About PowerPacked

PowerPacked · ‎07-12-2018

Hi @ejespiritu Take a look at the Delete command, here is the link. https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete You can make this as a scheduled search, make it run frequently to delete the data. & another thing to remind of is, you need to have delete permissions enabled for you role to delete the data from index ( delete permissions are separate from admin permissions ) Thank you

PowerPacked · ‎07-11-2018

Hi @ richnavis Take a look if by adding this line to severclass.conf works for you. excludeFromUpdate = location of your app. Thanks

PowerPacked · ‎07-10-2018

Ok, check if one of the instance ( search head ) has more number of extracted fields and showing up in the results & also inspect both the search jobs by going into -- job --- inspect job when the searches finishes. from the inspect job you can actually compare between the both jobs to see, which part of the job is making it to occupy more space. Thanks

PowerPacked · ‎07-10-2018

Hi @ksharany Take a look at this. Thanks

PowerPacked · ‎07-10-2018

Hi @navd Am not sure, if i understood your question correctly, index=abc | timechart span=5m count(server_error) by host. change the span to needed like 1m,5m,10m,1h,1d. Thanks

PowerPacked · ‎07-10-2018

Hi @skoelpin Servicehealthscore is a KPI which is calculated based on the severity level and importance of all remaining KPI's existing in the same sercvice at that time. Servicehealthscore is a score from 0 (critical) to 100(normal) --- calculation formulae = [weighted alert levels] / Σ [importance weights] example: KPINAME - ALERTSEVERITY - IMPORTNANCE kpi1 - low - 10 kpi2 - high - 5 servicehealthscore = (70*10) + (30*5) / 10 + 5 Alert Severity and its scores are: Normal - 100, Low- 70, Medium - 50, High - 30, Critical - 0. so to say, when you did a backfill of all the kpis, they dont have a Threshold & Importnace set & servicehealthscore can't be calculated at that time. Thanks

PowerPacked · ‎07-09-2018

Hi meenu_2017 are Instance 1 & Instance 2 - SH Clustered ? if they are not clustered, can be many reasons - permissions, distributed search groups, time zones, etc. if they are clustered, are you running the search from individual search head url or load balancer url. Thanks

PowerPacked · ‎07-09-2018

Hi @Cuyose check if the events are going to the default -- main index. & u can see in - settings - data - indexes - your indexname --- & see if it recieved any events. & also settings - data - data inputs - HTTP Event Collector - to see what was the index & token & many other settings. Thanks

PowerPacked · ‎07-09-2018

You can call the tokens in the first panel search by |App1 Availability | App2 $tokenpanel2$ | App3 $tokenpanel3$ | App4 $tokenpanel4$ forgot, missed the dollar signs around the token. Thanks

PowerPacked · ‎07-06-2018

Hi @ cmcdole Use this search in panel2, panel3 & panel4 to get the token values - tokenpanel2, tokenpanel3,tokenpanel4. <search> <query>|Field 1 Field2 Availability</query> <earliest>-15m</earliest> <latest>now</latest> <finalized > <condition match=" 'job.resultCount' != 0"> <set token="tokenpanel2">$result.Availability$</set> </condition> </finalized > </search> Do the same for panel3, panel 4 and get tokenpanel3,tokenpanel4. now in the panel1, you can do |App1 Availability | App2 tokenpanel2 | App3 tokenpanel3 | App4 tokenpanel4| Thanks

PowerPacked · ‎07-06-2018

Hi @sandyIscream Can you try charting.fieldcolors like this. <option name="charting.fieldColors"> {"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x009900, "NULL":0xC4C4C0} </option> Thanks

PowerPacked · ‎07-06-2018

Hi @nasrinmulani In the above case, Laptop-CPU & Laptop-Performance should be considered as entities of Laptop. in either bulk import or single creation, you will have option of service dependency tree. from where you can configure whih entities are treated as sub services under main service. & coming to service health of main service always depends on service health of sub services. ------ service health score of sub services are considered as kpis of importance of 11 in main service. ---- if any of the sub services fails the main service automatically turns into critical. Have a look at these docs. https://docs.splunk.com/Documentation/ITSI/3.1.1/Configure/Addservicedependencies Thanks

PowerPacked · ‎07-06-2018

Hi @bondmar30 I gave it a try in my environment, it shows the same empty list. I feel like many of the endpoints which are listed in the ITSI REST API doc are broken & not working as expected. Have a look at this query by me. https://answers.splunk.com/answers/668250/create-new-itsi-glass-table-through-rest-api-call Splunk should do some kind of action untill next patch as these are limiting the power of ITSI. Please try to raise a ticket with splunk if possible. Thanks

PowerPacked · ‎07-05-2018

extra space was added in | eval Date=strftime(_time," %a") try taking out the space as this ---- | eval Date=strftime(_time,"%a") Thanks

PowerPacked · ‎07-05-2018

Hi @HattrickNZ give this a try <dashboard> <label>check123</label> <search> <query>|makeresults | eval Date=strftime(_time," %a") | table Date</query> <earliest>-15m</earliest> <latest>now</latest> <finalized > <condition match=" 'job.resultCount' != 0"> <set token="Date">$result.Date$</set> </condition> </finalized > </search> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="select_wday"> <label>Select Day:</label> <choice value="Mon">Mon</choice> <choice value="Tue">Tue</choice> <choice value="Wed">Wed</choice> <choice value="Thu">Thu</choice> <choice value="Fri">Fri</choice> <choice value="Sat">Sat</choice> <choice value="Sun">Sun</choice> <default>$Date$</default> </input> </fieldset> </dashboard> Thanks

PowerPacked · ‎07-05-2018

Hi Adding new answer, as i cant post image in comments. Thanks

PowerPacked · ‎07-05-2018

Hi @bschaap Take a look at this if you want to do it in rex command: java.io.IOException:(?P<fieldname>.*?) at Thanks

PowerPacked · ‎07-03-2018

Hi @shreyad I believe whole Pie is considered as 100% in which each value takes some percentage by calculating its quantity on the whole. bringing pieces from individual queries should not be the case. Thanks

PowerPacked · ‎07-02-2018

Hi @I868162 Please add limit=0 to your chart query, & also do useother=f usenull=f if needed. Thanks

PowerPacked · ‎06-29-2018

Hi @ jluo [Splunk] you can use itsi_entity.py file in /SA-ITOA/lib/itsi/objects & itoa_object.py file in /SA-ITOA/lib/ITOA to make a script which can perform actions for you. Thanks

PowerPacked · ‎06-29-2018

Hi @hjauch Thanks for the reply, I was able to update, delete the glass table using the same end point, but am not sure why only create is not working. if possible, please provide with a work around untill a new patch is released. Thank you

PowerPacked · ‎06-29-2018

Please, Can someone from Splunk answer this question Thanks

PowerPacked · ‎06-29-2018

Hi @vicky05ssr If you only want the rest call way, Here is the query. | rest splunk_server=local servicesNS/nobody/SA-ITOA/itoa_interface/service fields="title,_key,kpis._key,kpis.title" Thanks

PowerPacked · ‎06-28-2018

Hi Guys I would like to create new glass tables through Rest API calls - but am failing as am not able to pass proper arguments needed for POST action of API call of ITSI glass table. for example: curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity -H "Content-Type: application/json" -X POST -d '{"component": ["PerProcess"],"informational": {"fields": ["info"],"values": ["field"]},"_version": "3.0.0","title": "PerProcess","object_type": "entity","_type":"entity","identifier": {"fields": ["component"],"values": ["PerProcess"]}}' This above call creates a new Entity in ITSI through Rest API call which is given in this doc http://docs.splunk.com/Documentation/ITSI/3.0.1/RESTAPI/ITSIRESTAPIreference i would like to create a new Glass Table in this way. Help is appreciated Thanks

PowerPacked · ‎06-28-2018

Hi @ nadlurinadluri you can create a static folder in apps folder of the app and put the images there. check your $splunkhome$/etc/apps/search/static/ folder to have an idea of what file images need to placed. Thanks

Posts	161
Solutions	19
Karma Given	2
Karma Received	34
Member Since	‎02-14-2018

Online Status	Offline
Date Last Visited	‎05-19-2022 10:05 PM

InsecureRequestWarning in splunkd.log from Splunk ...

Difference between (_time) internal field and (tim...

In Splunk IT Service Intelligence(ITSI), how do I ...

use of eval statement in tokens evaluation

Create new ITSI Glass Table through - Rest API cal...

SSL Error for Connection between Forwarder and Ind...

What is this (search_startup_time) field in _audit...

How to measure Execution Latency of Ad-hoc Searche...

Where or into which System Index - Does Splunk wr...

Where are Glass tables Tables saved location which...

Re: How to delete all data of index using python?

Re: How to manually deploy splunk app on deploymen...

Re: Why would a same search running on 2 different...

Re: extract characters after colon

Re: How to plot a chart or graph based on the numb...

Re: How to backfill a ServiceHealthScore in ITSI?

Re: Why would a same search running on 2 different...

Re: Events posted to HEC successfully, not showing...

Re: How do I show results from a panel in another ...

Re: How do I show results from a panel in another ...

Re: How to give specific color for each dot in Spl...

Re: How to Create sub Services in Splunk ITSI

Re: How do I list ITSI correlation searches in jso...

Re: How to control the default in a dropdown menu

Re: How to control the default in a dropdown menu

Re: Regex Help

Re: Regex Help

Re: Pie chart from multiple queries

Re: Adding more rows in the trellis single-value c...

Re: Scripted option for deleting all entities in I...

Re: Create new ITSI Glass Table through - Rest API...

Re: Create new ITSI Glass Table through - Rest API...

Re: Is there a way to list all the Services and it...

Create new ITSI Glass Table through - Rest API cal...

Re: Adding a icon (image) in the navigation menu

Are you a member of the Splunk Community?