About craigkleen

craigkleen · ‎08-25-2023

Hi all, I'm at a bit of an impasse. An executive would like to see colors that make sense to him in my Punchcard visualization of the number of WiFi devices in a particular space. My data looks like this: date_hour Location Capacity CapacityColor 0 Art Museum Staff 10 5 0 Lobby 3 5 1 Art Museum Staff 10 5 1 Lobby 5 5 10 Art Museum Staff 31 4 10 Lobby 90 2 11 Art Museum Staff 34 4 I have fiddled with all manner of "CapacityColor", charting options, even the field options I found at: https://docs.splunk.com/Documentation/Splunk/9.1.0/DashStudio/objOptRef I've tried my search in both Dashboard Studio and Classic, though I'll be honest, I prefer Classic. The best I seem to be able to do is using Sequential and setting max/min to like red and green. Very "autumn" palette of 5 colors comes out, but I can't change the legend. If I set the CapacityColor to match "Capacity" based on some thresholds like 90,75,50,10,0 it picks seemingly random numbers for the legend (which will confuse said executive). I wanted to be able to use fieldColors={"Over 90%": "red" ... } like I've seen with other charting options, but I haven't found an iteration of that which works either in the punchcard visualization. Has anyone found a way to modify the colors?

AndySplunks · ‎06-10-2022

We had the same issue and resolved it. The broken clients were all trying to download two versions of an app. I have Splunk_TA_Squid_SiteA and Splunk_TA_Squid_SiteB with competing configurations for the same Squid logs. I didn't realize Server Class SiteA Include was including my SiteB clients. My SiteB clients were downloading both SiteA Squid and SiteB Squid. Once I updated Server Class Site A to only apply to Site A clients and not Site B clients, my Site B clients stopped generating the CheckSum errors.

craigkleen · ‎02-01-2021

That was the ticket. Under ${SPLUNK_HOME}/etc/system, the limits.conf was the same. But, on the UF, under ${SPLUNK_HOME}/etc/apps/SplunkUniversalForwarder/ the default was overridden to 256K. So, I made a local directory and updated there. So, thanks for the pointer!

craigkleen · ‎10-01-2020

I ended up just resolving this "well enough" with some field extractions. I made two field extractions to get the "timestamp_1900" and "timestamp_1900fract", then made a calculated field for "timestamp" with this sourcetype. The calculation looks like: strftime(timestamp_1900 - 2208988800 + round(timestamp_1900fract / 4294967295, 3), "%m-%d-%Y %H:%M:%S.%3N")

craigkleen · ‎05-29-2020

Yeah, answering my own post. The issue was that we used the wrong "endpoint". We chose "USGovGCCHigh" instead of "Worldwide", because Worldwide kept erroring out. Lesson-learned that the Worldwide looked different to our Palo Alto Firewall as far as the "app ID" went, so the PAN blocked it. Once the firewall was open, and we switched the Endpoint to Worldwide, it worked perfectly.

craigkleen · ‎05-14-2019

Yeah, that gets me to the same place. But gets a little unwieldy in my use case. To expand my original data with an example, it's like: eventNum,Data,sequence_number eventOne,origData,6675670249450679850 eventOne,origData,6675670249450679847 eventOne,origData,6675670249450679801 eventTwo,extradata,6675670249450679800 eventOne,origData,6675670249450679653 eventTwo,extradata,6675670249450679652 eventOne,origData,6675670249450679645 eventOne,origData,6675670249450679643 eventTwo,extradata,6675670249450679642 eventOne,origData,6675670249450679523 eventTwo,extradata,6675670249450679522 Where, I'm trying to add the fields in "extraData" to the fields in "origData", when the only thing I have coupling this data is this sequence_number that's off by one. So, it seems shorter use a single statement like: | eval commonSeq=if(eventNum="eventOne", tonumber(substr(tostring(sequence_number), -6)) - 1, tonumber(substr(tostring(sequence_number), -6))) | transaction commonSeq Was really hoping that there was more of a function based approach I'm missing, rather than a rex-based one.

davpx · ‎01-25-2019

You should upgrade. There are known bugs for tailing files in versions this old.

craigkleen · ‎10-18-2016

Unfortunately, that middle one doesn't work well. Because the regex matches colons on either side, if the mac address is entirely single digits, it will match the first :x: but the next one skips a field because it would look like "x:" to SED. What I've had to do so far is: SEDCMD-macfix1 = s/(.*Option 82.*)$([a-f0-9]:)/\1(0\2/g SEDCMD-macfix2 = s/(.*Option 82.*\([a-f0-9]{2}):([a-f0-9]:)/\1:0\2/g SEDCMD-macfix3 = s/(.*Option 82.*\([a-f0-9]{2}:[a-f0-9]{2}):([a-f0-9]:)/\1:0\2/g SEDCMD-macfix4 = s/(.*Option 82.*\([a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}):([a-f0-9]:)/\1:0\2/g SEDCMD-macfix5 = s/(.*Option 82.*\([a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}):([a-f0-9]:)/\1:0\2/g SEDCMD-macfix6 = s/(.*Option 82.*\([a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}:[a-f0-9]{2}):([a-f0-9]$)/\1:0\2/g I was just hoping someone out there would know some more tricks to sed to shorten that.

panguy · ‎07-08-2016

Ah ok. That makes sense yes. I only want you to use UDP so that we can narrow down the issue to be related to the forwarder or rsyslogd. I'm glad you got it working!

scannon4 · ‎04-05-2019

Thanks this is what helped me get my dashboard exactly the way I needed it. Your help has been greatly appreciated.

martin_mueller · ‎10-24-2014

Sounds good. The count is zero because calling | stats count without any actual search before it does just that, counting zero events 🙂

craigkleen · ‎10-14-2014

Yeah, that's it. Thanks!

Posts	44
Solutions	3
Karma Given	2
Karma Received	9
Member Since	‎10-14-2014

Online Status	Offline
Date Last Visited	‎08-25-2023 07:51 PM

How to change Punchcard Visualization Categorical ...

UF versus HF processing

Timestamp in 1/1/1900 format

Office 365 Add-On connection errors - unhandled ex...

Very large number math

Splunk 6.6.1 stops monitoring files

SEDCMD for MAC address that are missing leading ze...

Palo Alto Networks App for Splunk: Reading Palo Al...

Sideview button action to refresh page

Why are we getting a deployment checksum failure o...

How to change Punchcard Visualization Categorical ...

Re: Why are we getting a deployment checksum failu...

Re: UF versus HF processing

Re: Timestamp in 1/1/1900 format

Re: Office 365 Add-On connection errors - unhandle...

Re: Very large number math

Re: Splunk 6.6.1 stops monitoring files

Re: SEDCMD for MAC address that are missing leadin...

Re: Palo Alto Networks App for Splunk: Reading Pal...

Re: Sideview button action to refresh page

Re: How to call an external python script to popul...

Re: Why does my sourcetype= search return no resul...