About johnnyfrx

johnnyfrx · ‎09-12-2018

The search below throws the error whenever there are more than two hosts searched for.: command="predict", Too few data points: -5. Need at least 1 (too many holdbacks (5) maybe?) If searching for just one host, the data is perfect. I have 700+ hosts that I need to run this against. Any ideas? Here is the search that returns the error: | inputlookup test_diskusage.csv | search host=splunk-indexer-1 | eval _time=strptime(date, "%Y-%m-%d") | timechart span=1d values("/opt/splunk") as "/opt/splunk", values(cold0) AS cold0, values(cold1) AS cold1, values(hot0) AS hot0, values(hot1) AS hot1, values(hot2) AS hot2 | predict "/opt/splunk" "cold0" "cold1" "hot0" "hot1" "hot2" algorithm=LLP5 holdback=5 future_timespan=25 upper95=upper95 lower95=lower95

niketn · ‎08-30-2018

@Mohsin123 while <input> can be brought inside <panels> , fieldset node has to be outside <row> in the root dashboard node i.e. <form> in case Splunk inputs are used. Following is example of input <form> <fieldset submitbutton="true"> <input type="dropdown" token="token1"> .... </input> </fieldset> <row> <panel> ... </panel> </row> ... </form> Following is example of moving Inputs inside panel... But Submit button stays outside: <form> <fieldset submitbutton="true"> </fieldset> <row> <panel> <input type="dropdown" token="token1"> .... </input> ... </panel> </row> ... </form> So if you want to use Splunk's Submit Button you would need to use CSS Override to position Submit Button Inside specific panel using relative position. Alternatively, you can create <html> panel with button <input> but you need to use Simple XML JS extension with Splunk JS Stack to code the button Click handler to function similar to how Splunk's Submit button works. You should be able to find examples of both on Splunk Answers. Let us know if you need help with those.

keiran_harris · ‎04-05-2020

Did you solve this @ljalvrdz - im having an identical issue. have tried across splunk enterprise 7.1.2 and over the weekend upgraded to 8.0.3, but still no joy. Any help appreciated, thanks!

mayurr98 · ‎08-24-2018

It’s all multiple choice and fill in the blank like cert 1.

johnnyfrx · ‎08-23-2018

When I run the search below, only one search head (SH) shows in the results...But... I do know that there are 18 SH's out there which do show up in the SH Clustering page with the role of Member. Does the search result mean that only one of the 18 is actually doing any work? | rest /services/server/info |search server_roles = shc_member

DEAD_BEEF · ‎08-23-2018

A lookup table will only provide an exact match to a field but what you want is a wildcard on the values in your lookup table. This can be done through a few steps: 1. create lookup table with wildcard entries *baddomain.com* 10.10.10.10* *domain.com* 2. Upload file to splunk as test_lookup.csv 3. Create lookup definition ( test_lookup for test_lookup.csv ) 4. Create transforms.conf entry [test_lookup] filename = test_lookup.csv match_type=WILDCARD(SearchString) 5. Reload splunk Now your lookup table will use wildcards.

Posts	11
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎08-23-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why is my below search throwing the following erro...

Why does my search result show only one Search Hea...

Why is my below search throwing the following erro...

Re: Why is the submit button inside a panel not wo...

Re: Splunk_TA_nix: why are my reports showing "No ...

Re: Is it okay to start fundamentals 2 before the ...

Why does my search result show only one Search Hea...

Re: Is using inputlookup or lookup commands the be...