About KevinAdu

KevinAdu · ‎12-20-2015

Yeah but the issue is that will show it in the unix timestamp format. So I was hoping I could change it to make it more readable. Where I saw the eval command being used that way was on this page: http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/tokens

KevinAdu · ‎12-15-2015

In my Splunk Dashboard, I have a time picker and charts which shows a search for each subsequent day from the earliest time selected in the time picker. I want to display a formatted date in a label for each chart. So for example: Day 1 - 15/12/2015 Day 2 - 16/12/2015 Day 3 - 17/12/2015 etc I understand that these dates can be derived from the time picker's token. Here is what I have attempted so far just for the first date but it does not seem to work: <input type="time" token="InputTime"> <label>TimePicker for SourceType</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <chart> <eval token="new_time">strptime($InputTime.earliest$, "%m/%d/%Y")</eval> <title>Day 1 - $new_time$</title> Could anybody tell me what I am doing wrong? Thanks

KevinAdu · ‎08-20-2015

Hello, I have created a dashboard with some very simple searches, for example: index=something | stats count In our dashboard every time it is run the results seem to vary. When run in the search bar we seem to consistently get the same result as expected. After a bit of research I realised that dashboards are run in Fast Mode. So I decided to change the dashboards so that they run in Verbose mode. The way I have done that was changing the dashboard to HTML and adding the following line to the search managers in the JavaScript portion: "adhoc_search_level": "verbose" Now after adding this, the correct results consistently show in dashboards. This is undesirable as it make the dashboards a bit difficult for us to change and other reasons. So my questions are: 1) Why is this happening? Surely depending on what mode you run your search in, it shouldn't affect the results. 2) Is there any other way to solve this without converting my dashboard into an HTML one? Thanks for you time.

KevinAdu · ‎08-03-2015

Could you explain what you did to add your data to the summary index? Did you end up changing the search string to use a reporting command? Or somehow used the collect command to place your data in the summary index?

KevinAdu · ‎11-27-2014

I think I found out the problem. 2 things: 1) Yes my regex was definitely wrong for the REGEX and FORMAT fields. 2) Since my file wasn't getting updated there was nothing to forward and hence the changes wouldn't be applied.

KevinAdu · ‎11-25-2014

Oh I see, FORMAT doesn't use regex at all. I just tried with the new FORMAT value and with SEDCMD but still no changes. Could it possibly be that it's not reading the props or transforms files at all? Is there anyway to check if it's doing so?

KevinAdu · ‎11-25-2014

Yes it is. It says that both in the inputs.conf on the forwarder and in the event when searched for.

KevinAdu · ‎11-25-2014

Still a bit new to Splunk but here goes my question. My setup is pretty simple, it consists of a heavy forwarder sending logs to an indexer. On the heavy forwarder, I want to mask some data before I send it to the index data. An example of the event looks like this: Example Event 9/12/2014 17:21 Shawn Michaels 21.00 2013210345537512 I want to mask the last series of digits like this: 201321######7512 The edited config on my heavy forwarder is using the props.conf and transforms.conf. They look like this: props.conf [test-masking] TRANSFORMS-masking = mask transforms.conf [mask] REGEX = (.*)\s\d{16}$ FORMAT = $1\s\d{6}######\d{4}$2 DEST_KEY = _raw The issue is that the data gets forwarded fine but the data doesn't seemed to have changed in anyway. Does anything look strange?

Posts	8
Solutions	1
Karma Given	8
Karma Received	2
Member Since	‎03-29-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to use eval on a token from a time picker and ...

Dashboard not showing correct results

How to configure a heavy forwarder to anonymize da...

Re: How to use eval on a token from a time picker ...

How to use eval on a token from a time picker and ...

Dashboard not showing correct results

Re: Create Summary Index from Table?

Re: How to configure a heavy forwarder to anonymiz...

Re: How to configure a heavy forwarder to anonymiz...

Re: How to configure a heavy forwarder to anonymiz...

How to configure a heavy forwarder to anonymize da...