Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About AzJimbo
AzJimbo
Path Finder
Member since:
06-19-2013
08-20-2025
Community Statistics
| Posts | 30 |
| Solutions | 0 |
| Karma Given | 15 |
| Karma Received | 15 |
| Member Since | 06-19-2013 |
Activity Feed
- Posted Re: Failed to load source for Wordcloud visualization on All Apps and Add-ons. 06-19-2024 02:44 AM
- Got Karma for Re: Retrieve names of all fields. 01-05-2024 12:57 PM
- Got Karma for Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?. 05-31-2023 08:03 PM
- Got Karma for Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?. 01-05-2023 01:12 AM
- Got Karma for In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature?. 05-05-2022 06:20 AM
- Posted Re: Events return blank results on Splunk Search. 11-17-2021 11:18 AM
- Tagged Re: Events return blank results on Splunk Search. 11-17-2021 11:18 AM
- Posted Re: Why does Splunk Web sometimes not show the event data for a search unless I restart? on Splunk Search. 11-17-2021 11:17 AM
- Posted network diagram viz on Dashboards & Visualizations. 08-12-2021 03:31 AM
- Posted Re: Quick Reference Guide Card on Splunk Search. 08-05-2021 03:24 AM
- Posted Quick Reference Guide Card on Splunk Search. 08-05-2021 02:58 AM
- Tagged Quick Reference Guide Card on Splunk Search. 08-05-2021 02:58 AM
- Karma Re: After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 10-08-2020 12:01 AM
- Karma Re: TA-pfsense transforms.conf pfsense_sourcetyper broken? for pkt_nspktr. 07-14-2020 04:23 PM
- Karma Re: Changing the color of comment macro for jeffland. 06-05-2020 12:50 AM
- Got Karma for In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature?. 06-05-2020 12:50 AM
- Karma Re: Support for BRO IDS in splunk 7 for mreynov_splunk. 06-05-2020 12:49 AM
- Karma Re: Support for BRO IDS in splunk 7 for jodomingo. 06-05-2020 12:49 AM
- Karma Re: Forced directed graph Source and Destination node opposite arrow direction for niketn. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
06-19-2024
02:44 AM
worked like a champ - note it is a restart required. Debug Refresh (I tried a short cut) did not work. There were several spots in the files that needed the change. Thanks!
... View more
11-17-2021
11:18 AM
this old problem bit me today. Go to 'All Fields' and deselect all fields, then close that window. Once that was settled, I was able to reselect the 'All Fields' option and the Event Viewer repopulated. Not sure why it worked, but it did and thought I'd share.
... View more
- Tags:
- blank
- event viewer
11-17-2021
11:17 AM
2 Karma
this old problem bit me today. Go to 'All Fields' and deselect all fields, then close that window. Once that was settled, I was able to reselect the 'All Fields' option and the Event Viewer repopulated. Not sure why it worked, but it did and thought I'd share.
... View more
08-12-2021
03:31 AM
Is there a trick to adding "value", "type" and "color" to the 'to' entities in this viz? I'm only getting the default values for recipients in one way relationships.
... View more
Labels
- Labels:
-
chart
08-05-2021
03:24 AM
been there, tried that. they couldn't get them now either. Also, in the quantities I'm looking for, that's a challenge. I go through up to between 5 to 10 a quarter. I used to pick up between 20 and 30 at then end of .conf and they lasted a year. Also, I'm not always the only group within my org that need/wants them. If I could buy them from the store, that'd be a sound and fair option.
... View more
08-05-2021
02:58 AM
Hoping to find some physical copies of the Quick Reference Guide on card stock. I was hoping they would be available from the Online Splunk store here: https://www.mypromomall.com/splunk but they are not. I usually pick them up at .conf, but being virtual last year didn't have that opportunity. I'm working with a rotating base of junior folks who use the heck out of them. The cards have been an awesome aid in getting them up to speed.
... View more
02-20-2020
02:29 AM
I used this today for a results panel - thank you.
However, If you just have html to present (instructions or overview or what ever) you can use the html5 tags
<panel>
<html>
<details>
<summary>here's the deetz</summary>
<p>the deetz you're talking about</p>
<details>
<summary>sub-deetz</summary>
<p>the nested sub deetz in html</p>
</details>
</details>
</html>
</panel>
... View more
10-27-2018
12:57 AM
2 Karma
I love this feature in 7.2. The icon up front helped me find and fix a serious ingest issue I was otherwise blissfully unaware of. But, I found the only way to clear the health alert (get the icon to change back to green) was to restart splunkd. Did I miss something in the documentation? Is there an easier way to get the menu icon back to green after an issue is fixed?
... View more
10-23-2018
02:24 PM
Thanks kvswathi - I had the same problem. my curl wouldn't work - your edit suggestion did.
And debug refresh works too (w/o restart)
... View more
10-10-2018
04:20 PM
4 Karma
this was a bad change. Finally got around to upgrading a small dev environment from 6.x and don't like it at all. Such a major change w/o an easy way to opt out creates a bad customer experience. Why make it so hard to change it back? Also, the release notes for 7.1 don't really explain that the custom colors for apps will be majorly impacted. Screen captures in operational SOPs are now all obviously out of date and have to be rewritten as well as internal training documents. ...sigh. I understand the desire to keep the UI fresh, but this was not well thought out. Why not put a way to mod the dashboard.css in the UI? Still love Splunk - but this is frustrating.
... View more
06-21-2018
01:09 AM
Thank you for doing what you do. It's a great app. I've got it pointed at my stream app and am finding some interesting results.
I'm on version 2.0 of the app- just installed it last night. I'm using Firefox 60.0.2 (64-bit) on a windows 10.
I've got the feature enabled, confirmed looking in the xml. I have disabled browser plug-ins that might interfere. I still can't find the feature.
... View more
06-20-2018
04:59 PM
I've been beating my head against a dead horse here; how to I get the Pan Zoom feature to work on the Force Directed viz? I'm sure it's not rocket surgery, but the solution eludes me...
I'm a look at the sample kind of learner, but can't find a sample anywhere.
... View more
03-09-2018
01:15 PM
1 Karma
I was playing with koshyk's query and came up with this one.
Make sure you use fast mode and event sampling 1:100,000 or else it might take forever.
index=whatever
|rename _bkt AS bucketId, _cd AS cd
|stats earliest(_time) as first_event latest(_time) as last_event
by bucketId
|join type=left bucketId
[|dbinspect index=whatever |fields bucketId, state]
|stats first(first_event) AS first_event, last(last_event) AS last_event dc(bucketId) AS buckets by state
|eval last_event=strftime(last_event,"%m/%d/%Y %H:%M")
|eval first_event=strftime(first_event,"%m/%d/%Y %H:%M")
|table first_event, last_event, state buckets |sort - last_event
And if you want to see 'em all:
index=*
|rename _bkt AS bucketId, _cd AS cd
|stats earliest(_time) as first_event latest(_time) as last_event
by bucketId, index
|join type=left bucketId
[|dbinspect index=* |fields bucketId, state index]
|stats first(first_event) AS first_event, last(last_event) AS last_event dc(bucketId) AS buckets by state index
|eval last_event=strftime(last_event,"%m/%d/%Y %H:%M")
|eval first_event=strftime(first_event,"%m/%d/%Y %H:%M")
|table index first_event, last_event, state buckets |sort - last_event
... View more
02-14-2017
12:23 AM
Thank you! works exactly as intended in the search app. I truly appreciate the time and effort you spent putting this together. I think your answer will be viewed and used by many.
Any thoughts on my it won't work in my home made app? I haven't started troubleshooting this yet; I think there might be an underlying dependency I'm not aware of. Other splunk answers indicate if might be css? If someone could point me in the right direction on where to start looking...
jeffland, if you're coming to .conf this year, seek me out, I owe you a beer.
... View more
02-10-2017
01:07 AM
Thanks jeffland, but I can't seem to get this to work. I've placed the js in the [app]/appserver/static directory and changed the permissions & owner to match js in other apps. I've poked, prodded, tweaked and cajoled this seven ways from Sunday and can't seem to get it to change the token. Restarting splunk after each js mod. Perhaps I'm not that adept at troubleshooting the java script. Perhaps another set of eyes on this might see something I'm missing.
I tweaked the sample you provided to better illustrate what I'm working with (and renamed the js file):
<form script="resetappt,js">
<label>_temp input button</label>
<fieldset submitButton="false">
<input type="text" token="app" searchWhenChanged="true">
<default>*</default>
<label>Input</label>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=$app$ | stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<drilldown>
<set token="app">$click.value$</set>
</drilldown>
</chart>
<html>
<center>
<p>$app$</p>
<button type="button" id="buttonId" class="btn">Reset</button>
</center>
</html>
</panel>
</row>
</form>
the script info:
[root@doolin static]# pwd
/opt/splunk/etc/apps/test_app/appserver/static
[root@doolin static]# ls -la
-rw-r--r--. 1 splunk splunk 261 Feb 10 03:09 resetappt.js
[root@doolin static]# more resetappt.js
require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function ($, mvc) {
var tokens = mvc.Components.get("default");
$('#buttonId').on("click", function (e){
tokens.set("form.app", "*");
});
});
Sumpin in there isn't working. I appreciate your time and assistance.
[edit - I did notice the comma in the sample in the form tag and tried it both with the comma and a period]
... View more
02-07-2017
11:29 PM
My challenge is that it doesn't work at all.
... View more
02-06-2017
01:18 PM
1 Karma
I think this is new in 6.5, but I've been able to set variables with an env call in xml
<row>
<panel>
<html>
<h1>Welcome $env:user_realname$ </h1>
You are logged in as $env:user$
</html>
</panel>
</row>
... View more
02-05-2017
12:31 PM
1 Karma
I've got a pie chart with a drilldown by pie slice, I'd like to add a button to the bottom of the panel that allows me to reset the token value to * .
I can get the button to present, and even react when I press it, but can't seem to find the syntax for changing the token value back to the default.
this is what I've got (there are two sample attempts there):
<drilldown>
<set token="app">$click.value$</set>
</drilldown>
</chart>
<html>
<center>$user$
<p/>
<input type="button" value="reset app token" searchWhenChanged="true">
<set token="app">*</set>
<default>*</default>
</input>
<br/>
Reset:<input type="button" token="app" value="*" searchWhenChanged="true">
<br/>
</input>
</center>
</html>
Any ideas?
... View more
07-12-2016
03:18 PM
2 Karma
Here's something I cobbled together based on several answers:
index=*
|eval index_sourcetype=index+"-"+sourcetype
|chart limit=0 count(*) as * by index_sourcetype
|untable index_sourcetype field value
|xyseries field index_sourcetype value
... View more
04-08-2016
01:04 AM
Sooooo..... it's been a couple of years; but I still don't see ICMP in the Stream App? I'm currently running nfdump just so I can get the ICMP, but would much rather use just the Stream app. Looking to detect and alert on icmp tunneling, a method to stealthy exfil data out of a compromised network. (http://www.cs.uit.no/~daniels/PingTunnel/) .
... View more
06-10-2015
12:39 AM
Thanks MuS - The disable in the UI wasn't enabled. I figured it out - I had to go into the data input and repoint the syslog inputs (UDP & TCP) back to the main index. Luckily, my custom field extractions were re-enabled. Once I repointed the data inputs, the 'disable' option in the apps tab was there.
... View more
06-09-2015
04:34 PM
1 Karma
How do I disable this app without losing data? This app has hijacked my syslog, that was configured to go into a different index. I want my syslog back. Also, it only works with specific FiOS equipment. It should better named to avoid this confusion. Nothing on the main page specified FiOS only.
... View more
03-05-2015
10:33 AM
Thanks for getting back to me. I'm currently working on getting YAF with DPI to work, but would really rather have Stream.
... View more
02-14-2015
12:53 AM
Has anyone gotten the Stream App to work on a RaspberryPi? For the ARM processor?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-20-2025
04:06 AM
|
Karma given to
