Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About renjith_nair
renjith_nair
Legend
Member since:
01-08-2015
Online
Community Statistics
| Posts | 2467 |
| Solutions | 637 |
| Karma Given | 55 |
| Karma Received | 926 |
| Member Since | 01-08-2015 |
Activity Feed
- Got Karma for Re: How do you parse and chart fields in a JSON array?. yesterday
- Posted Re: service status of a service including Disaster Recovery situation on Splunk Search. yesterday
- Posted Re: How to add download button while hiding the result s of the panel on Splunk Cloud Platform. yesterday
- Got Karma for Re: How to add download button while hiding the result s of the panel. yesterday
- Posted Re: How to add download button while hiding the result s of the panel on Splunk Cloud Platform. yesterday
- Got Karma for Re: Customised Dashboard - How to create a dropdown to show specific panel visuals?. yesterday
- Posted Re: Projects on Dashboards & Visualizations. Wednesday
- Posted Re: Search for ip in lookup based on system alias in csv on Getting Data In. Wednesday
- Posted Re: Configure static color by value in splunk dashboard studio on Dashboards & Visualizations. Wednesday
- Posted Re: how to add a textbox value to a multiselect input in order to filter out all values selected in multiselect on Dashboards & Visualizations. Wednesday
- Posted Re: how to add a textbox value to a multiselect input in order to filter out all values selected in multiselect on Dashboards & Visualizations. Tuesday
- Posted Re: Configure static color by value in splunk dashboard studio on Dashboards & Visualizations. Tuesday
- Karma Kuala Lumpur Malaysia Splunk Usergroup May month meeting for inventsekar. Tuesday
- Posted Re: How to add download button while hiding the result s of the panel on Splunk Cloud Platform. Tuesday
- Posted Re: How to Create a custom Configuration Table in the view of the application? on Splunk Enterprise. Tuesday
- Posted Re: how to add a textbox value to a multiselect input in order to filter out all values selected in multiselect on Dashboards & Visualizations. Tuesday
- Posted Re: Need to replace null values to space or some other valuefs in output table results on Splunk Search. Friday
- Karma Introducing the 2024 Splunk MVPs! for SplunkCommunity. a week ago
- Karma Introducing the 2024 SplunkTrust! for SplunkCommunity. a week ago
- Posted Re: How to get token values from dropdown to splunk query? on Dashboards & Visualizations. a week ago
Topics I've Started
yesterday
There are multiple methods to achieve this. However, lets first try it in a simpler way index=mday source="service_status.ps1" sourcetype=service_status os_service="App_Service" host=*papp01
|stats latest(status) AS status by host
|eventstats values(status) as _status
|eval OverallStatus=if(mvcount(_status) < 2 OR isnull(mvfind(_status,"Running")),"Down","Good") Steps - count the status values - If the count is less than 2 : meaning only one of the status from Running/Stopped is present - OR Running status is not available, we are setting the overall status as down. In this way, we can handle multiple situations where one of the server is down or both are reporting down or even both are reporting Running (active & passive) Demonstrated with a dummy search |makeresults|eval host="HostA",status="Running"
|append[|makeresults|eval host="HostB",status="Stopped"]
|stats latest(status) as status by host
|eventstats values(status) as _status
|eval OverallStatus=if(mvcount(_status) < 2 OR isnull(mvfind(_status,"Running")),"Down","Good") Try changing the status of HostA or HostB and see the results.
... View more
yesterday
Ok, lets check if the results are available by just removing below from the dashboard depends="$hide_this_always$" We need to confirm the sid is available since its part of the download path. So either in the title of the panel or somewhere just display the token. If the result is available and sid is present, try using the URL directly in the browser to make sure that the result is fetched. Here is a sample dashboard created using the same logic and it works <dashboard version="1.1" theme="light">
<label>Download</label>
<row>
<!-- Below is the table with the results. We are setting the panel depends to a non existing token so that it always false the panel is not visible.-->
<panel depends="$hide_always$">
<title>$sid$</title>
<table>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<eval token="date">strftime(now(), "%d-%m-%Y %H:%M:%S")</eval>
<set token="sid">$job.sid$</set>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<!-- Setting the title for testing purpose and making sure that the SID is available in the token -->
<title>Job Id is : $sid$, Time is : $date$</title>
<html>
<a href="/api/search/jobs/$sid$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=test_$date$.csv&outputMode=csv" class="button js-button">Download</a>
<style>
.button {
background-color: steelblue;
border-radius: 5px;
color: white;
padding: .5em;
text-decoration: none;
}
.button:focus,
.button:hover {
background-color: #2A4E6C;
color: White;
}
</style>
</html>
</panel>
</row>
</dashboard>
... View more
yesterday
It works, I have an IP list based on the specified system name (prod etc). Now how can I associate this list with a search? So that the list of IPs displayed by this query can be attached to dscip | search sourcetype="new" DstIP=(list of above ip)
... View more
Wednesday
Splunk is very security focused and has many apps and various options for data etc.... A couple of tips: When I first started, I had a play with this App, its a great way to learn about security datamodels and dashboards. Its not Splunk ES SIEM but its still very good to have a play with and learn. https://splunkbase.splunk.com/app/4240 The other one to install and have a play with is security essentials - this provide so much security content, again good to learn about. (This is not a SIEM or monitoring app) and its my go to for security use cases. https://splunkbase.splunk.com/app/3435
... View more
Wednesday
@vananhnguyen For that we need to know what value comes to map it with a color. We can transpose the result and set the result as column values and set the colors. Please check the following run anywhere example. makeresults is just used to create a set of dummy data {
"visualizations": {
"viz_PKMJkTej": {
"type": "splunk.column",
"options": {
"y": "> primary | frameBySeriesNames('count','Critical','Failure','Info','Success')",
"seriesColorsByField": {
"Critical": "#dc4e41",
"Failure": "#f8be34",
"Success": "#53a051",
"Info": "#0051B5"
},
"x": "> primary | seriesByName('count')",
"y2": "> primary | frameBySeriesNames('Critical','Failure','Info','Success')"
},
"dataSources": {
"primary": "ds_Lmyq9G4p"
}
}
},
"dataSources": {
"ds_Lmyq9G4p": {
"type": "ds.search",
"options": {
"query": "| makeresults count=100 \n| eval value=random() \n| eval status=case(value%2==0,\"Success\",value%3==0,\"Failure\",value%4==0,\"Warning\",value%5==0,\"Critical\",1==1,\"Info\") \n| stats count by status \n| transpose header_field=status column_name=count"
},
"name": "Search_1"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_PKMJkTej",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 1010,
"h": 300
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "",
"title": "Static Colors"
}
... View more
Tuesday
You can make use of the KV store to store information and retrieve https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/ https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/ https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/ Splunk JS can be then used to control the button actions and processing the record. There were some dev materials available explaining the overall process but looks like its removed. There are some third party documentation available in public for splunk KVStore CRUD
... View more
Friday
@ravir_jbp , Did you try fillnull https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull OR replace in case its a literal value NULL https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace
... View more
a week ago
Since you already have applicationName=" as your prefix, this line index=mulesoft environment=$env$ applicationName=$BankApp$ InterfaceName=$interface$ will expand to index=mulesoft environment=$env$ applicationName=applicationName="*" InterfaceName=InterfaceName="*" Either remove applicationName= from your prefix or from your search index=mulesoft environment=$env$ $BankApp$ $interface$
... View more
a week ago
@karthi2809 Try this example. Changes : While setting the token on the change event, you should use the values . PS : Added a token to the Interface text to demonstrate the changes. <form version="1.1" theme="light">
<label>Depends_Rejects</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel id="panel_layout">
<input id="input_link_split_by" type="link" token="tokSplit" searchWhenChanged="true">
<label></label>
<choice value="Finance">OVERVIEW</choice>
<choice value="BankIntegrations">BANKS</choice>
<default>OVERVIEW</default>
<initialValue>OVERVIEW</initialValue>
<change>
<condition value="Finance">
<set token="Finance">$value$</set>
<unset token="BankIntegrations"></unset>
</condition>
<condition value="BankIntegrations">
<set token="BankIntegrations">$value$</set>
<unset token="Finance"></unset>
</condition>
</change>
</input>
</panel>
</row>
<row>
<panel>
<input type="time" token="time" searchWhenChanged="true">
<label>Time Interval</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Environment</label>
<choice value="*">ALL</choice>
<choice value="DEV">DEV</choice>
<choice value="TEST">TEST</choice>
<choice value="PRD">PRD</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$">
<label>ApplicationName</label>
<choice value="*">ALL</choice>
<choice value="p-wd-finance-api">p-wd-finance-api</choice>
<default>"p-wd-finance-api</default>
<initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue>
<fieldForLabel>ApplicationName</fieldForLabel>
<fieldForValue>ApplicationName</fieldForValue>
</input>
<input type="text" token="InterfaceName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$">
<label>InterfaceName</label>
<default>$tokSplit$</default>
<initialValue></initialValue>
</input>
<input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$">
<label>ApplicationName</label>
<choice value="p-wd-finance-api">p-wd-finance-api</choice>
<default>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</default>
<initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue>
<fieldForLabel>ApplicationName</fieldForLabel>
<fieldForValue>ApplicationName</fieldForValue>
</input>
<input type="text" token="InterfaceName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$">
<label>InterfaceName</label>
<default>$tokSplit$</default>
<initialValue></initialValue>
</input>
</panel>
</row>
</form> Hope it helps!
... View more
a week ago
@selvam_sekar Are you trying to achieve something similar? Here is a run anywhere example . Number input is only to change the value in the A box for demonstration {
"visualizations": {
"viz_mP9NTc6l": {
"type": "splunk.singlevalue",
"options": {
"trendColor": "#171d21",
"backgroundColor": "#dc4e41"
},
"dataSources": {
"primary": "ds_uCpsCnrn"
}
},
"viz_5qfKAE2H": {
"type": "splunk.singlevalue",
"options": {
"backgroundColor": "#b6c75a"
},
"dataSources": {
"primary": "ds_s5yiPOpw_ds_uCpsCnrn"
}
},
"viz_lwpeyQcS": {
"type": "splunk.singlevalue",
"options": {
"backgroundColor": "#62b3b2"
},
"dataSources": {
"primary": "ds_6iVMrVEi_ds_s5yiPOpw_ds_uCpsCnrn"
}
},
"viz_P6dRCwGc": {
"type": "abslayout.line"
},
"viz_jTW6Jy5J": {
"type": "abslayout.line"
}
},
"dataSources": {
"ds_uCpsCnrn": {
"type": "ds.search",
"options": {
"enableSmartSources": true,
"query": "| makeresults count=$number$\n| stats count"
},
"name": "A"
},
"ds_s5yiPOpw_ds_uCpsCnrn": {
"type": "ds.search",
"options": {
"enableSmartSources": true,
"query": "| makeresults count=5\n| stats count"
},
"name": "B"
},
"ds_6iVMrVEi_ds_s5yiPOpw_ds_uCpsCnrn": {
"type": "ds.search",
"options": {
"enableSmartSources": true,
"query": "| makeresults\r\n| eval variance=$A:result.count$ - $B:result.count$\r\n| table variance"
},
"name": "Variant"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
},
"input_vWVKiJlJ": {
"options": {
"defaultValue": 10,
"token": "number"
},
"title": "Number Input Title",
"type": "input.number"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_mP9NTc6l",
"type": "block",
"position": {
"x": 410,
"y": 170,
"w": 150,
"h": 100
}
},
{
"item": "viz_5qfKAE2H",
"type": "block",
"position": {
"x": 680,
"y": 170,
"w": 150,
"h": 100
}
},
{
"item": "viz_lwpeyQcS",
"type": "block",
"position": {
"x": 520,
"y": 370,
"w": 150,
"h": 100
}
},
{
"item": "viz_P6dRCwGc",
"type": "line",
"position": {
"from": {
"x": 483,
"y": 274
},
"to": {
"item": "viz_lwpeyQcS",
"port": "n"
}
}
},
{
"item": "viz_jTW6Jy5J",
"type": "line",
"position": {
"from": {
"x": 756,
"y": 272
},
"to": {
"item": "viz_lwpeyQcS",
"port": "n"
}
}
}
],
"globalInputs": [
"input_global_trp",
"input_vWVKiJlJ"
]
},
"description": "",
"title": "Variance_Test"
}
... View more
a week ago
It could be in the default location as well Try the command and should give you some pointers splunk btool web list --debug|findstr cert Or in details splunk btool web list settings
... View more
03-05-2024
10:36 PM
This solution is not helping us please provide some good solution so that i can change the colour in the single value itself as I am not using the dropdown as status . Even I applied above changes in my code but the color for stopped and running did not change. above is my code after a change but no color change happened, Please help me here asap.
... View more
03-01-2024
07:43 PM
1 Karma
Can you try changing the condition value to tok1* instead of tok1 ? Here is a run anywhere example for reference <form version="1.1" theme="light">
<label>Tokens</label>
<fieldset submitButton="false">
<input type="dropdown" token="project" searchWhenChanged="true">
<label>Project</label>
<choice value="tok1*">Token1</choice>
<choice value="tok2*">Token2</choice>
<change>
<condition value="tok1*">
<set token="x-key">Key1</set>
</condition>
<condition value="tok2*">
<set token="x-key">Key2</set>
</condition>
</change>
</input>
<input type="multiselect" token="Record">
<label>Record</label>
<delimiter> ,</delimiter>
<fieldForLabel>Record</fieldForLabel>
<fieldForValue>Record</fieldForValue>
<search>
<query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|search project=$project$ AND x-key=$x-key$</query>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<title>Project = $project$ , Key = $x-key$, Record = $Record$</title>
<table>
<title>Results</title>
<search>
<query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|where Record in ($Record$)</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
... View more
02-28-2024
05:40 PM
1 Karma
5 years later and I came upon this. This should be the actual, concise answer for OP's question.
... View more
02-27-2024
07:31 AM
Thanks. That worked.
... View more
02-26-2024
10:19 AM
@renjith_nair Thank you so much It works!
... View more
02-26-2024
04:14 AM
From the syntax `Exempted_Dark_Devices`, it's a macro. Look in the macro definitions and you should be able to find the expansion of this macro https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros
... View more
02-24-2024
02:57 AM
@Abhigyan_2907 , Assuming that by PCF , you meant Pivotal Cloud Foundry Without looking at the sample logs, it's difficult to formulate a search to get the logs. There are different log types for applications and based on your requirement , you could search the respective types. Have a look at this https://docs.cloudfoundry.org/devguide/deploy-apps/streaming-logs.html
... View more
02-20-2024
04:07 AM
Please have a look at https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Configurethepeerindexes
... View more
02-04-2024
09:59 PM
Any idea? how to hide in studio dashboard?
... View more
01-03-2024
06:12 AM
You can use a token modifier |s to escape double quotes. $token$ $token|s$ The value of the tokens get parsed asdf="asdf" "asdf=\"asdf\"" Unfortunately, this also adds double quotes around it, which makes this modifier useless in all my work. I would have preferred only having 1 effect per modifier that can stack with others for those that want both, but this might work for others. The modifiers for tokens inside of alert action email bodies may not be available, but it will work in dashboards. Source: https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/tokens#Syntax_to_consume_tokens
... View more
- Tags:
- token filters
12-21-2023
01:53 AM
Splunk documentation has a page that guides customers to troubleshoot similiar issues as you described, like when they don't find the data/events. "Are you searching for events and not finding them, or looking at a dashboard and seeing "No result data"? Here are a few common mistakes to check." https://docs.splunk.com/Documentation/Splunk/9.1.2/Troubleshooting/Cantfinddata
... View more
12-20-2023
09:28 PM
Did you mean the drop down is not enabled to select? If thats the case, check the search which populates the dropdown. If it uses the macros, then ensure that the user/app has permissions to access the macro and is expending the search
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
34 seconds ago
|
Karma from
Karma given to
