Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tomawest
tomawest
Path Finder
Member since:
08-20-2018
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 3 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 08-20-2018 |
Activity Feed
- Got Karma for Re: How do I create an alert when a value is greater than "X" directly following a specific string within a log file?. 01-20-2023 08:27 AM
- Got Karma for Re: How can I implement a pseudo-searchWhenChanged functionality for inputs using a JS button?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I find a number of non-null values and put them in a column?. 06-05-2020 12:50 AM
- Karma Re: How to configure props and transforms.conf based on the rex extractions in my sample search? for xpac. 06-05-2020 12:49 AM
- Karma Re: What are your Splunk t-shirt ideas? for landen99. 06-05-2020 12:49 AM
- Karma Re: How to sort severity in search? for niketn. 06-05-2020 12:49 AM
- Karma Re: Passed AppInspect but still no AppInspect badge for smoir_splunk. 06-05-2020 12:49 AM
- Got Karma for Re: How do I create an alert when a value is greater than "X" directly following a specific string within a log file?. 06-05-2020 12:49 AM
- Karma Re: How to hide or grey out Clone option under Edit on Splunk dashboard? for nabeel652. 06-05-2020 12:47 AM
- Karma Re: How to search the total number of business hours of an event from a csv file? for javiergn. 06-05-2020 12:47 AM
- Posted Re: How to display a bargraph or a line graph for # of ERROR level logs per 5 minutes over the last on Dashboards & Visualizations. 10-23-2019 05:32 AM
- Posted Re: Handling splunk dashboard token on Dashboards & Visualizations. 10-23-2019 05:28 AM
- Posted Re: Re SPL Rehab app: Search Head Cluster deployment support? on All Apps and Add-ons. 09-13-2019 06:47 AM
- Posted Re: How can I implement a pseudo-searchWhenChanged functionality for inputs using a JS button? on Dashboards & Visualizations. 07-16-2019 02:07 PM
- Posted Re: How to show a dashboard panel- only if one or more input token is set? on Dashboards & Visualizations. 06-21-2019 06:13 AM
- Posted Re: Using url form parameters in section of dashboard to create tokens for panel depends on Dashboards & Visualizations. 06-14-2019 01:22 AM
- Posted Re: How do I get my token based value to not show a $result.total$ output??? on Dashboards & Visualizations. 12-21-2018 01:56 AM
- Posted Re: Can you help me with the time series data and axis behavior on a chart? on Monitoring Splunk. 11-30-2018 08:47 AM
- Posted Re: How do I find a number of non-null values and put them in a column? on Splunk Enterprise. 11-30-2018 08:42 AM
- Posted Re: How do I read logs from splunk>enterprise into my application? on Splunk Dev. 11-30-2018 08:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
10-23-2019
05:32 AM
Check out the timechart command. link to docs
If you're new to splunk I would also recommend the splunk fundamentals course
... View more
10-23-2019
05:28 AM
Set the default value for both text fields to * .
Your issue is that the token is unset when nothing is entered in.
... View more
09-13-2019
06:47 AM
Hey @wryanthomas
Thanks for letting me know. I will take a look and get back to you when I can.
Thanks
Tom
... View more
07-16-2019
02:07 PM
1 Karma
Try the following
- store the inputs in their tokens as I assume you are already.
- create hidden text fields for each input but do not change them when you change the value of your inputs
- on selection of the button, assign a hidden text field to now()
- on change of the hidden text field, assign the mapped hidden text fields to the values of your inputs
... View more
06-21-2019
06:13 AM
Hi,
Look at the option with inputs. Further info for this can be found in the docs here
2 and 3: You're after some advanced token logic. I have an example dashboard which may be of use. In essence I use hidden text fields to set the values of multiple tokens and replicate logic throughout without having loads of set and unset statements all over the place.
<form script="tokenlinks.js">
<label>Button Handler Updated</label>
<!--
<init>
<set token="ShowDev"></set>
</init>
-->
<fieldset submitButton="false"></fieldset>
<row>
<panel depends="$ShowBoth$">
<html>
<button class="btn" data-set-token="form.DateButton" data-value="Show">Show Date</button>
<button class="btn" data-set-token="form.SecsButton" data-value="Show">Show Time</button>
<button class="btn" data-set-token="form.AllButton" data-value="Show">Show All</button>
</html>
</panel>
<panel depends="$ShowDate$">
<html>
<button class="btn" data-set-token="form.DateButton" data-value="Show">Show Date</button>
<button class="btn" data-set-token="form.SecsButton" data-value="">Hide Time</button>
<button class="btn" data-set-token="form.AllButton" data-value="Show">Show All</button>
</html>
</panel>
<panel depends="$ShowSecs$">
<html>
<button class="btn" data-set-token="form.DateButton" data-value="">Hide Date</button>
<button class="btn" data-set-token="form.SecsButton" data-value="Show">Show Time</button>
<button class="btn" data-set-token="form.AllButton" data-value="Show">Show All</button>
</html>
</panel>
<panel depends="$ShowHide$">
<html>
<button class="btn" data-set-token="form.DateButton" data-value="">Hide Date</button>
<button class="btn" data-set-token="form.SecsButton" data-value="">Hide Time</button>
</html>
</panel>
</row>
<row>
<panel>
<single depends="$ShowDatePanel$">
<search>
<query>
| makeresults | eval ShowMessage=strftime(now(),"%b %e") | fields ShowMessage
</query>
</search>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="underLabel">Date</option>
</single>
<single depends="$ShowSecsPanel$">
<search>
<query>
| makeresults $ShowSecsPanel$ | eval ShowMessage=strftime(now(),"%H:%M:%S") | fields ShowMessage
</query>
</search>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="underLabel">Time</option>
<drilldown>
<set token="form.SecsButton"></set>
</drilldown>
</single>
<html rejects="$ShowBoth$">
<button class="btn" data-set-token="form.AllButton" data-value="">Hide All</button>
</html>
</panel>
</row>
<row depends="$ShowDev$">
<panel>
<html>
<h1>DEV CONTROLS</h1>
</html>
</panel>
</row>
<row depends="$ShowDev$">
<panel>
<input type="text" token="DateButton">
<default></default>
<change>
<condition value="Show">
<set token="ShowDatePanel"></set>
<set token="form.SetButtonsInitial">DateShow</set>
<set token="form.AllButton">Date</set>
</condition>
<condition>
<unset token="ShowDatePanel"></unset>
<set token="form.SetButtonsInitial">DateHide</set>
<set token="form.AllButton">Date</set>
</condition>
</change>
</input>
<input type="text" token="SecsButton">
<default></default>
<change>
<condition value="Show">
<set token="ShowSecsPanel"></set>
<set token="form.SetButtonsInitial">SecsShow</set>
<set token="form.AllButton">Secs</set>
</condition>
<condition>
<unset token="ShowSecsPanel"></unset>
<set token="form.SetButtonsInitial">SecsHide</set>
<set token="form.AllButton">Secs</set>
</condition>
</change>
</input>
<input type="text" token="AllButton">
<default></default>
<change>
<condition value="Show">
<set token="form.SecsButton">Show</set>
<set token="form.DateButton">Show</set>
</condition>
<condition value="Date"></condition>
<condition value="Secs"></condition>
<condition>
<set token="form.SecsButton"></set>
<set token="form.DateButton"></set>
</condition>
</change>
</input>
<input type="text" token="SetButtonsInitial">
<default></default>
<change>
<condition match="$form.SecsButton$=="Show" AND $form.DateButton$=="Show"">
<set token="form.ResetButtons"></set>
</condition>
<condition match="$form.SecsButton$=="Show"">
<set token="form.ResetButtons">Secs</set>
</condition>
<condition match="$form.DateButton$=="Show"">
<set token="form.ResetButtons">Date</set>
</condition>
<condition>
<set token="form.ResetButtons">Both</set>
</condition>
</change>
</input>
<input type="text" token="ResetButtons">
<default></default>
<change>
<unset token="ShowBoth"></unset>
<unset token="ShowSecs"></unset>
<unset token="ShowDate"></unset>
<unset token="ShowHide"></unset>
<set token="form.SetButtons">$value$</set>
</change>
</input>
<input type="text" token="SetButtons">
<default></default>
<change>
<condition value="Both">
<set token="ShowBoth"></set>
</condition>
<condition value="Secs">
<set token="ShowDate"></set>
</condition>
<condition value="Date">
<set token="ShowSecs"></set>
</condition>
<condition>
<set token="ShowHide"></set>
</condition>
</change>
</input>
</panel>
</row>
</form>
The tokenlinks js file is the same file you can get from the dashboard examples app. The code is below, however its just to handle the buttons in the same way any other input sets a token value.
require(['jquery', 'underscore', 'splunkjs/mvc', 'util/console'], function($, _, mvc, console) {
function setToken(name, value) {
console.log('Setting Token %o=%o', name, value);
var defaultTokenModel = mvc.Components.get('default');
if (defaultTokenModel) {
defaultTokenModel.set(name, value);
}
var submittedTokenModel = mvc.Components.get('submitted');
if (submittedTokenModel) {
submittedTokenModel.set(name, value);
}
}
$('.dashboard-body').on('click', '[data-set-token],[data-unset-token],[data-token-json]', function(e) {
e.preventDefault();
var target = $(e.currentTarget);
var setTokenName = target.data('set-token');
if (setTokenName) {
setToken(setTokenName, target.data('value'));
}
var unsetTokenName = target.data('unset-token');
if (unsetTokenName) {
setToken(unsetTokenName, undefined);
}
var tokenJson = target.data('token-json');
if (tokenJson) {
try {
if (_.isObject(tokenJson)) {
_(tokenJson).each(function(value, key) {
if (value == null) {
// Unset the token
setToken(key, undefined);
} else {
setToken(key, value);
}
});
}
} catch (e) {
console.warn('Cannot parse token JSON: ', e);
}
}
});
});
... View more
06-14-2019
01:22 AM
I think this is similar to issues I have experienced in the past. Try adding a default value for your show_filters input. Your trigger points are based on a change in value, however you arent actually changing the value when you load the dashboard with a prefilled value as the dashboard will treat that as the initial value (and as such, you arent changing it).
... View more
12-21-2018
01:56 AM
Have you tried this:
<search>
<query>
blah blah blah a search that outputs one row, which is a stats output for a total</query>
<done>
<condition match="'job.resultCount'!=0">
<set token="total">$result.Total$</set>
</condition>
<condition>
<unset token="total"/>
</condition>
</done>
<progress>
<unset token="total"/>
</progress>
</search>
... View more
11-30-2018
08:47 AM
assuming you are using timechart, can you not just use the span statement?
Documentation Here
... View more
11-30-2018
08:42 AM
1 Karma
I think you would get it using the following statement above your table
eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))
... View more
11-30-2018
08:32 AM
This may seem a bit too simplistic however I would run a search across two days along the lines of
search log-level=error | stats count as "totalerrors" by errorType| search totalerrors = 1
... View more
11-30-2018
08:23 AM
It's a bit of a bodge, however however I use a mouse with custom macros (Logitech MX Master). One of the macros I have configured is to perform the following tasks.
Left Click
ctrl + left
shift + ctrl + right
I also have macros for copy and paste too which help a lot when lifting and shifting segments of xml.
The only scenario where this doesnt work is when you want to double click and drag to quickly highlight multiple words.
... View more
10-21-2018
03:31 PM
for whatever reason, I couldn't get it to work correctly for me... It was a shame because I would have much preferred to use that than to have to use virtualbox
... View more
10-20-2018
03:26 PM
I have been looking at how to resolve this within windows and came to the conclusion after many attempts messing around with the filesystem permissions, cygwin, etc that it was just far easier to install Virtualbox and a copy of Ubuntu (other Linix based OS are available). After setting this up and applying the suggested permissions, mine passed first-time!
I'd rather there was an easier way but its not too difficult to use as a workaround.
... View more
10-16-2018
05:20 AM
In order to do this you will need to write some logic in your dashboard to handle different tokens. Essentially the result is that you need to change the token represented for the multi-select.
Take a look here for for some information which should hopefully help: docs.splunk.com/Documentation/Splunk/latest/Viz/tokens
... View more
08-23-2018
10:58 AM
Hi
I have just released an add-on to splunkbase to ingest trello data. Specifically Board, list, card, member and checklist information. In order to use it you do need to obtain a key and token, both of which are available at developers.trello.com.
The link to the app on splunkbase is here.
I'd really appreciate any feedback (good or bad) as I have only been using splunk for a month.
Thanks
Tom
... View more
Hi,
Have you tried the following:
| rex field=_raw "Memory\sused\sby\sAPP:\s(?<MBUsed>\S+)\sMB"
| where MBUsed>4000
... View more
08-20-2018
03:53 PM
Hi,
Thankyou very much for your suggestion, however unfortunately it made no difference.
The answer in the end was as simple as editing the data input within the add-on creator and specify the JSON path as $.[*] within the event extraction settings.
Thanks
Tom
... View more
08-20-2018
08:56 AM
I suspect someone may be able to come up with a cleaner way, however this is the kind of approach I have taken in the past to this kind of issue.
index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low |
eval Risk=if(Risk="Critical","1:". Risk,if(Risk="High","2:". Risk,if(Risk="Medium","3:". Risk,"4:". Risk))) |
chart count by index, Risk |
rex field=Risk "[0-9]+:(?.+)" |
addtotals
... View more
08-20-2018
08:46 AM
Does this work? regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)
... View more
08-20-2018
08:26 AM
Hi,
I've been trying to create a new add-on to ingest some data into a new sourcetype within splunk via a REST API service. Unfortunately the api returns JSON as a full array so I am unable to use the add-on creators function to automatically separate arrays into separate events.
I have been doing a lot of reading into event breaking and looked at a number of solutions to this using LINE_BREAKER and BREAK_BEFORE_ONLY however in both instances I haven't succeeded in breaking the event.
The JSON I have been using is [{"idOrg":"abc123","name":"Joe Smith","active":true,"id":"xyz789"},{"idOrg":"efg456","name":"Michael Thomas","active":true,"id":"uvw456"},{"idOrg":"hij789","name":"Craig Lease","active":true,"id":"rst123"}]
I'm trying to get the data into splunk so each nested json is it's own entry. I.e.
{"idOrg":"abc123","name":"Joe Smith","active":true,"id":"xyz789"}
{"idOrg":"abc123","name":"Michael Thomas","active":true,"id":"uvw456"}
{"idOrg":"abc123","name":"Craig Lease","active":true,"id":"rst123"}
I have managed to get this to work as intended when importing this data via the sourcetype editor using the following in props.conf
SHOULD_LINEMERGE = false
LINE_BREAKER = }(,){
However when running this outside the add-on creator on my machine, I cannot get the same level of success.
It's worthwhile noting that I have the following commands in my props.conf in addition to the ones above:
KV_MODE = json
SEDCMD-remove_header = s/[//g
SEDCMD-remove_footer = s/]//g
pulldown_type = 1
So far I have taken the following actions in order to attempt to resolve this. All of which have had no benefit.
Change LINE_BREAKER to \}(,)\{
Add a new SEDCMD to replace }, with }NEWLINE and change LINE_BREAKER to NEWLINE . The SEDCMD worked as expected but no luck with LINE_BREAKER
Set SHOULD_LINEMERGE to true and LINE_BREAKER to BREAK_BEFORE_ONLY
Any advice at this stage would be very gratefully received.
Regards
Tom
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
