Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About fk319
fk319
Builder
Member since:
10-19-2010
03-18-2021
Community Statistics
| Posts | 144 |
| Solutions | 10 |
| Karma Given | 66 |
| Karma Received | 43 |
| Member Since | 10-19-2010 |
Activity Feed
- Posted Re: How to use same set of filter value on multiple Dashboard on Splunk Dev. 03-16-2021 12:37 PM
- Posted Re: Pyton SDK custom command runing distributed instead of local only on Splunk Dev. 03-16-2021 12:34 PM
- Posted Running a script on the Search Head initiated from browser on Splunk Dev. 03-16-2021 09:58 AM
- Posted Re: Sending Splunk email alert with variable email address and variable subject values. on Splunk Enterprise. 08-11-2020 11:39 AM
- Posted Re: Splunk 8.0 sendemail/subsearch issues after upgrading on Splunk Search. 07-15-2020 01:25 PM
- Karma Re: Deployment Server - when app is redeployed, what is overwritten for Lowell. 06-11-2020 05:59 AM
- Karma Re: Use lookup table to populate otherwise empty rows for rmmiller. 06-05-2020 12:51 AM
- Karma How to disable realtime searches for the power user role? for skoelpin. 06-05-2020 12:49 AM
- Karma Re: App.conf version is empty on .spl file for dnamal. 06-05-2020 12:49 AM
- Got Karma for Re: What is the correct way to remove an item from restmap.conf ?. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Got Karma for using sendemail in a dashboard. 06-05-2020 12:49 AM
- Got Karma for using sendemail in a dashboard. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Karma Re: How abort a search based on a condition? for mmol. 06-05-2020 12:48 AM
- Karma How abort a search based on a condition? for reed_kelly. 06-05-2020 12:48 AM
- Karma Re: What is the difference between the metasearch and tstats commands? for cpride_splunk. 06-05-2020 12:48 AM
- Got Karma for Simple XML strips onclick from HTML button. 06-05-2020 12:48 AM
- Got Karma for Simple XML strips onclick from HTML button. 06-05-2020 12:48 AM
- Got Karma for Re: Simple XML strips onclick from HTML button. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 2 | |||
| 1 |
03-16-2021
12:37 PM
The easy way is to have a jump page or index page. This page allows you to select the filters and build links to the other dashboards by updating the URL. The hard way is to run a bunch of searches, save and retrieve data from a KV (or lookup).
... View more
03-16-2021
12:34 PM
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.13/searchcommands.html#splunklib.searchcommands.GeneratingCommand The command changed from "local" to "distributed". Good luck.
... View more
03-16-2021
09:58 AM
I have a htmn POST I would like to make from the search head when a user clicks on a button in their browser. Currently, I am creating a search that runs a custom command. Due to the nature of the issue, a user can generate 200 events in a few seconds. As you would expect, I am hitting limits all over the place. I have a .js that builds the Splunk command to call a custom command that does an HTML POST. I would like to skip Splunk as I can. The problem I have is the javascript runs on the local web browser and the POST needs to be on the private network that Splunk is on. I am taking advantage of Splunk's authentication to run the search, so I would like to do the same with a script. I am presuming this is either built-in and I missed it, or really hard. Does anyone have any ideas?
... View more
08-11-2020
11:39 AM
The issue here is several commands are built as the search as parsed, sendemail is one of these commands. There are three ways I have found around this: call a saved search use the map command use a subsearch |sendemail [ | makeresults | eval To="[email protected]" | eval Subject=case( a<th1,"Below Threshold 1", a<th2,"Below Threshold 2", true(),"Above Threshold 3") ] Be forewarned the map command is broken in 8.0.2, but is fixed in 8.0.5
... View more
07-15-2020
01:25 PM
I had this issue when running 8.0.3. I just upgraded to 8.0.5 and it works as expected.
... View more
05-29-2020
09:08 AM
All this I understand.
In my case app1, app2, and app3 are the same app, but they are different users. They share the same dashboards and searches but have different data.
I am looking for a way for an admin, to review mylookup for all three apps at the same time.
in my case, mylookup will seldom change, but if user1 makes a change in app1, I would like for the admin to look at their dashboard and review the change without checking the apps individually.
... View more
05-28-2020
01:01 PM
I have several similar apps. They share global searches and dashboards. They each have custom data in a lookup table, custom_data.csv . Is it possible to see all the custom_data.csv files in a single search using an admin account?
Normally I would generate a list of apps via a |rest call and then do a |map search. I cannot figure out how to cross apps with a lookup table command inputlookup .
... View more
Labels
- Labels:
-
CSV
04-07-2020
04:43 PM
I have read this a could of times, and not really sure of what you want to do.
I can suggest reversing the order of your searches.
|inputlookup
|join app [search to get data]
... View more
04-07-2020
04:07 PM
Can anyone offer any suggestions on how to configure AWS ELB with a Splunk Cloud Cluster?
... View more
12-13-2018
05:29 AM
1 Karma
there is a pre-defined environment variable so you do not ahve to hard code.
$env:app$
http://docs.splunk.com/Documentation/Splunk/7.2.1/Viz/tokens#Use_global_tokens_to_access_environment_information
... View more
04-26-2018
07:46 PM
The problem was in my default/setup.xml I need a field called name.
It seems the name field is special. Once I passed it to the endpoint, things started happening again. Thanks for all those that helped.
... View more
04-25-2018
08:12 AM
2 Karma
whether I like the new UI or not, is not really relative. Splunk made a change, that affects every implementation. I have 50-100 different apps, most are in use, and unrelated. I have knowledge articles with pictures and everyone has to be updated. There was no warning or option not to change.
True I do not have to upgrade yet, but when I do I have a lot of work that should not be done.
These changes should be limited to major changes, not feature updates.
... View more
04-24-2018
03:34 PM
The background of the icon in the upper right changes its background color.
... View more
04-23-2018
10:36 AM
This looks very close to what Hurricane Labs posted
(I have a slightly different issue, and I ran across this in my research.)
Splunk Custom Endpoints
... View more
04-23-2018
09:26 AM
1 Karma
restmap.conf defines rest endpoints.
removing, or commenting, an entry will prevent the endpoint from being created.
(a restart will be required)
... View more
04-21-2018
04:53 PM
I would like to create a new rest command that creates new stanzas from setmup.xml.
I can add/edit entries to an existing stanza.
restmap.conf:
# Admin: catches the url
[admin:owm_config]
match = /owm
members = config, city
# Admin_External: where to send members
[admin_external:config]
handlertype = python
handlerfile = OWM_config_handler.py
handleractions = list, edit
[admin_external:city]
handlertype = python
handlerfile = OWM_city_handler.py
handleractions = create, list, edit
In OWM_city_handler.py
I have the setup(), handleCreate(), handleList(), handleEdit()
When I call this with _new, self.requestedAction reports 64/?, 1/create, 4/list
I do not know what to do with self.requestedAction=64 and I cannot get any of the handlers called.
When I call with anything besides _new, it all works as expected.
Any Ideas?
... View more
04-08-2018
01:43 PM
I see what you are doing, but I need to do a js for each token I want to convert.
Is there a way I could do something more general? even if I could pas the id?
... View more
04-08-2018
01:20 PM
I did google search before I posted, really I did.
I like the solution. I will get the changed implemented in a few days. I am in documentation mode at the moment.
... View more
04-08-2018
09:19 AM
I would like to create HTML code in my Splunk search and display it in an HTML section.
The problem I have is the interpreter presents my html as characters and not as tags.
In my current case, I have a series of image I would like to display, about 40. I can create the 40 set token in my SimpleXML, but it is so much easier to build it in the query. In the past I would have 1-3 images I wanted to display, but ended up only showing the first.
|eval html=""
gets displayed as the string.
I solved this by just passing
$result.icon$
Internally I have a multivalue field that has a list of icons, I would convert each to html and then join them up and pass as a single string. I just do not know how to display them as the intended tags instead of the string of characters.
... View more
12-18-2017
01:49 PM
If I understand your question correctly, what you need to do is in your search have your viewed and hidden values. in your simple xml specify your views. on your link you can still reference the hidden values.
... View more
11-15-2017
03:02 PM
I was able to download and have the app running.
Unfortunately I cant seem to find the next step.
I am running FreeNAS with a minos plugin, a splunk server and my workstation, so I get lost as to what points to where.
The instructions seem to indicated if you download the app there is nothing else to do. I think some of the instructions under install from source would apply, but then I am not sure which ones or where to apply them.
... View more
10-27-2017
05:44 AM
<dashboard>
<label>test sendemail</label>
<row>
<panel>
<title>inline search</title>
<table>
<search>
<query>| metasearch index=* OR index=_*
| stats count by index, host
| sendemail to="[email protected]" sendcsv=false subject="index host"
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<search id="base">
<query>| metasearch index=* OR index=_*
| stats count by index, host
| fields count index host
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<row>
<panel>
<title>post search host</title>
<table>
<search base="base">
<query>
| stats sum(count) as count by host
| sendemail to="[email protected]" sendcsv=false subject="post host"
</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<title>post search index</title>
<table>
<search base="base">
<query>
| stats sum(count) as count by index
| sendemail to="[email protected]" sendcsv=false subject="post index"
</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
... View more
10-26-2017
06:54 AM
a saved search would work as does each panel with its own search. The problem is in my original problem I have 4 panels using the a base search and this is the case where I get multiple e-mails.
... View more
