Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About navd
navd
New Member
Member since:
01-30-2018
06-05-2020
Community Statistics
| Posts | 58 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-30-2018 |
Activity Feed
- Posted Query to alert when no results found on Alerting. 05-20-2019 06:38 AM
- Posted Re: How do you send an alert when the number of records goes below 20% of the daily avg? on Splunk Search. 01-25-2019 09:28 AM
- Posted How do you send an alert when the number of records goes below 20% of the daily avg? on Splunk Search. 01-25-2019 06:27 AM
- Tagged How do you send an alert when the number of records goes below 20% of the daily avg? on Splunk Search. 01-25-2019 06:27 AM
- Posted Re: Is it possible to not limit the bars in bar chart ?? on Dashboards & Visualizations. 09-19-2018 01:22 PM
- Posted Is it possible to not limit the bars in bar chart ?? on Dashboards & Visualizations. 09-19-2018 11:57 AM
- Posted How do I make it so links only display when clicking on the h1 tag? on Dashboards & Visualizations. 09-17-2018 09:22 AM
- Tagged How do I make it so links only display when clicking on the h1 tag? on Dashboards & Visualizations. 09-17-2018 09:22 AM
- Posted Re: How do you display response time results sorted in descending order ? on Splunk Search. 09-10-2018 08:09 AM
- Posted How do you display response time results sorted in descending order ? on Splunk Search. 09-10-2018 07:18 AM
- Tagged How do you display response time results sorted in descending order ? on Splunk Search. 09-10-2018 07:18 AM
- Posted Re: How to round a number when displaying results in a chart? on Splunk Search. 09-07-2018 06:56 AM
- Posted How to combine two field results into single field permanently ? on Splunk Search. 09-06-2018 12:19 PM
- Posted Re: How to round a number when displaying results in a chart? on Splunk Search. 08-20-2018 11:11 AM
- Posted Re: How to round a number when displaying results in a chart? on Splunk Search. 08-20-2018 09:15 AM
- Posted How to round a number when displaying results in a chart? on Splunk Search. 08-20-2018 07:28 AM
- Tagged How to round a number when displaying results in a chart? on Splunk Search. 08-20-2018 07:28 AM
- Posted Re: What is the difference between extracting field from an event and extracting a field using regex in a search? on Splunk Search. 08-14-2018 12:22 PM
- Posted What is the difference between extracting field from an event and extracting a field using regex in a search? on Splunk Search. 08-14-2018 11:17 AM
- Tagged What is the difference between extracting field from an event and extracting a field using regex in a search? on Splunk Search. 08-14-2018 11:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-08-2018
08:49 AM
I want to find number of 500 , 200 , 300 error present in the logs . I have already fields extracted for error_code
so I am doing something like this index="abc" |stats count(eval(error_code=502)) AS error_code which is working but how do I include in query for other error codes ?
... View more
- Tags:
- splunk-enterprise
05-31-2018
10:51 AM
I have tried with the code you provided , but ALL option isn't working , below is my sample xml for my entire dashboard . let me know if I am missing anything here .
<form>
<label>My test dropdown</label>
<search id="baseSearchHostFilter">
<query>| tstats count where index="abc" AND host=*$service$* AND host=*$env$* by host
| stats values(host) as host
| nomv host
| eval host=replace(host," ",",")
| table host
<earliest>-7d@h</earliest>
<latest>now</latest>
<done>
<set token="tokAllFilteredHosts">$result.host$</set>
</done>
<input type="dropdown" token="service" searchWhenChanged="true">
<label>Select service</label>
<choice value="service1">service1</choice>
<choice value="service2">service2</choice>
<fieldForLabel>service</fieldForLabel>
<fieldForValue>service</fieldForValue>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Select Environment</label>
<choice value="DEV">DEV</choice>
<choice value="QA">QA</choice>
<choice value="PROD">PROD</choice>
<fieldForLabel>env</fieldForLabel>
<fieldForValue>env</fieldForValue>
</input>
<input type="dropdown" token="tokHostDropDown" searchWhenChanged="true">
<label>Select Host</label>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search base="baseSearchHostFilter">
<query>| makemv host delim=","
| mvexpand host
</query>
</search>
<change>
<condition label="All">
<set token="tokHost">$tokAllFilteredHosts$</set>
</condition>
<condition>
<set token="tokHost">$value$</set>
</condition>
</change>
<choice value="*">All</choice>
</input>
<panel>
<event>
<search>
<query>index="abc" host=$tokHostDropDown$</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<option name="list.drilldown">full</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
... View more
05-31-2018
07:12 AM
What if I want to change my multiselect to just dropdown and include ALL option , so that it displays All hosts based on the query
index=abc (host=$service$ AND host=$env$) |dedup host
can you help me out how I can do a dropdown which also includes ALL option based on the above xml I provided
... View more
05-30-2018
02:45 PM
@niketnilay
My host drop down XMl
<input type="multiselect" token="host" searchWhenChanged="true">
<label>Select Host Name</label>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>index=abc (host=*$service$* AND host=*$env$*) |dedup host</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<delimiter> </delimiter>
<choice value="*">ALL</choice>
</input>
And In my final search I am using this query to display events based on host selection
index="abc" host IN($host$)
... View more
05-30-2018
02:21 PM
I have a dropdown input to display Host which has options for hosts already predetermined in it from previous dropdowns. When I select the "All" option in the dropdown , instead of displaying all the hosts in the host dropdown, its displaying eventsof all the hosts belonging to index . How can I have an all option for just the hosts determined in host dropdown?
... View more
- Tags:
- splunk-enterprise
05-30-2018
09:21 AM
Hi ,
I have the following sources in splunk , so I wanted to group similar ones under one category/checkbox instead of displaying the entire list in drop down
source= /var/log/message.log
source=/var/log/message1.log
source=/var/log/message2.log
source=/var/log/tmp/rmps.log
So, based on the above sources, I want to achieve this:
... View more
05-17-2018
12:38 PM
what if the list is not static (I mean US1,US2.US3 is not static values)
... View more
05-17-2018
08:27 AM
Yes the US should list only US1 and US2
... View more
05-17-2018
08:01 AM
I have drop down listing down countries . for example my drop down has values as shown below .Now I want to display just two radio buttons instead of drop down ,which should be just UK and US and all the data under US should be US1,US2 .
And Uk radio button should have UK1,UK2,UK3
US1
UK1
UK2
UK3
US2
... View more
- Tags:
- splunk-enterprise
05-03-2018
11:39 AM
When I login to splunk , I have search as landing , how do I change/modify it with my dashboard
... View more
- Tags:
- splunk-enterprise
05-02-2018
03:17 PM
I have host=abc_cloud_aws_dev
host = abc_cloud_aws_qa
Here is my basic search string
index=myindex host=abc_cloud* , to display all the events , but I want to check and display events which are having abc_cloud and also which contains dev in as part of host
... View more
- Tags:
- splunk-enterprise
05-02-2018
07:58 AM
I updated the search for source and I could see source based on host selected, but when I choose any option from the source I couldn,t see the results/events based on the source selected
... View more
05-02-2018
07:30 AM
Here is my sample code that I am using
<form>
<label>raw data</label>
<fieldset submitButton="true" autoRun="true">
<input type="dropdown" token="host" searchWhenChanged="true">
<label>Select Host Name</label>
<choice value="*">ALL</choice>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>index=abcd |dedup host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="time" token="time_range" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select Source</label>
<choice value="*">ALL</choice>
<fieldForLabel>source</fieldForLabel>
<fieldForValue>source</fieldForValue>
<search>
<query>index=abcd |dedup source</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>index="abcd" host=$host$</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<option name="list.drilldown">full</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
</form>
... View more
05-01-2018
01:57 PM
My sample code looks like this how do I apply/insert drilldown to my code , to link to search results
<form>
<label> Areas</label>
<row>
<panel>
<title></title>
<html>
<p>
<h2>
<strong> abc </strong>
</h2>
</p>
</html>
</panel>
</row>
</form>
... View more
- Tags:
- splunk-enterprise
04-30-2018
09:01 AM
how do I customize or adjust width of panel ?
my sample code
<row>
<panel>
<title></title>
<html>
<p>
<h2>
<strong> abc </strong>
</h2>
</p>
</html>
</panel>
... View more
- Tags:
- splunk-enterprise
04-27-2018
02:04 PM
yes it looks like this
..<...visualization eg table/chart.>.
..<...visualization eg table/chart.>.
...<...visualization eg table/chart.>.
... View more
04-27-2018
01:43 PM
yes , I have added html panel to show text , just wondering if there is any ui option for it . Thank you.
... View more
04-27-2018
01:34 PM
How can I add a heading between two rows , my each row on dashboard has three panels . and can i customize it ?
... View more
- Tags:
- splunk-enterprise
04-25-2018
12:18 PM
Yes , I didnt see the question getting posted , so posted again . Anyway my question is the same ,
... View more
04-25-2018
12:05 PM
I have base search query as index="abc" avg(responetime)
I want to create an alert whenever the avg(responsetime) > 500 , how can i do it ?
... View more
- Tags:
- splunk-enterprise
04-25-2018
11:56 AM
search query is:
index="confiacd" | stats avg(responsetime)
Now I want to setup an alert when the avg(responsetime) > 500 , so where do i write this condition to setup alert.
... View more
02-07-2018
01:26 PM
The dashboard that I have created says sharing in App, how do I make the dashboard sharing Global ?
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
