About iKate

iKate · ‎04-04-2016

Thanks! To be honest, I couldn't suppose to put all search string into value section even after reading tutorial. This is how my working dashboard(part) looks like now: <fieldset submitButton="false" autoRun="true"> <input type="time" searchWhenChanged="true"> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="devicemanufacturer"> <label>device manufacturer</label> <search> <query>index=myindex earliest=-2d | stats dc(devicemanufacturer) as d by devicemanufacturer</query> </search> <fieldForLabel>devicemanufacturer</fieldForLabel> <fieldForValue>devicemanufacturer</fieldForValue> <choice value="*">All</choice> <default>*</default> <prefix>devicemanufacturer=</prefix> </input> </fieldset> <row> <panel> <html > <h2>Top 30 Search Strings</h2> <div id="search_words" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{ "preview": true, "search": { "type": "token_safe", "value": " index=myindex $$devicemanufacturer$$ earliest=$$earliest$$ latest=$$latest$$| top limit=30 searchstr " } }"> </div> ....

iKate · ‎03-30-2016

Hi! How can one pass input parameters from drop-down/textfield/etc into a search that is inside a div tag of an html panel (I'm using bubble chart example)? $$mytoken$$ or $mytoken$ - doesn't work placing depends="$mytoken$" in html or div tag didn't help either Here's part of bubble chart example xml and we can see text inputs term and category , but they aren't displayed on a dashboard and aren't used in the search inside html. Is it possible at all? <form script="custom_vizs:autodiscover.js, custom_vizs:viz_bubblechart.js"> <label>Bubble Chart</label> <fieldset submitButton="false" autoRun="true"> <input type="time" searchWhenChanged="true"> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="term" id="input_term"/> <input type="text" token="category" id="input_category"/> </fieldset> <row> <panel> <html> <h2>Top 30 Most Common Terms in an Ad-hoc Search Query (drilldown)</h2> <div id="bubblechart_search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{ "preview": true, "search": "index=_audit NOT REST: search=* | regex search_id=\"'\\d+\\.\\d+'\" | rex field=search max_match=0 \"(?<terms>\\w+)\" | eval terms=mvdedup(terms) | top limit=30 terms | lookup search_commands.csv search_command AS terms OUTPUT search_command | eval type=case(isnum(terms), \"number\", isnotnull(search_command), \"command\", 1=1, \"word\") | eval terms=if(isnum(terms), \"\\\"\"+terms+\"\\\"\", terms)", "earliest_time": { "type": "token_safe", "value": "$$earliest$$" }, "latest_time": { "type": "token_safe", "value": "$$latest$$" } }'> </div> <div id="bubblechart" class="splunk-view" data-require="app/custom_vizs/components/bubblechart/bubblechart" data-options='{ "managerid": "bubblechart_search", "nameField": "terms", "valueField": "count", "categoryField": "type", "height": 600 }'> </div> </html> </panel> </row>

iKate · ‎03-30-2016

Thanks for your answer! Unfortunately changing feature id element name in lookup definition didn't help( I attached sample geodata in csv, maybe it can help.

iKate · ‎03-23-2016

Hi splunkers! While trying to add KMZ file to use awesome choropleth map with my country I got this error: Failed to memory map index files. Here is a piece of search.log: 03-23-2016 20:18:13.983 INFO spatial:Util - fullPath to spatial polygons data file: /opt/splunk/etc/apps/play/lookups/regions2010_wgs.kmz 03-23-2016 20:18:13.983 INFO spatial:Util - using disk index: /opt/splunk/etc/apps/play/lookups/ru_regions 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - Num Keys in ray.key: 0 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - Num Keys in seg.key: 0 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - Num Keys in grid.key: 0 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - memory mapping existing file: ray.key 03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file ray.key 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - memory mapping existing file: ray.val 03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file ray.val 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - memory mapping existing file: seg.key 03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file seg.key 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - memory mapping existing file: seg.val 03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file seg.val 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - memory mapping existing file: grid.key 03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file grid.key 03-23-2016 20:18:13.987 INFO spatial:PointInPolygonIndex - memory mapping existing file: grid.val 03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file grid.val 03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - memmap failed! no valid keys and values Our file is in kmz, it contains filled Name param (featureid). Search string that I used: source=purchases | geoip ip_address | lookup ru_regions longitude as ip_address_longitude, latitude as ip_address_latitude | stats count by featureId | geom ru_regions Link for downloading kmz file: http://gis-lab.info/data/rusbounds-rosreestr/regions2010_wgs.kmz Test geodata: test_data.csv Hope for your help, I want this cool viz so much:)

iKate · ‎03-16-2016

It's sad to hear this. We faced the same problem after 6.3 had released, got no response on the issue and just moved to previous version 6.2. Next week we'll try to upgrade again this time to 6.3.3. I'm afraid the same errors will arise but we need new apps that work just with 6.3.. Here was my question https://answers.splunk.com/answers/310778/journalslicedirectory-cannot-seek-to-0-and-error20.html

iKate · ‎03-16-2016

At that moment and we we got no response and moved to previous version. Next week we'll try to upgrade again this time to 6.3.3. Did you solve the problem?

iKate · ‎11-30-2015

Thanks for your answer jeffland. Seems there's nothing to do with this.

iKate · ‎11-26-2015

Hi-hi! Is it possible to preserve original table column order after untable and xyseries commands? E.g.: ... | table period orange lemon ananas apple cherry (and I need right this sorting afterwards but transposed with header in "period") | untable period name value | xyseries name period value and instead initial table column order I get lexicographical sorting: name period1 period2 period3 period4 period5 ananas apple cherry lemon orange At the moment I see just variant with renaming columns to contain digit in the beginning but it's not convenient as I have several dozens of them %)

iKate · ‎09-24-2015

Hi Splunkers! I've just watched the .conf2015 keynote and being full of inspiration we upgraded our Splunk Enterprise. But right after this some of our advanced XML dashboards got red-label error: JournalSliceDirectory: Cannot seek to 0 Several charts display Error#2032 And others show the message "No results found" when it was possible before the upgrade. Can we solve it? Thanks in advance. P.S. cannot create a new tag "splunk6.3" as I have no permissions for this, nice( 015-09-24 16:42:36,335 ERROR [5603fdcc467fe464055750] proxy:190 - [HTTP 400] Bad Request; [{'text': 'JournalSliceDirectory: Cannot seek to 0', 'code': None, 'type': 'FATAL'}] Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/proxy.py", line 168, in index timeout=simpleRequestTimeout File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 565, in simpleRequest raise splunk.BadRequest, (None, serverResponse.messages) BadRequest: [HTTP 400] Bad Request; [{'text': 'JournalSliceDirectory: Cannot seek to 0', 'code': None, 'type': 'FATAL'}] Update: Finally, we've upgraded Splunk version to 6.3.3. We still had the same error but I made a trick that found in one of the answers: data from some indexes could not be retrieved for "All time", but it still worked if the custom time for a smaller time period was selected. So I just added earliest=... in searches that were damaged. And luckily we haven't seen any other problems with the new version so far.

iKate · ‎08-11-2015

Will anything change with this case? Still can't schedule pdf delivery from a dashboard with inputs.

iKate · ‎07-14-2015

It worked! Great, thank you Martin!

iKate · ‎07-13-2015

Hi splunkers! I have a large lookup that is fully updated once a day. The first time I address this lookup each day, it takes way too long time to get results. After such initial reindexing or loading (not sure), further searches are calculated with normal speed. Is it possible to preload/reindex it,not at a search-time, but beforehand, e.g. just after it's done updating on a schedule for all users? Thank you!

iKate · ‎02-24-2015

Hi there, I've got temporal lookup that is defined in transforms.conf as: [lookup_time] filename = lookup_time.csv max_matches = 1 time_field = start_time csv file lookup_time.csv has a structure like this: user_uid,type,start_time,start_month 13482832,WEB,1313096400,2011.08 13482832,MIX,1418331600,2014.12 Invoking it at a search time like source=source1 | loookup lookup_time user_uid OUTPUT doesn't work correctly and I get both types for this user_uid at every moment of time. But it works when making this lookup automatically invoked with this source by putting a notion about it in props.conf, [source::source1] LOOKUP-lookup_time = lookup_time user_uid OUTPUT and restarting config with | extract reload=T But we don't need this lookup to run every time we address to source1, in order not to make search time longer as a lookup is heavy. So can I use temporal lookup at a search time? In lookups description there's no limitations about automatical or manual invoking of temporal lookup: Or am I doing mistake somewhere? Thanks in advance! Edit existing lookup definitions or define a new file-based or external lookup Use the Settings > Lookups > Lookup definitions page to define the lookup table or edit existing lookup definitions. You can specify the type of lookup (file-based or external) and whether or not it is time-based. Once you've defined the lookup table, you can invoke the lookup in a search (using the lookup command) or you can configure the lookup to occur automatically.

iKate · ‎01-15-2015

Hi Mikael! If the question is somehow still relevant I’ll make a suggestion and hope it can(or at least could:) help. Seems it was better to search by both eventtypes at once; events would be sorted by _time automatically at a search time and with assumption that there can be just one src during transaction for a user, transaction command could be used excluding src that exists just in one eventtype; then a transaction id field can be created, to distinguish transactions from one user, let it be just simple counter. The search can look like this: eventtype=juniper_sa_authentication OR eventtype=xenapp:65:session | transaction user mvlist=t startswith="eventtype=juniper_sa_authentication_success" endswith="eventtype=juniper_sa_authentication_logout" keepevicted=t | eval TransactionId=1 | accum TransactionId | eval State = if(closed_txn == 1, "Disconnected", "Connected") | eval elapsed_secs = case(State == "Connected" AND NOT duration == 0, now()-starttime, State == "Connected" AND duration == 0, now()-_time, State == "Disconnected" AND NOT duration == 0, duration ) | eval ExternalIP = src | stats latest latest(realm), latest(State), latest(elapsed_secs), list(BrowserName), list(ConnectTime), list(LogOnTie), list(SessionId), list(ServerName) BY user TransactionId

iKate · ‎11-18-2014

The same problem. Any solutions?

iKate · ‎09-26-2014

dragging panels in Launcher doesn't change order in the apps' dropdown in the upper left corner. Or which dropdown did you mean?

iKate · ‎08-30-2014

Thanks for the answer. Then my next steps are to try this app http://apps.splunk.com/app/1772/ that I knew about from this post: http://i-splunk.blogspot.ru/2014/03/web-path-analytic-with-splunk.html Or implement Sankey by our own like it is described here http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAEN6 Maybe you can address the authors of these posts as probably they have also faced the same problem. Looking forward for your news!

iKate · ‎08-14-2014

Hi all, While mapping ip-addresses to cities using iplocation or geoip commands, they returned just 65% of matched ip+cities. There's another geoip database that have more full information concerning my region. Ip-addresses there are grouped in ranges that are converted into numeric format (ip address a.b.c.d is converted this way: a*256*256*256+b*256*256+c*256+d ) : city range range_start range_end region city1 2.60.0.0 - 2.60.255.255 37486592 37552127 region1 city2 2.61.0.0 - 2.61.255.255 37552128 37617663 region2 city3 2.62.0.0 - 2.62.255.255 37617664 37683199 region3 csv file of 38k lines And file with 700k ip-s that is needed to be matched with cities above, looks like this: ip_address ip_converted 2.60.0.0 37486592 2.61.0.0 37552128 2.62.0.0 37617664 Each ip_converted value shoud be checked against all ranges to find one where this statement is true: range_start <= ip_converted <= range_end How can this matching be done in splunk? I've tried map but it's not for this case. Thanks in advance!

iKate · ‎07-16-2014

Hi! Are there any limitations on the amount of data that can be used in the chart of Sankey module? I'm using 90MB file of 200K rows and the dashboard can hardly build a graph even with limit 10 and can never do it with limit 15 and above, while table data is calculated ok. Chrome or FF web-page simply crashes. And can you please tell more about $sankey.searchterms$ Thank you! p.s. I've asked this question in another one (d3-sankey-chart-without-using-django-framework), hope separately it will have more chances to be answred.

iKate · ‎07-14-2014

@martin_mueller, @MuS hello! Are there any limitations on the amount of data that can be used in this chart? I'm using 90MB file of 200K rows and the dashboard can hardly build a graph even with limit 10 and can never do it with limit 15 and above. Chrome or FF web-page simply crashes. And can you please tell more about $sankey.searchterms$ Thank you!

iKate · ‎04-29-2014

Hi, Basing on customers' purchases I'd like to make a proposition of what item can be probably purchased if a user had previously purchased itemX. Seems the command arules can help with this but I got no reults using it. My dataset is a list of transactions with major fields that I intended to use: user_id and item_name source=transactions | arules user_id item_name Am I misusing the command? Or is there another way to get the desired information in splunk?

iKate · ‎04-28-2014

@sideview thanks in advance! It will add consistency to sideview's cool drilldown capabilities.

iKate · ‎04-28-2014

Thanks, Martin!! I've forgotten about drilldown's option 'all' and tried to do the same with 'row', sure it was no result with click.name/value2 )

iKate · ‎04-25-2014

Hi! Can you please suggest how to make a table drilldown by clicking on a cell resulted from the following command: | chart count by range column I've tried almost all variants from sideview app's page on drilldowns but found no proper one. At first I just wanted to have the same experience as you get when selecting in flashtimeline any cell of results: you wil be redirected to a new flashtimeline and the search will be modified by dropping the last resulting command and adding search by two parameters you selected: ...| search range="1-14" column="2) 2-4" At first I wanted to use converttodrilldownsearch <module name="SimpleResultsTable" autoRun="True"> <param name="drilldown">row</param> <param name="entityName">results</param> <param name="count">100</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> <param name="popup">True</param> </module> </module> </module> But it took just the value of a row (range="1-14") but not a column. Then I decided to make inline drilldown with sideview utils <module name="Pager"> <module name="Table"> <module name="Search"> <param name="search"> ...| search range="$row.fields.range$" column="$row.fields.column$" But $row.fields.column$ cannot be defined.

iKate · ‎03-12-2014

@cormieja how did you solve the issue? I've faced the same problem. What has helped me this time is recreation of lookup table. But I didn't realized the reason of the problem and cannot be sure it wouldn't repeat. What I've also done is eliminated table command in the query that generates lookup table. The search looked like: | dbquery dbname " select * ...." | table field1 field2 field3 | outputlookup file.csv And now like: | dbquery dbname " select field1, field2, field3 ...." | outputlookup file.csv Not sure this affected the lookup table format but I've read about some problems of dbquery and table command so..

Posts	153
Solutions	7
Karma Given	58
Karma Received	56
Member Since	‎03-01-2012

Online Status	Offline
Date Last Visited	‎12-09-2020 07:46 PM

Why kv store lookup is much slower than csv lookup...

kv_store vs dbxlookup

How to setup scheduled search to run after fulfill...

Setting for cleaning scheduled saved search artifa...

Can you help me with Dedup events in a data model?

Incomplete lookup results

Unable to make several independent tab areas in a ...

How can I complete many (70) similar transformatio...

Make map command process values in series

Silent hit of limit

Re: Custom Visualizations app: How to pass paramet...

Custom Visualizations app: How to pass parameters ...

Re: Choropleth: Failed to memory map index files

Choropleth: Failed to memory map index files

Re: After indexer cluster upgrade to Splunk 6.3, w...

Re: JournalSliceDirectory: Cannot seek to 0 and e...

Re: preserve original table column order after unt...

preserve original table column order after untable...

Getting error "JournalSliceDirectory: Cannot seek ...

Re: User input to dashboard - schedule PDF deliver...

Re: Is it possible to reindex or preload a large l...

Is it possible to reindex or preload a large looku...

How to invoke a temporal lookup at a search-time?

Re: How to combine transaction search results of o...

Re: After upgrading to Splunk 6.2, why can I no lo...

Re: Splunk 6 launcher shows apps in reverse order

Re: Are there any limitations on amount of data us...

loop search for ranges mapping

Are there any limitations on amount of data used i...

Re: D3 sankey chart without using Django framework

arules command returns no output

Re: Inline drilldown after a chart command

Re: Inline drilldown after a chart command

Inline drilldown after a chart command

Re: Incomplete LOOKUP results

Are you a member of the Splunk Community?