Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jlhamlet
jlhamlet
Path Finder
Member since:
11-12-2012
4 weeks ago
Community Statistics
| Posts | 14 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 10 |
| Member Since | 11-12-2012 |
Activity Feed
- Posted Dedicated search head with admin rights but not admin of indexer cluster. on Deployment Architecture. 4 weeks ago
- Got Karma for Re: How to block access to the search bar for users in an app?. 02-03-2021 02:24 PM
- Got Karma for Re: How to block access to the search bar for users in an app?. 06-05-2020 12:47 AM
- Got Karma for Re: How to block access to the search bar for users in an app?. 06-05-2020 12:47 AM
- Got Karma for Re: How to write the regex and configure transforms.conf to extract multiple values for one field?. 06-05-2020 12:47 AM
- Got Karma for Limit choices in default TIMEPICKER. 06-05-2020 12:47 AM
- Got Karma for Limit choices in default TIMEPICKER. 06-05-2020 12:47 AM
- Got Karma for Limit choices in default TIMEPICKER. 06-05-2020 12:47 AM
- Got Karma for Limit choices in default TIMEPICKER. 06-05-2020 12:47 AM
- Got Karma for Limit choices in default TIMEPICKER. 06-05-2020 12:47 AM
- Got Karma for Re: TimePicker: Limit the choices on a specifique Dashboard. 06-05-2020 12:46 AM
- Posted Re: How to block access to the search bar for users in an app? on Splunk Search. 06-11-2015 08:23 AM
- Posted Limit choices in default TIMEPICKER on All Apps and Add-ons. 03-13-2015 07:19 AM
- Tagged Limit choices in default TIMEPICKER on All Apps and Add-ons. 03-13-2015 07:19 AM
- Tagged Limit choices in default TIMEPICKER on All Apps and Add-ons. 03-13-2015 07:19 AM
- Tagged Limit choices in default TIMEPICKER on All Apps and Add-ons. 03-13-2015 07:19 AM
- Posted Re: How do you modify drilldown customization from tag clouds? on Dashboards & Visualizations. 03-13-2015 04:13 AM
- Posted Re: How to write the regex and configure transforms.conf to extract multiple values for one field? on Splunk Search. 02-04-2015 01:28 PM
- Posted Re: How to write the regex and configure transforms.conf to extract multiple values for one field? on Splunk Search. 02-04-2015 04:46 AM
- Posted How to write the regex and configure transforms.conf to extract multiple values for one field? on Splunk Search. 02-04-2015 03:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 5 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
4 weeks ago
Hi, My team (Team1) has a cluster of indexers and a search head cluster. We want to add a dedicated a search head to Team 2 where they can be admin. A few conditions and restrictions: - Team 1 should remain admins of the cluster but not of the dedicated search head. - Team 2 should not be able to search certain indexes nor change that setting by any means. In short, there are a few indexes which we do not want Team 2 to see nor tamper the settings to get access to, but we would like them to be admins of their own search head. any suggestions?
... View more
Labels
- Labels:
-
indexer clustering
-
search head
06-11-2015
08:23 AM
3 Karma
Hi,
@David, hope you solved your problem. Here is what i would do:
1 - Give my "normal users" access to the application containing all my dashboards. (by selecting their roles)
Handle the Users rights by changing the permissions on your app
2- Set a default dashboard. (users will fall on the dashboard as they log on and falls directly on your app)
3- On each dashboard panels, hide the followings:
<dashboard hideEdit="true"> # will hide on the dashboard: Edit, More Info, export PDF and Print
...
<option name="link.openSearch.visible">false</option> # will hide Open in Search from under the panel
<option name="link.openPivot.visible">false</option> # will hide Open in Pivot from under the panel
<option name="link.inspectSearch.visible">false</option> # will hide Inspect from under the panel
<option name="link.exportResults.visible">false</option> # will hide Export from under the panel
4- The SEARCH page is a "view" that is set to GLOBAL.
so i would change the permissions on that view so that my normal users could not access to it (even by changing the url)
Hope this helps some of you.
Happy Splunking,
Lloyd,
... View more
03-13-2015
07:19 AM
5 Karma
Hi,
I am trying to limit the choices in the default timepicker in Simple XML.
The ideas is to only keep: "Presets" and "Date & Time Range", and delete the rest for a specific application.
Can you please provide me a way to do this ?
Note: in the Times.conf file, seems like i can only disable/enable what is included in the "Presets" dropdown.
Thank you,
... View more
03-13-2015
04:13 AM
Hello,
Any solution for this ?
Thank you for your help.
... View more
02-04-2015
01:28 PM
1 Karma
Thank You very much for your help. It worked perfectly.
Regards,
... View more
02-04-2015
04:46 AM
Thank you, I will test this and get back to you.
... View more
02-04-2015
03:13 AM
Hi,
I am indexing data with events in this format:
Field1:value1|Field1:value2 .....
In my transforms.conf i set the regex to :
REGEX = (?<_KEY_1>[a-zA-Z]+):(?<_VAL_1>[^|]+)
This only extracts Value1 for Field1 and seems to ignore Value2.
I am a newbie to regex, can someone help me out here ?
Note that the IFX (web interface) does not allow me to extract Value2 to Field1.
Thank you,
... View more
09-15-2014
07:12 AM
Hi
Have you found a solution to this problem ?
Regards,
... View more
07-04-2014
11:28 AM
Hi,
I am using DB CONNECT app to collect data coming from a MySQL database.
The table I am querying has 4 fields. Two of these fields are dates (in different formats). After being indexed in Splunk, the events look as follows:
**datetime1=1404374979 field2=value **datetime2="2014/07/04 - 23:45:00" field4=value
I wish to force Splunk to use datetime1 (Epoch format) as Timestamp.
What options do i have to apply to my props.conf to do so ?
I am thinking on TIME_FORMAT and TIME_PREFIX, but not sure of what option to use.
Also, do i have to clean my index so that changes can apply ?
Thank you for your help.
Regards
... View more
07-03-2014
06:50 AM
Hi Rich,
Thank you, i did not expect it to be that simple 🙂
After your solution "eval end_time=_time+time_taken" i got results in Epoch time.
So i had to convert it using "convert" , "timeformat" and "ctime" to convert it back to normal.
Thank you 🙂
... View more
07-02-2014
07:58 AM
Hi,
I have a proxy log that logs the time the query was executed and also give the duration in seconds.
"11/Jan/2014:00:45:32.755 +0200" - - 1xx.1xx.1xx.43:0 0 - - 3226 "-"
I would like to "add" the seconds (3326) to the timestamp so that i can create a table with:
Start_time = 00:45:32
End time = "00:45:32" + "3336"
To sum up: End_Time should be START_TIME + SECONDS.
Hope i am clear on the explanation.
Thank you for your help
... View more
03-12-2014
07:58 AM
1 Karma
Hello,
I solved my problem differently. This may help some of you:
Select Time Range:
-1w
<!-- Define the default value -->
Past Day
Past Week
And under my searches on the dashboard:
$timerange$
now
Thank you.
Happy Splunking!
... View more
03-12-2014
06:54 AM
Thank you for your answer.
On the other side, i cant get it to work with my code. Do i have to replace my input type=time ?
Thank you,
... View more
03-12-2014
06:25 AM
Hi,
I have two dashboard:
- "Normal" dashboard: With the basic TimePicker.
- Fixed Time report: Here i want the user to be able to select just a few values ( Last 24hours, Last Week, Last Month)
How can i get to limit the choices of the Time Picker on the "Fixed Time Report" ?
Here is the code that works for the "Normal" dashboard :
Normal Report - Category Overview
** **
....
....
Just by using the input type=time, it adds the basic Time Range from Splunk with its default values (Preset, Relative, Real-Time, ...)
Note: I am using Splunk 6
Thank you for your help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
Karma from
