Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About alinadejeu
alinadejeu
Explorer
Member since:
06-11-2018
05-02-2022
Community Statistics
| Posts | 10 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-11-2018 |
Activity Feed
- Posted Re: Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-20-2019 09:53 AM
- Posted Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-16-2019 12:49 PM
- Tagged Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-16-2019 12:49 PM
- Tagged Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-16-2019 12:49 PM
- Tagged Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-16-2019 12:49 PM
- Tagged Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-16-2019 12:49 PM
- Tagged Button click to run a SPL search containing a token from dashboard on Dashboards & Visualizations. 08-16-2019 12:49 PM
- Posted Re: How to show all of the parsed fields? on Splunk Dev. 10-08-2018 08:52 AM
- Posted How to show all of the parsed fields? on Splunk Dev. 09-28-2018 01:42 PM
- Tagged How to show all of the parsed fields? on Splunk Dev. 09-28-2018 01:42 PM
- Tagged How to show all of the parsed fields? on Splunk Dev. 09-28-2018 01:42 PM
- Posted Re: How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-18-2018 10:16 AM
- Posted Re: How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-18-2018 10:11 AM
- Posted Re: How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-18-2018 09:14 AM
- Posted Re: How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-18-2018 09:03 AM
- Posted How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-17-2018 11:54 AM
- Tagged How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-17-2018 11:54 AM
- Tagged How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-17-2018 11:54 AM
- Tagged How to show/hide panels based on dynamic values? on Dashboards & Visualizations. 07-17-2018 11:54 AM
- Posted How do you colorize event types, so the i column in the search results is colored? on Dashboards & Visualizations. 06-11-2018 10:27 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-20-2019
09:53 AM
Thank I was able to do what I needed with a simple savedsearched for now.
... View more
08-16-2019
12:49 PM
I need to build a js script that will run a splunk search when I click a button on my dashboard.
The search within the .js file needs to: (1) get a token I have set on the dashboard which is $host_tok$ and (2) append the search results to a kv store (named: collected-data) I already have setup.
I would also like the js script to ask for confirmation (yes/no) "Are you sure you want to add $host_tok$ data to the collected-data kv store?" Clicking yes will run the search. Clicking no will close the notification window.
I have a basic understanding of js, but I don't work with it enough to remember how I would build this script.
dashboard xml:
<form script="run_action_test.js">
<fieldset submitButton="false">
<input id="host" type="dropdown" token="host_tok">
<label>Host</label>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>index=main sourcetype=test | stats count by host</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<prefix>host=</prefix>
</input>
<input type="time" token="time_tok">
<label></label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
...
<row>
<panel>
<html
<buttton class="btn btn-primary button1">Copy to KV Store!</button>
</html>
</panel>
</row>
...
... View more
10-08-2018
08:52 AM
In the event anyone else is trying to do something similar I was able to figure out what my .js was missing which were:
managerid: 'details-search-manager',
type: 'table'
...
...
search: 'sourcetype="syndication"' + titleCell.value + '|table *'
... View more
09-28-2018
01:42 PM
I have a table and I wanted to use the "table row expansion" JavaScript (JS) function. I don't know very much about JS.
I have my table and I even have the > info symbol that shows up. However, when I click on the > symbol and the panel attempts to run the expansion search, I get the event I want but not all of the fields are shown.
I would like to get something similar to this:
https://www.aldeid.com/wiki/Splunk/table-expandable-rows-time-picker
so when I click on the > symbol in order to expand the event on within my table, I want all of the parsed fields to display. Like it would if I was using an event instead of a table.
I'm not sure what the issue is.
The dashboard is:
<dashboard script="test.js">
...
<row>
<panel>
<table id="expand_events">
<search>
<query>index=main sourcetype=syndication tag!=* | table published, source, title, summary, id</query>
......
my test.js script:
require([
'splunkjs/mvc/tableview',
'splunkjs/mvc/eventsviewerview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc',
'underscore',
'splunkjs/mvc/simplexml/ready!'
],function(
TableView,
EventsViewer,
SearchManager,
mvc,
_
){
var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({
initialize: function(args) {
// initialize will run once, so we will set up a search and events to be reused.
this._searchManager = new SearchManager({
id: 'details-search-manager',
preview: false
});
this._eventsViewer = new EventsViewer({
managerid: 'details-search-manager'
});
},
canRender: function(rowData) {
// Since more than one row expansion renderer can be registered we let each decide if
// they can handle that data
// Here we will always handle it.
console.log("RowData: ", rowData);
return true;
},
render: function($container, rowData) {
// rowData contains information about the row that is expanded. We can see the cells, fields, and values
// We will find the sourcetype cell to use its value
var titleCell = _(rowData.cells).find(function (cell) {
//console.log("RowData: ", rowData);
return cell.field === 'title';
});
//update the search with the sourcetype that we are interested in
this._searchManager.set({
earliest_time: "$form.TimeRangePicker.earliest$",
latest_time: "$form.TimeRangePicker.latest$",
search: 'source="syndication://DarkReading Attacks-Breaches"' + titleCell.value
}, {tokens: true});
console.log("RowData: ", rowData);
// $container is the jquery object where we can put out content.
// In this case we will render our chart and add it to the $container
$container.append(this._eventsViewer.render().el);
}
});
var tableElement = mvc.Components.getInstance("expand_events");
tableElement.getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer());
});
});
... View more
- Tags:
- eventsviewer
- splunkjs
07-18-2018
10:16 AM
I got it, found the typo. Thanks that works! Greatly appreciate it.
... View more
07-18-2018
10:11 AM
I'm not sure where I'm going wrong:
</input>
<input type="radio" token="sourcetype">
<label>Vol</label>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>|tstats count where $host$ by sourcetype</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<change>
<condition value="netstat">
<set token="panel1">true</set>
<unset token="panel2"></unset>
</condition>
<condition value="arp">
<unset token="panel1"></unset>
<set token="panel2">true</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel depends="$panel1$">
<title>netstat</title>
<event>
<search>
<query>index=*security_forensics $host$ $sourcetype$</query>
... View more
07-18-2018
09:14 AM
So I am using a Universal Forward to send data (text files) to splunk. These files are completely different from one another which is why i have different sourcetypes. netstat and arp are just 2 of the many files being send. Each time we need to investigate a issue these files are generated for investigative purposes. So the host will always be different but the files we create and ingest into splunk are always for example netstat, arp, etc. So what I was trying to do is create a panel for each file (netstat, arp, etc.) and when you pick on the sourcetype you want, the corresponding panel would show.
... View more
07-18-2018
09:03 AM
So that works.... ish.... the issue is, it does generate the sourcetype lists but when I go to check the box on one of the sourcetypes all of the hidden panels appear.
For example I have 2 sourcetypes:
netstat & arp
If I check the box for sourcetype: netstat both netstat and arp panels show up. I would like it when I click netstat only the netstat panel appears.
... View more
07-17-2018
11:54 AM
At the top of my dashboard I have a input that lists a variety of Hosts you can select from. In the screenshot example below I have "i_ubuntu1" selected. Once I click/select the host I want to examine, the host value is passed to another input I have to the right labeled "vol" (in the example screenshot below). The vol input takes that host value and lists the corresponding sourcetypes available. The sourcetype input is using the checkbox option. What I would like to do is when you check one of those sourcetype values the corresponding panel shows below. If the checkbox is not select the corresponding panel is not shown.
I have been trying to look at other splunk answers that have been posted about this topic to figure this out but I'm not sure how to get this to apply because my sourcetype input are dynamic values. Is there a way I can set the token to the value of the sourcetype that is checked? Or something similar. I also don't mind using Radio instead of the checkbox if that helps.
... View more
06-11-2018
10:27 AM
I have an app I'm building that contains an event panel. I know splunk comes with event type colors which I can enable through the UI and it does work just fine. However, I would like to add additional colors. And I am having difficulties trying to figure out how to get it to work. I have found several different splunk communication questions around this and I think I'm close to getting it to work.
To my understanding I have to update 3 files (eventypes.conf, event_renderer.conf, and application.css)
Here is an example of what I have tried:
Eventtypes.conf
[bin_rm]
search = index=* sourcetype=*forensic* desc="*bin/rm*" OR short="*bin/rm*" tag=“deleted_data”
Event_Renderers.conf
[EventRenderer_bin_rm]
eventtype = bin_rm
css_class = EventRendererdeleted_data
Application.css
.splEvent-EventRendererdeleted_data .event{ background-color: #000000; color: #ffffff}
For some reason this is not working, and I don't understand what I'm missing. I would like the > symbol under the i column to appear white with a black background when the eventtype matches.
Also where is the application.css file supposed to be? I currently have it under appserver/static/application.css
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-02-2022
06:44 PM
|
