Hi sympatiko! Probably tcp_routing can establish this. There are some good answers on this site on how to establish this ... View more

Is there anything new in 6.2.2 on how to control these messages in a better way? I noticed somewhere in a script under templates/lib.html a reference to a variable DISABLE_MESSENGER but no reference as how to use this. ... View more

Hey All, Within spunk 6.2.2, Is the Messages facility (menu bar) better controllable? Turn it off or filter out system vs user related messages for display etc. I see reference in scripts (under templates/lib.html) like: if 'common.min.js' not in seen: % if disable_messenger: <br> var DISABLE_MESSENGER = true;<br> % endif But not much documentation on how this would work. Thank you! ... View more

what does ...eval code=.....|stats count by code show? ... View more

You need to put the quotes back 😞 I found out (actually i'm testing with index=_internal) ... View more

Robert hi, I also got an error when I copied the expression, after I typed it by hand, it worked. I also removed the " and " from OVERIG, NIAS and GPS ... View more

Hi Jitsinha! Half of my answer was gone i realise 🙂 you could create a script that performs your wanted actions (a search) against the REST API. You can access the REST API with the auth token that is passed when configured in commands.conf. In that case, you don't create a spunk alert, but append your script directly to the search you wanted to create the alert on: | script python . Maybe a bit of a long shot though ..... ... View more

You could configure a command in commands.conf and set passAuth=true, so splunk will pas an authentication token to stdin of the script/command. You can process this in your script with: sessionKey = sys.stdin.readline().strip() tokenize = re.match( r'(.)(.) ... View more

This paste contains some errors 🙂 ... View more

I verified this and it works after restart and clearing your browsercache: cat blabla/appserver/static/table_icons_inline2.js :: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomIconRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'count'; }, render: function($td, cell) { var count = cell.value; // Compute the icon base on the field value var icon; if(count > 3000) { icon = 'alert-circle'; } else if(count > 1000) { icon = 'alert'; } else { icon = 'check'; } // Create the icon element and add it to the table cell $td.addClass('icon-inline numeric').html(_.template('<%- text %> <i class="icon-<%-icon%>"></i>', { icon: icon, text: cell.value })); } }); mvc.Components.get('table1').getVisualization(function(tableView){ // Register custom cell renderer tableView.table.addCellRenderer(new CustomIconRenderer()); // Force the table to re-render tableView.table.render(); }); mvc.Components.get('table2').getVisualization(function(tableView){ // Register custom cell renderer tableView.table.addCellRenderer(new CustomIconRenderer()); // Force the table to re-render tableView.table.render(); }); }); ————————— cat blabla/default/data/ui/views/custom_table_icon_set_inline2.xml: <label>Table Icon Set (Inline)</label> <row> <table id="table1"> <title>Render Icons based on rangemap result</title> <searchString>index=_internal | stats count by sourcetype,source,host</searchString> <earliestTime>-1h</earliestTime> <option name="drilldown">none</option> </table> </row> <row> <table id="table2"> <title>Render second table Icons based on rangemap result</title> <searchString>index=_internal | stats count by component</searchString> <earliestTime>-1h</earliestTime> <option name="drilldown">none</option> </table> </row> ... View more

Btw when i use: index=_internal |timechart count(eval(log_level="ERROR")) AS NOK count(eval(log_level!="ERROR")) AS OK|eval Nodata=if(NOK+OK=0,1,0) and choose stacked area representation, I get a nice 100% stacked graph that has an additional "Nodata" variable when I receive no hits on OK or NOK ... View more

Jonathan hi! Yes and it did work also :-). If I remember correctly: I needed to restart spunk (but am not sure anymore on that) You need to use all table-id's you defined in your javascript in the dashboard. gr. ... View more

and of course the }); after each mvc.Components table def 😉 ... View more

You can add the following to the javascript for each table needed: mvc.Components.get('table2').getVisualization(function(tableView){ // Register custom cell renderer tableView.table.addCellRenderer(new CustomIconRenderer()); // Force the table to re-render tableView.table.render(); mvc.Components.get('table3').getVisualization(function(tableView){ // Register custom cell renderer tableView.table.addCellRenderer(new CustomIconRenderer()); // Force the table to re-render tableView.table.render(); etc. and use these as your additional table id's in the dashboard ... View more