Hello, We recently encountered an issue with a search that returned this error message: [subsearch]: File '/opt/splunk/var/run/splunk/file_name.csv' could not be opened for reading. While the fix was fairly simple, we would like to be notified when this type of issue starts in the future. I checked all of the index="_*" logs, and I do not see the error message. Is there a way for me to enable logging for this type of problem? Thank you, Jim ... View more

I thought that there would be 1024 MBs in 1 GB, but the examples online for indexes.conf has these entries: ### Indexes may be allocated space in effective groups by sharing volumes ### # perhaps we only want to keep 100GB of summary data and other # low-volume information [volume:small_indexes] path = /mnt/splunk_indexes maxVolumeDataSizeMB = 100000 # and this is our main event series, allowing 50 terabytes [volume:large_indexes] path = /mnt/splunk_indexes maxVolumeDataSizeMB = 50000000 Shouldn't 50 terabyes be defined as 52428800? I am tuning my indexes.conf config and want to be as precice as possible. Thank you, Jim ... View more

I am trying to get my menus to load faster. It seems like the searches are searching over all time, because it was really fast when I first started collecting data. I tried to move the Time Picker to the top of the search, but that didn't seem to help it load any faster. Does anyone have advice on how to speed them up? <?xml version="1.0"?> <view onunloadCancelJobs="False" autoCancelInterval="100"> <!-- autoCancelInterval is set here to 100 --> <label>Active VPN users</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="SearchBar" layoutPanel="splSearchControls-inline"> <param name="label">Search</param> <param name="default">*</param> <param name="useOwnSubmitButton">False</param> <!-- HiddenIntention that inserts index="vpn_access". --> <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index">vpn_access</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- Search to build the drop down menu items. --> <module name="SearchSelectLister" layoutPanel="splSearchControls-inline"> <param name="label">VPN Concentrator</param> <param name="settingToCreate">element_name</param> <param name="search">index=vpn_access element_name=* | stats count by element_name | sort element_name</param> <param name="searchWhenChanged">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">ALL</param> <param name="value">*</param> </list> </param> <param name="selected">ALL</param> <param name="searchFieldsToDisplay"> <list> <param name="label">element_name</param> <param name="value">element_name</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">element_name</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="element_name">$target$</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- Search to build the drop down menu items. --> <module name="SearchSelectLister" layoutPanel="splSearchControls-inline"> <param name="label">Group Policy</param> <param name="settingToCreate">group_policy</param> <param name="search"> | stats count by group_policy | sort group_policy</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">ALL</param> <param name="value">*</param> </list> </param> <param name="searchFieldsToDisplay"> <list> <param name="label">group_policy</param> <param name="value">group_policy</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">group_policy</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="group_policy">$target$</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- Search to build the drop down menu items. --> <module name="SearchSelectLister" layoutPanel="splSearchControls-inline"> <param name="label">Username</param> <param name="settingToCreate">username</param> <param name="search"> | stats count by username | sort username</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">ALL</param> <param name="value">*</param> </list> </param> <param name="searchFieldsToDisplay"> <list> <param name="label">username</param> <param name="value">username</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">username</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="username">$target$</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- Time picker. --> <module name="TimeRangePicker"> <param name="label">Time Picker</param> <param name="selected">Last 4 hours</param> <param name="searchWhenChanged">True</param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <!-- Google Map. --> <module name="GenericHeader" layoutPanel="graphArea"> <param name="label">Google Map</param> </module> <module name="HiddenSearch" layoutPanel="graphArea" autoRun="true"> <param name="search"> | dedup vpn_index | localop | geoip public_ip</param> <module name="GoogleMaps"> <param name="drilldown">true</param> <param name="drilldown_field">public_ip</param> <param name="doubleClickZoom">off</param> <param name="height">600px</param> <param name="mapType">roadmap</param> <param name="scrollwheel">off</param> <param name="streetViewControl">on</param> <!-- Search results in a table that updates with clicks. --> <module name="HiddenSearch" autoRun="False"> <param name="search">index=vpn_access $clientips$</param> <module name="ConvertToIntention"> <param name="settingToConvert">maps.drilldown</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="clientips"> <param name="value">$target$</param> </param> </param> </param> <module name="JobProgressIndicator"> </module> <module name="HiddenPostProcess"> <param name="search">dedup vpn_index | localop | geoip public_ip | rename public_ip as "public ip" assigned_ip as "assigned ip" public_ip_country_code as code public_ip_country_name as country public_ip_city as city public_ip_region_name as "state / region" bytes_rx as "bytes rx" bytes_tx as "bytes tx" | table username "public ip" "assigned ip" country code city "state / region" "bytes rx" "bytes tx" duration | sort - bytes_tx</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <param name="count">1000</param> <param name="entityName">results</param> <module name="HiddenSearch"> <param name="search">eventtype=public_ip="$public_ip$"</param> <module name="ConvertToIntention"> <param name="settingToConvert">click.value</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="public_ip"> <param name="value">$target$</param> </param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> <param name="popup">true</param> </module> </module> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="label">View events...</param> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> ... View more

Hello, I am writing and adv. xml page that leverages the Google maps app to display where VPN users are. I now want to be able to click on the location to pull up a table of information on the users in that area. I enabled the drilldown parameter and noticed that I see a finger in place of the hand when hovered over a number. When I click it, it zooms in. I tried to turn off doubleClickZoom, but the results are the same. Is it supposed to launch a search as is? Anyone else with this issue? Do I need to add an intention? Thank you, Jim ... <!-- Google Map. --> <module name="GenericHeader" layoutPanel="graphArea"> <param name="label">Google Map</param> </module> <module name="HiddenSearch" layoutPanel="graphArea" autoRun="true"> <param name="search"> | dedup vpn_index | localop | geoip public_ip</param> <module name="GoogleMaps"> <param name="doubleClickZoom">off</param> <param name="height">800px</param> <param name="mapType">roadmap</param> <param name="drilldown">true</param> <param name="scrollwheel">off</param> <param name="streetViewControl">on</param> </module> ... ... View more

I just wrote up a custom web page that provides a search bar and drop down menus over the Google maps app. I am pretty pleased with it, but there is one thing that is not working how I want it to. When I select menu items from left to right, they re-populate the down stream filters as expected. However, they do not populate them up stream. I am most concerned because I would really like to see the time picker reload the previous menus. I suspect that the SearchLinkLister applyOuterIntentionsToInternalSearch parameter is driving the results down stream (most of my code is extracted from the UI examples app). However there does not seem to be a way to "applyOuterIntentionsToExternalSearch". Is there possibly some other way to accomplish this? Thank you in advance, Jim [root@awesome views]# more test.xml <?xml version="1.0"?> <!-- autoCancelInterval is set here to 100 --> Active VPN users * False 1 Search * False <!-- sample HiddenIntention that inserts index="vpn_access" --> <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index">vpn_access</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- sample HiddenIntention that inserts element_name="*" --> <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="element_name">*</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- sample HiddenIntention that inserts group_policy="*" --> <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="group_policy">*</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- sample HiddenIntention that inserts username="*" --> <module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="username">*</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <module name="SearchSelectLister" layoutPanel="splSearchControls-inline"> <param name="label">VPN Concentrator</param> <param name="settingToCreate">vpn_device_setting</param> <param name="search">index=vpn_access element_name=* | stats count by element_name | sort element_name</param> <param name="searchWhenChanged">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">ALL</param> <param name="value">*</param> </list> </param> <param name="selected">ALL</param> <param name="searchFieldsToDisplay"> <list> <param name="label">element_name</param> <param name="value">element_name</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">vpn_device_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="element_name"> <param name="fillOnEmpty">True</param> <param name="value">$target$</param> </param> </param> </param> <module name="SearchSelectLister" layoutPanel="splSearchControls-inline"> <param name="label">Group Policy</param> <param name="settingToCreate">group_policy_setting</param> <param name="search">index=vpn_access element_name=$element_name$ | stats count by group_policy | sort group_policy</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">ALL</param> <param name="value">*</param> </list> </param> <param name="searchFieldsToDisplay"> <list> <param name="label">group_policy</param> <param name="value">group_policy</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">group_policy_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="group_policy"> <param name="fillOnEmpty">True</param> <param name="value">$target$</param> </param> </param> </param> <module name="SearchSelectLister" layoutPanel="splSearchControls-inline"> <param name="label">Username</param> <param name="settingToCreate">username_policy_setting</param> <param name="search">index=vpn_access element_name=$element_name$ group_policy=$group_policy$ | stats count by username | sort username</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="staticFieldsToDisplay"> <list> <param name="label">ALL</param> <param name="value">*</param> </list> </param> <param name="searchFieldsToDisplay"> <list> <param name="label">username</param> <param name="value">username</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">username_policy_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="username"> <param name="fillOnEmpty">True</param> <param name="value">$target$</param> </param> </param> </param> <module name="TimeRangePicker"> <param name="label">Time Picker</param> <param name="selected">Last 4 hours</param> <param name="searchWhenChanged">True</param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <module name="GenericHeader" layoutPanel="graphArea"> <param name="label">Google Map</param> </module> <module name="HiddenSearch" layoutPanel="graphArea" autoRun="true"> <param name="search">index=vpn_access element_name=$element_name$ group_policy=$group_policy$ username=$username$ | localop | geoip public_ip</param> <module name="GoogleMaps"> <param name="height">500px</param> <param name="mapType">roadmap</param> <param name="scrollwheel">off</param> </module> </module> </module> <module name="Message" layoutPanel="graphArea"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">2</param> <module name="JobStatus"> <param name="resultsLink"> <param name="popup">True</param> <param name="viewTarget">report_builder_define_data</param> <param name="transformedResultsViewTarget">report_builder_format_report</param> </param> <module name="FlashTimeline" layoutPanel="graphArea"> <param name="height">180px</param> <param name="width">100%</param> <module name="TitleBar" layoutPanel="viewHeader"/> <module name="FieldPicker" layoutPanel="sidebar"> <param name="fields">host sourcetype source</param> <param name="link"> <param name="view">report_builder_format_report</param> </param> <module name="Message" layoutPanel="resultsAreaLeft"> <param name="filter">pageControls</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="Count" layoutPanel="pageControls"> <param name="options"> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="selected">True</param> <param name="value">50</param> </list> </param> <module name="ButtonSwitcher" layoutPanel="pageControls"> <param name="mode">independent</param> <param name="selected">splIcon-events-list</param> <param name="disableOnNull">True</param> <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List"> <param name="entityLabel">events</param> <param name="entityName">events</param> <module name="Paginator" layoutPanel="pageControls"> <param name="entityName">events</param> <param name="maxPages">10</param> <module name="SoftWrap" layoutPanel="resultsOptions"> <param name="enable">True</param> <module name="RowNumbers"> <module name="MaxLines"> <param name="options"> <list> <param name="text">5</param> <param name="selected">True</param> <param name="value">5</param> </list> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="value">50</param> </list> <list> <param name="text">100</param> <param name="value">100</param> </list> <list> <param name="text">200</param> <param name="value">200</param> </list> <list> <param name="text">All</param> <param name="value">0</param> </list> </param> <module name="Segmentation"> <param name="options"> <list> <param name="text">inner</param> <param name="selected">True</param> <param name="value">inner</param> </list> <list> <param name="text">outer</param> <param name="value">outer</param> </list> <list> <param name="text">full</param> <param name="value">full</param> </list> <list> <param name="text">raw</param> <param name="value">raw</param> </list> </param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> <param name="reportFieldLink">report_builder_format_report</param> </module> </module> </module> </module> </module> </module> </module> <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table"> <param name="entityLabel">events</param> <param name="entityName">events</param> <module name="Paginator" layoutPanel="pageControls"> <param name="count">50</param> <param name="entityName">events</param> <param name="maxPages">10</param> <module name="RowNumbers" layoutPanel="resultsOptions"> <module name="DataOverlay" layoutPanel="resultsAreaLeft"> <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft"> <param name="entityName">events</param> </module> </module> </module> </module> </module> <module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table"> <param name="entityLabel">results</param> <param name="entityName">results</param> <module name="EnablePreview" group="show" layoutPanel="resultsOptions"> <param name="enable">True</param> <module name="Paginator" layoutPanel="pageControls"> <param name="count">50</param> <param name="entityName">results</param> <param name="maxPages">10</param> <module name="RowNumbers" layoutPanel="resultsOptions"> <module name="DataOverlay" layoutPanel="resultsAreaLeft"> <module name="SimpleResultsTable" layoutPanel="resultsAreaLeft"> <param name="entityName">results</param> </module> </module> </module> </module> </module> </module> </module> </module> <module name="MultiFieldViewer"> <param name="link"> <param name="view">report_builder_format_report</param> </param> </module> <module name="SuggestedFieldViewer"> <param name="minDistinctCount">1</param> <param name="minFrequency">0.5</param> <param name="maxFields">50</param> <param name="exclude"> <list>^date_.*</list> </param> <param name="link"> <param name="view">report_builder_format_report</param> </param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> [root@awesome views]# ... View more

Hello, I am extracting logs from the results of a screen scrape on Cisco load balancers. I used to use some Perl code to pre-parse the data, but I am trying to port that functionality into Splunk. Below is a some same output: slb/prod16# show service-policy LB_123_ABC_POLICY detail Status : ACTIVE Description: NONE Interface: vlan 1180 4713 6404 service-policy: LB_VIP_POLICY class: L4_SSL-123_ABC_CLASS_DEV ssl-proxy server: NEW-SSL-PROXY VIP Address: Protocol: Port: 10.47.15.16 tcp eq 443 loadbalance: L7 loadbalance policy: L7_SSL-123_ABC_POLICY VIP Route Metric : 77 VIP Route Advertise : DISABLED VIP ICMP Reply : ENABLED-WHEN-ACTIVE VIP State: INSERVICE curr conns : 780 , hit count : 1251767 dropped conns : 159774 client pkt count : 21301490 , client byte count: 2624639829 server pkt count : 26552109 , server byte count: 28101998657 conn-rate-limit : 0 , drop-count : 0 bandwidth-rate-limit : 0 , drop-count : 0 L7 Loadbalance policy : L7_SSL-123_ABC_POLICY class/match : class-default ssl-proxy client : SSL_PSRVICE_CLIENT LB action: : primary serverfarm: prod.thingy:30011 state: UP backup serverfarm : - hit count : 1244324 dropped conns : 1 class: prod.thingy:30010 VIP Address: Protocol: Port: 10.47.15.16 tcp eq 80 loadbalance: L7 loadbalance policy: prod.thingy:8010 VIP Route Metric : 77 VIP Route Advertise : DISABLED VIP ICMP Reply : ENABLED VIP State: INSERVICE curr conns : 602 , hit count : 308787 dropped conns : 35 client pkt count : 1526460 , client byte count: 130340865 server pkt count : 1224022 , server byte count: 208605432 conn-rate-limit : 0 , drop-count : 0 bandwidth-rate-limit : 0 , drop-count : 0 L7 Loadbalance policy : prod.thingy:8010 class/match : class-default LB action: : primary serverfarm: prod.thingy:30010 state: UP backup serverfarm : - hit count : 308784 dropped conns : 0 This is the detail of two Classes, but IRL, there are many more Classes listed one after another. I am trying to map the "class:" name with the corresponding "curr conns" that follows. Is this possible? I am thinking that I would be able to grab the other data points if it is ever requested in the future. Would I be better off pre-parsing the data, like I have in the past? Thank you, Jim ... View more

Hello, I am looking at the results of a table lookup, where there many values for a particular field are returned. This is exactly what I want, but I would like to further evaluate one of the fields and only show the tabled results that match a string. When I attempt to pipe my search into another search, the all of fields still remain, even if I try to match against field_name=one_of_many_values. Is there a away to remove these fields from the search results / MVF? Thank you, Jim ... View more

I am trying to enhance the *nix app by creating an entirely collapsed list of the available graphs for a host on a single page. Then, a user can just click on the links that they want to load, decreasing the page load time and reducing clutter all at once. I am sure that I will make some of the content static later, but this is just a starting point. To get the list of hosts, I have a daily search that looks for all of the hosts (| metadata type=hosts index=os | sort host | fields + host). I then parse the results via Perl & API and prints a .csv in my lookup dir. The final printout has columns with hosts and the names of macros to call from the *nix app, which draw pretty graphs. Each host has a complete list of the macro names, which lets me lookup the table from a SearchSelectLister and present the results in a table (also built with future customizations in mind - think dynamic lists per host or host type). Everything works up to this point, and I am ready for a victory lap. However, my dreams are shattered by this error message - "PARSER: Applying intentions failed Error in 'SearchParser': The name '$click.value2$' is invalid. Macro and argument names may only include alphanumerics, '_' and '-'.". I thought that this was the proper way to tackle this problem. Do I have to add another field in the .csv that contains the search string (defined by the macro) and have that variable be $click.value2$? I started down this path, but padding all of the special characters in my Perl script is taking me a bit to get straight. It would be even better if there was a way to properly use the $click.value2$ variable when calling the macro. Any input would be greatly appreciated, I have attached my code and a screen shot for clarity. Regards, Jim https://lh6.googleusercontent.com/_Zgb9nnpHAxA/TZKih8XwwWI/AAAAAAAAAZU/---jOAXmo7I/s1440/Screen%20shot%202011-03-29%20at%2011.19.23%20PM.jpg <view template="dashboard.html"> <label>Custom wiring the clicks</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="SearchSelectLister" layoutPanel="panel_row1_col1_grp1"> <param name="label">Select host</param> <param name="settingToCreate">host_setting</param> <param name="search">| metadata type=hosts index=os | sort host</param> <param name="searchWhenChanged">True</param> <param name="selected">mrtg-2.unix.X.edu</param> <param name="searchFieldsToDisplay"> <list> <param name="label">host</param> <param name="value">host</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">host_setting</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="host">$target$</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <module name="GenericHeader"> <param name="label">Reports</param> </module> <module name="HiddenSearch"> <param name="search">| lookup all_hosts host OUTPUT report | head 1 | fields + host report | fields - _time</param> <param name="earliest">-1d</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Interface</param> <param name="secondaryAxisTitle.text">bits/sec</param> <param name="legend.placement">none</param> <module name="JobProgressIndicator"/> <!-- here's the SimpleResultsTable that we'll click on --> <module name="SimpleResultsTable" layoutPanel="panel_row1_col1_grp1"> <param name="displayRowNumbers">false</param> <param name="drilldown">all</param> <param name="entityName">results</param> <!-- We throw in a header so we can tell the user what they clicked on. --> <module name="SimpleResultsHeader" layoutPanel="panel_row1_col1_grp2"> <param name="entityName">results</param> <param name="headerFormat">CHART for time = $time$, cv=$click.value$, cv2=$click.value2$, cn=$click.name$, cn2=$click.name2$</param> </module> <!-- we swap out the search to be a timechart. --> <module name="HiddenSearch"> <param name="search">`$click.value2$($host$)`</param> <param name="earliest">-1d</param> <!-- this module will grab the value we clicked on and put it in as a searchterm, element_name="some_element_name". --> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="element_name">$click.value2$</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> </param> <!-- finally, we render the search in another FlashChart, and we throw in a JobProgressIndicator for good measure. --> <module name="JobProgressIndicator" layoutPanel="panel_row1_col1_grp2"></module> <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1_grp2"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">bits per second</param> <param name="legend.placement">none</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">160px</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view> New code: Custom wiring the clicks * False 1 dashboard Select host host_setting | metadata type=hosts index=os | sort host True mrtg-2.unix.X.edu host host host_setting addterm $target$ indexed <module name="GenericHeader"> <param name="label">Reports</param> </module> <module name="HiddenSearch"> <param name="search">| lookup all_hosts host OUTPUT report | head 1 | fields + host report | fields - _time</param> <param name="earliest">-1d</param> <!-- here's the SimpleResultsTable that we'll click on --> <module name="SimpleResultsTable" layoutPanel="panel_row1_col1_grp1"> <param name="displayRowNumbers">false</param> <param name="drilldown">all</param> <param name="entityName">results</param> <!-- We throw in a header so we can tell the user what they clicked on. --> <module name="SimpleResultsHeader" layoutPanel="panel_row1_col1_grp2"> <param name="entityName">results</param> <param name="headerFormat">CHART for time = $time$, cv=$click.value$, cv2=$click.value2$, cn=$click.name$, cn2=$click.name2$</param> </module> <!-- this module will grab the value we clicked on and put it in as a searchterm, element_name="some_element_name". --> <module name="ConvertToIntention"> <param name="intention"> <param name="settingToConvert">click.value2</param> <param name="name">stringreplace</param> <param name="arg"> <param name="element_name"> <param name="value">$click.value2$</param> </param> </param> </param> <!-- this module will grab the value we clicked on and put it in as a searchterm, element_name="some_element_name". --> <module name="ConvertToIntention"> <param name="intention"> <param name="settingToConvert">click.value</param> <param name="name">stringreplace</param> <param name="arg"> <param name="host"> <param name="value">$click.value$</param> </param> </param> </param> <!-- we swap out the search to be a timechart. --> <module name="HiddenSearch"> <param name="search">`$element_name$($host$)`</param> <param name="earliest">-1d</param> <!-- finally, we render the search in another FlashChart, and we throw in a JobProgressIndicator for good measure. --> <module name="JobProgressIndicator" layoutPanel="panel_row1_col1_grp2"></module> <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1_grp2"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">bits per second</param> <param name="legend.placement">none</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">160px</param> </module> </module> </module> </module> </module> </module> </module> </module> ... View more

Hello, I am extracting a few user names from a multiple line log, using MV_ADD=true in transforms.conf and KV_MODE = multi in transforms. The search results look great, and are what I am expecting; a single event per user found. However, when I attempt to dedup the users, I run into problems. The user names are no longer individual events, but are consolidated into the original event. For instance, lets pretend that these are the three logs that I am searching: Username: rabbit Username: snail Username: rabbit Username: turtle Username: rabbit When I attempt to dedup the user name, I get: rabbit, snail rabbit, turtle rabbit I am expecting: rabbit snail turtle I thought that the problem would be resolved by using "multi: invokes multikv to expand a tabular event into multiple events" in props, but it does not. Any ideas? I could always pre-process the data, but I was hoping to do it all in Splunk. Thank you, Jim ... View more

Hello, I see that we have a lot of charting options within Splunk, but I am looking for one in particular - step graphs. Here is a picture of one: http://fatweasel.com/tutorials/python-tutorials/matplotlib/step-graphs-in-malplotlib/ Thank you! Jim ... View more

When I attempt to do this, I get the following error: Error in 'UnifiedSearch': Unable to parse the 'Invalid RHS for comparison' search. Is there a way to accomplish this using a form search? jim from thartmann: Ala Jim 🙂 Here's the XML we're working on... and as you stated, it will not work as is. Should I add a drop down that contains "*" or "NOT" in between the field=$something$? That might get pretty busy, since I already have a lot of fields. <searchTemplate>sourcetype=smartsAlerts service_class=$service_class$ group_owner=$group_owner$ element_name=$element_name$ element_class=$element_class$ event=$event$ | transaction name=active_alerts | search active=$active$</searchTemplate> <fieldset autoRun="true"> <!-- the default is a text box, with no seed value; if user does not input a value, then the $from$ token in searchTemplate will be removed --> <input type="text" token="service_class"> <label>service class</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="group_owner"> <label>group owner</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="element_class"> <label>element class</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="element_name"> <label>element name</label> <default>*</default> <seed>*</seed> </input> <input type="text" token="event"> <label>event</label> <default>*</default> <seed>*</seed> </input> <input type="dropdown" token="active"> <populatingSavedSearch fieldForValue="active" fieldForLabel="active"><![CDATA[drop down active]]></populatingSavedSearch> <label>active?</label> <choice value="true OR false">Both</choice> <default>true</default> <seed>true</seed> </input> <input type="time" /> </fieldset> ... View more

Can I customize the icons displayed when using iconify? I think it would be cool if I could map specific icon to an eventtype within a transaction. Jim ... View more