Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About fredkaiser
fredkaiser
Path Finder
Member since:
03-04-2012
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 4 |
| Member Since | 03-04-2012 |
Activity Feed
- Karma Re: How to get a table cell color to change depending on the field value? for tom_frotscher. 06-05-2020 12:47 AM
- Got Karma for How to get a table cell color to change depending on the field value?. 06-05-2020 12:47 AM
- Got Karma for How to get a table cell color to change depending on the field value?. 06-05-2020 12:47 AM
- Got Karma for How to get a table cell color to change depending on the field value?. 06-05-2020 12:47 AM
- Got Karma for How to get a table cell color to change depending on the field value?. 06-05-2020 12:47 AM
- Karma Re: How to show a custom icon for a single value module (such as a stoplight)? for cevyn. 06-05-2020 12:46 AM
- Karma displaying icons in search for jalfrey. 06-05-2020 12:46 AM
- Posted Re: Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:29 PM
- Posted Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:04 PM
- Tagged Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:04 PM
- Tagged Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:04 PM
- Tagged Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:04 PM
- Tagged Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:04 PM
- Tagged Why are only the first two lines of my CSV file getting indexed? on Getting Data In. 05-24-2016 05:04 PM
- Posted Re: dynamically assign sourcetype on folder on Getting Data In. 02-16-2016 05:06 PM
- Posted Re: dynamically assign sourcetype on folder on Getting Data In. 02-16-2016 05:00 PM
- Posted Re: dynamically assign sourcetype on folder on Getting Data In. 02-14-2016 06:11 PM
- Posted dynamically assign sourcetype on folder on Getting Data In. 02-14-2016 05:24 PM
- Tagged dynamically assign sourcetype on folder on Getting Data In. 02-14-2016 05:24 PM
- Tagged dynamically assign sourcetype on folder on Getting Data In. 02-14-2016 05:24 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 4 |
05-24-2016
05:29 PM
have tried that still no luck
... View more
05-24-2016
05:04 PM
Trying to index a CSV, but only the first two lines are indexing. I want to skip the first line and start indexing the data from the headers for the columns
Splunk Search output
TYPE Selected.Microsoft.ActiveDirectory.Management.ADAccount,,
LastLogonDate,Name,LockedOut
CSV input file
TYPE Selected.Microsoft.ActiveDirectory.Management.ADAccount,,
LastLogonDate,Name,LockedOut
25/05/2016 2:13,SPKTest3,TRUE
25/05/2016 2:13,SPKTest4,TRUE
Props.conf
[ADAcount]
HEADER_FIELD_LINE_NUMBER=2
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER=,
input file
[monitor:...//test.csv]
disabled = false
sourcetype =ADAcount
index = test
... View more
02-16-2016
05:00 PM
found the issue was to do with are Props.conf
Props.conf
[source::C:\Program Files (x86)\\Current\\*\\*.log]
should be
[source::...\\Current\\*\\*.log]
everything else was right.
... View more
02-14-2016
06:11 PM
I'll try that as well and still returns the file name as the sourcetype. even when you test your regex here http://www.regexr.com/ it shows it should work. But for some reason it doesn't work with Splunk
... View more
02-14-2016
05:24 PM
I'll like to assign the sourcetype on the folder the logs are sitting in
What I have
File location pick up by forwarder
C:\Program Files (x86)\License\Current\test\filename.log
props.conf
[source::C:\\Program Files (x86)\\License\\Current\\*\\*.log]
TRANSFORMS-set_sourcetype = set_sourcetype_from_log_subdir
Transforms.conf
[set_sourcetype_from_log_subdir]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Sourcetype
REGEX = .+\\(.+)\\[^]*
FORMAT = sourcetype::$1
Splunk Returns sourcetype as filename when index
but I want is the folder not the file name so it should return test
... View more
11-24-2015
06:03 PM
Hi @Vtsguerrero
There is other way with out restarting your Splunk for the changes to take effect and that to bump splunk.
So to do that just:
http://host:mport/locale_string/_bump
EG: http://splunk/en-us/_bump
http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/CustomizationOptions
... View more
11-16-2015
03:00 PM
Hi Vstguerrero
you can override this by adding the below in custom CSS
svg.svg-container {
height=75% !important;
width=75% !important;
}
which will put them both on the same line but with a big space between them.
Once this has been change you need to restart Splunk or bump it
How to bump Splunk
http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/CustomizationOptions
... View more
06-23-2015
06:25 PM
yes we have single indexer and all the logs go there. We want to use Stacks so we can assign more of the licence to one of the environments. But still use one indexer. So your answer won't help.
... View more
06-23-2015
05:40 PM
We have an indexer where we have multiple environments (A and B) sending logs to this one indexer.
My question: Is there a way without setting up a new indexer (server). To assign environment A more of the license than B without pointing environment B to a new indexer and assigning that indexer to a different stack?
... View more
04-19-2015
07:48 PM
After a bit of playing with the example dashboard. I finally got what I wanted. Thanks for you help Tom
... View more
04-16-2015
07:49 PM
4 Karma
Hi,
I've looked at a few answers now and can't make heads or tails of it, but what I am trying to do is, if the value says red/Green, the cell should be that color.
Here is what I have so far.
XML
test2
<panel>
<table>
<search>
<query>index="monitor_t" sourcetype="ServiceStatus" earliest=-5m | stats count(eval(Status="Running")) AS RunningCount |rangemap field=RunningCount red=0-60 default=green</query>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
Application.js
if ((Splunk.util.getCurrentView() === "test2") && Splunk.Module.SimpleResultsTable) {
Splunk.Module.SimpleResultsTable = $.klass(Splunk.Module.SimpleResultsTable, {
onResultsRendered: function ($super) {
var retVal = $super();
this.myCustomHeatMapDecorator();
return retVal;
},
myCustomHeatMapDecorator: function () {
$("tr:has(td)", this.container).each(function () {
var tr = $(this);
if (tr.find("td:nth-child(1)").text() === "green") {
tr.addClass("greenClass");
}
if (tr.find("td:nth-child(1)").text() === "red") {
tr.addClass("redClass");
}
});
}
});
}
Application.css
tr.redClass td {
background-color:#000000 !important;
color: #FFFFFF !important;
}
tr.greenClass td {
background-color:#FFFFFF !important;
color: #000000 !important;
}
... View more
