SAMBAXMLTEST | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source,BuildAndDate In one of the tabs, the BuildID field did not show up in the fields area (it was also absent is the More fields area), while in the other tab, the BuildID field showed up. Both queries were ran using the same criteria (All time) & Verbose Mode. It was strange to see that the same query ran in the same app worked in one tab and not the other. It seems part of the app was not detecting the extracted field (don't know if that's possible), but I think this may be related to the dropdown issue. Thanks so much @maciep for your assistance. 🙂 I believe you helped me drilldown to the potential cause of the issue. Thanks @Sukisen1981 for the suggestion.

mawomommoh · ‎03-23-2018

I am building the dashboard in a different app, but the BuildID is globally shared. I discovered where the issue was coming from. It had to do with the _time field. When I changed mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") to mostRecent=strftime(mostRecent, "%B %d, %Y %I:%M%p") it kind of works (It returns the values for the BuildID in the dropdown). So this works: | stats count by source, BuildID but this still doesn't work: | stats count by source, BuildAndDate . Any thoughts?

mawomommoh · ‎03-23-2018

Yes, this works: host=XXXX sourcetype=XXX| eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source but whenever I put in the BuildAndDate or BuildID field in the stats command, it doesn't work. For instance, this doesn't work: host=WP3L2M6VNX1 sourcetype=SAMBAXMLTEST | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source, BuildAndDate This also doesn't work: host=WP3L2M6VNX1 sourcetype=SAMBAXMLTEST | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source, BuildID These two queries (which don't work) work fine in the Search & Reporting App, it only fails to work when I insert it in the Search criteria in the dropdown.

mawomommoh · ‎03-23-2018

Thanks, but it still doesn't work. Quite strange.

mawomommoh · ‎03-23-2018

Yes, you're right. That's basically what I am trying to accomplish. I replaced the last stats as you said, and it returns the expected result in the Search app, however when I insert the same search query in the Search found in the dropdown, I get a message saying 'Search produced no results', so the dropdown is not being populated. Any idea why the search does not work in the dropdown?

mawomommoh · ‎03-22-2018

I am getting my events from an xml file. In that xml file, there is tag which gives the BuildID of a software. For instance: <BuildID>SoftwareBuildVer.2.0.6</BuildID> . I have been able to extract the SoftwareBuildVer.2.0.6 as a BuildID field in Splunk using regex. I want to be able to use BuildID + DateTime of the file creation to uniquely identify the source in Splunk. I have been able to create a final field, BuildAndDate, which has values that looks like this: SoftwareBuildVer.2.0.6 March 22, 2018 12:05PM . I plan on using the values in this field in a dashboard dropdown menu so that when a user selects a particular BuildAndDate value from the dropdown, the source which contains that particular BuildID is returned, and a new dashboard is generated based on the newly determined source value. Here is my simple xml for the dashboard (changes in dropdown to use BuildAndDate field has not been added yet): <form> <label>XXXX_Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="source_tok" searchWhenChanged="true"> <label>Selected BuildID/DateTime</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>| tstats max(_time) AS mostRecent where host=XXXX sourcetype=XXXX groupby source, sourcetype, host| sort -mostRecent | fields source | rex mode=sed field=source "s/(\\\)/\1\1\1/g"</query> <earliest>0</earliest> <latest></latest> </search> <prefix>source="</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <html depends="$alwaysHideCSSOverride$"> <style> .select2-container .select2-choice {width: 520px;} .select2-drop .select2-search {width: 528px; background-color: white;} .select2-drop .select2-results {width: 528px;} .select2-drop-active {width: 530px !important;} .select2-container-active {width: 530px !important;} .splunk-status-indicator { border-radius: 15px !important; border: 2px solid white; font-size: 10px !important; line-height: normal !important; white-space: normal !important;  overflow-x: hidden !important; display: flex; justify-content: center; align-items: center; word-break: break-word; padding: 3px; } div.facet-label { visibility: hidden !important; } div.viz-facet {  padding:0 !important; height: 30% !important; width: 5% !important; margin: 0 15px 15px 0 !important; } div.facets-container {  background-image: url("/static/app/status_indicator_app/images/arrow.png"); background-repeat: no-repeat; background-size: 100% 45%; margin-top: 55px; } </style> </html> </panel> </row> <row> <panel> <viz type="status_indicator_app.status_indicator"> <search> <query>host=XXXX index=XXXX $source_tok$ | eval NewTime=strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N") | eval _time=NewTime | eventstats max(_time) AS latestScan by Description | where _time=latestScan | stats count by StepResult, Description | eval color=case(StepResult=="Passed","green",StepResult=="Skipped","gold", StepResult=="Failed","red") | eval StepResult = Description</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="drilldown">none</option> <option name="height">275</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.fixIcon">check</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">1</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option> <option name="trellis.enabled">1</option> <option name="trellis.size">small</option> <option name="trellis.splitBy">Description</option> </viz> </panel> </row> </form> The dashboard currently works, but it directly makes use of the source in the dropdown. I want the BuildAndDate to be what shows up in the dropdown, and it should be used to determine the source which is then used to produce the new dashboard. The issue I am having is mapping the BuildAndDate to its source, and the source then displaying all events in the source based on that. RIght now, clicking on a BuildAndDate value only returns one event, i.e. one line in the xml file ( <BuildID>SoftwareBuildVer.2.0.6</BuildID> ) instead of returning all the events in the xml in which <BuildID>SoftwareBuildVer.2.0.6</BuildID> is contained in. This query produces the BuildAndDate field and value as expected: host=XXXX sourcetype=XXXX | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats values(BuildAndDate ) as BuildAndDate Goal: Click on BuildAndDate value in dropdown and generate new dashboard via that selection. Any help would be appreciated. Thanks in advance.

mawomommoh · ‎03-14-2018

This works well. Thanks! The next thing is to carry out the drill down (you can see my reply to richgalloway's answer below). If you have any ideas pertaining to that, it would be much appreciated. Thanks once again.

mawomommoh · ‎03-14-2018

Great! These queries show me the list of my files. Thanks. Regarding how my sources map to dashboards: - I have a drop folder on my machine with a universal forwarder monitoring it. - I currently have a dashboard in the Status Indicator app which makes use of the data from the latest file that has been forwarded from my drop folder. So when a new xml file is dropped into that folder, and it gets forwarded to Splunk, the dashboard updates using the latest info. This is the query I use for the dashboard in the Status Indicator app: host=XXXX index=XXXX | eval NewTime=strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N") | eval _time=NewTime | eventstats max(_time) AS latestScan by Description | where _time=latestScan | stats count by StepResult, Description| sort Description | eval StepResult = Description This is how my sources are being mapped to the dashboard. File > Drop folder > File forwarded to Splunk > Dashboard updates based on query At the moment, I have included a time picker to the dashboard so I can switch between the latest dashboard being displayed to the previous dashboards i.e. previous forwarded source files (using a date/time range), but this is a bit tedious because I always need to know the date/time of the source file (dashboard) I would like to view. With the list of source files being displayed for that specific host and index, I would like to be able to drill down to the Status Indicator dashboard of a specific source file when I click on it from the list.

mawomommoh · ‎03-13-2018

I have multiple xml files which have been forwarded to Splunk from my machine. Each file has its own data which is used to create a dashboard using the Status Indicator app. My goal is have a centralized location in Splunk such that I can see all the files that have been forwarded to Splunk (a list) and when I click on each file in the list, it should take me to the dashboard unique to that specific file. Is there a way that this can be done in Splunk? Is there any place I can view the list of forwarded items in Splunk which can help me for this purpose?

mawomommoh · ‎03-08-2018

I am making use of the Status Indicator App to create a dashboard which shows if steps in a process Passed, Skipped or Failed. I get my events from an xml file and I have been able to create the dashboard successfully with each step in the xml being reflected in the dashboard with their corresponding StepResult. I am trying to sort the order of events showing in the dashboard based on the timestamp gotten from each step in the xml. Using my search query, the events are sorted properly when viewed in the Events and Statistics tab, but when I use the same search query in the Status Indicator App for my dashboard, the events become ordered alphabetically instead of using the timestamp I have extracted (StartTime). Any idea why the sort stops working when I insert the same search query in the Status Indicator App dashboard? Here is my search query: host=XXXX index=XXXX | eval NewTime=strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N") | eval _time=NewTime | eventstats max(_time) AS lastestScan by Description | where _time=lastestScan | stats count by StepResult, Description, _time| sort _time | eval color=case(StepResult=="Passed","green",StepResult=="Skipped","gold", StepResult=="Failed","red") | eval StepResult = Description Also, the colors for each step no longer show, but when I get rid of the _ time field in the stats command, the colors work again. Any assistance would be appreciated. Thanks in advance.

mawomommoh · ‎03-07-2018

It worked. Thanks! Yes, based on what I am working on I need those two fields to have the same value. You can add your answer so I give you credit. Thanks for the assistance once again. 🙂

mawomommoh · ‎03-07-2018

Oh, I see. I am expecting sorting based on _time field in the Statistics tab. How do I go about that?

mawomommoh · ‎03-07-2018

This is my current search: host=XXXX index=XXXX | eval NewTime=strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N") | eval _time=NewTime | sort _time| eventstats max(_time) AS lastestScan by Description | where _time=lastestScan | stats count by Description, StepResult| eval color=case(StepResult=="Passed","green",StepResult=="Skipped","gold", StepResult=="Failed","red") | eval StepResult = Description 'StartTime' is the extracted field from the xml. It sorts fine in the Events tab but not in the Statistics tab.

mawomommoh · ‎03-07-2018

I have an xml containing steps with timestamps. When I run a search, I am able to sort the events based on the timestamps I have extracted from the xml. In the Events tab, my xml steps sort properly based on the timestamp, but when I switch to the Statistics tab, my xml steps(events) appear in alphabetical order instead of sorting based on the timestamp. Why does the sort work when in the Events tab but not when in the Statistics tab when the search query is the same? Any help will be appreciated. Thanks

mawomommoh · ‎01-26-2018

I just need to get a key:value pair of the Description and the StepResult of this portion of the file in the order they appear: <Steps> <Step xsi:type="xxx" Description="Survey" StepResult="Passed" /> <Step xsi:type="xxx" Description="Analyze survey" StepResult="Passed" /> <Step xsi:type="xxx" Description="Extract data" StepResult="Skipped" /> <Step xsi:type="xxx" Description="Analyze data" StepResult="Passed" /> <Step xsi:type="xxx" Description="Combine data from various sources" StepResult="Passed" /> <Step xsi:type="xxx" Description="Deliver results" StepResult="Failed" /> <Step xsi:type="xxx" Description="Get feedback" StepResult="Passed" /> <Step xsi:type="xxx" Description="Process feedback" StepResult="Passed" /> <Step xsi:type="xxx" Description="Make improvements" StepResult="Passed" /> </Steps> So in essence, the Description and StepResult will be field names (in a tabular form) made up of the field values appearing in the same order shown in the file. The order is determined by the Description (not alphabetically, but as in the file).

mawomommoh · ‎01-26-2018

Yes, the data has steps within steps.

mawomommoh · ‎01-25-2018

I have an XML file which is in this format: <?xml version="1.0"?> <EvaluateMethods xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <DataCollectionMethods> <DataCollectionMethod Description="xxx" StepResult="Passed"> <Steps> <Step xsi:type="xxx" Description="Dataxxx" StepResult="Passed"> <Steps> <Step xsi:type="xxx" Description="Survey" StepResult="Passed" /> <Step xsi:type="xxx" Description="Analyze survey" StepResult="Passed" /> <Step xsi:type="xxx" Description="Extract data" StepResult="Skipped" /> <Step xsi:type="xxx" Description="Analyze data" StepResult="Passed" /> <Step xsi:type="xxx" Description="Combine data from various sources" StepResult="Passed" /> <Step xsi:type="xxx" Description="Deliver results" StepResult="Failed" /> <Step xsi:type="xxx" Description="Get feedback" StepResult="Passed" /> <Step xsi:type="xxx" Description="Process feedback" StepResult="Passed" /> <Step xsi:type="xxx" Description="Make improvements" StepResult="Passed" /> </Steps> </Step> </Steps> <Start>2022-09-05T99:64:73.0990042+22:00</Start> <Files /> </DataCollectionMethod> </DataCollectionMethods> </EvaluateMethods> There are no timestamps to the steps. After adding the file to splunk, the events (comprising of the Description and StepResult) appear in alphabetical order (using the Description) when I do a splunk search. How do I order the output of my search to appear in the same order they were in the XML file (i.e. how can I make the result of my search to be displayed step-by-step as contained in the XML file?)... Thanks

mawomommoh · ‎01-23-2018

Wow! Thank you so much @niketnilay . It worked! I really appreciate the help 🙂

mawomommoh · ‎01-23-2018

Thanks @niketnilay. Here is a more detailed explanation of the problem and what I am trying to achieve: https://answers.splunk.com/comments/613505/view.html

mawomommoh · ‎01-23-2018

I am using the Status Indicator Visualization App. I am trying to manipulate the Simple XML of the dashboard created by this app. See my response to @493669 (https://answers.splunk.com/comments/613505/view.html) for a more detailed explanation of the problem and what I am trying to achieve. Thanks in advance!

mawomommoh · ‎01-23-2018

Here is the simple xml I am trying to manipulate (from the 'Source' Edit dashboard option): <dashboard stylesheet="xxx.css" script="xxx.js"> <label>xxxReport</label> <row> <panel> <html depends="$alwaysHideCSSOverride$"> <style> .splunk-status-indicator { border-radius: 35px !important; } </style> </html> </panel> </row> <row> <panel> <viz type="status_indicator_app.status_indicator"> <search> <query>source="xxx" host="xxx" index="xxx_xml" sourcetype="xml" | stats distinct_count(Result) by Action, Result | eval color=case(Result=="Passed","green",Result=="Skipped","gold", Result=="Failed","red")</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="height">500</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.fixIcon">check</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">1</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">small</option> <option name="trellis.splitBy">Action</option> </viz> </panel> </row> </dashboard> Here is a sample out of how the dashboard appears based on the xml above: Status Indicator Dashboard when split by Action: https://ibb.co/dRP1Ob What I want to achieve: Instead of the values of the Result field (e.g. 'Passed', 'Skipped') being displayed in the boxes in the dashboard, I want to display the values of the Action field (e.g. 'Place order', 'Call customer',etc) in those boxes dynamically based on the results of my query. If I split by the Result field, the dashboard appears like this: Status Indicator Dashboard when split by Result: https://ibb.co/n1Gnww The final goal is that the dashboard should appear something like this: Status Indicator Final Goal: https://ibb.co/hVJQGw I hope this clarifies things better. Thanks in advance!

Posts	54
Solutions	0
Karma Given	16
Karma Received	2
Member Since	‎01-14-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do I forward latest file from group of files?

How do I exclude WinEventsLog:Application files fr...

How can a forwarder monitor a dynamic path?

Why are my credentials not working when I run Splu...

Forwarder refusing to start

Why do I keep getting 2 email notifications for 1 ...

Is there a way to use TFS for version control in S...

Why is my server name not displayed as host?

What are the pros and cons of installing a UF on s...

Is there a way to send email notifications to all ...

Re: Is there a way to send email notifications to ...

Re: Is there a way to send email notifications to ...

What are the pros and cons of installing a UF on s...

Is there a way to send email notifications to all ...

Re: How to display all events of a source if the s...

Re: How to display all events of a source if the s...

Re: How to display all events of a source if the s...

Re: How to display all events of a source if the s...

Re: How to display all events of a source if the s...

How to display all events of a source if the sourc...

Re: Is there a way to have a list of forwarded fil...

Re: Is there a way to have a list of forwarded fil...

Is there a way to have a list of forwarded files i...

Status Indicator App: Why are Sort and Color not s...

Re: Why is the event sort not reflecting in Statis...

Re: Why is the event sort not reflecting in Statis...

Re: Why is the event sort not reflecting in Statis...

Why is the event sort not reflecting in Statistics...

Re: How can I order events based on how they appea...

Re: How can I order events based on how they appea...

How can I order events based on how they appear in...

Re: Status Indicator App: How do I access search r...

Re: Status Indicator App: How do I access search r...

Re: Status Indicator App: How do I access search r...

Re: Status Indicator App: How do I access search r...

Join the Conversation