Activity Feed
- Got Karma for Re: How to get a list of all emails sent out by Splunk and all associated reports and alerts?. 09-09-2024 06:38 AM
- Got Karma for Re: Is it possible to access properties from a custom config file (props.conf) in a Simple XML extension?. 06-30-2022 02:17 AM
- Got Karma for Re: How to get a list of all emails sent out by Splunk and all associated reports and alerts?. 12-04-2020 08:12 AM
- Got Karma for Re: How to change the Checkpoint Value in a Splunk DB Connect 2 input for the rising column?. 06-05-2020 12:48 AM
- Got Karma for Re: How to change the Checkpoint Value in a Splunk DB Connect 2 input for the rising column?. 06-05-2020 12:48 AM
- Got Karma for Re: How to change charting.fieldColors through JS. 06-05-2020 12:48 AM
- Got Karma for Re: How can I change the width and height of a TextInput?. 06-05-2020 12:48 AM
- Got Karma for Re: splunklib client giving SSLError. 06-05-2020 12:48 AM
- Got Karma for Re: splunklib client giving SSLError. 06-05-2020 12:48 AM
- Got Karma for Re: How to merge cells in a table based on value. 06-05-2020 12:48 AM
- Got Karma for Re: How to merge cells in a table based on value. 06-05-2020 12:48 AM
- Got Karma for Re: How to merge cells in a table based on value. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a central dashboard containing links to all other dashboards for users to navigate to?. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a central dashboard containing links to all other dashboards for users to navigate to?. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a central dashboard containing links to all other dashboards for users to navigate to?. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a central dashboard containing links to all other dashboards for users to navigate to?. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a central dashboard containing links to all other dashboards for users to navigate to?. 06-05-2020 12:48 AM
- Got Karma for Re: How to install Splunk for Excel Export?. 06-05-2020 12:48 AM
- Got Karma for Re: set simple xml token from java script file. 06-05-2020 12:48 AM
- Got Karma for Re: How do I convert these timestamps to epoch?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-07-2017
11:01 AM
Outstanding - that does exactly what I wanted. Thank you very much! That really is some advanced stuff. Also, I hadn't seen an asterisk used in the table command before.
... View more
02-07-2017
09:21 AM
My raw data looks like this:
Timestamp Field1 Field2 Field3
2017-01-01 AAA Key1 Key1val
2017-01-01 AAA Key2 Key2val
2017-01-01 AAA Key3 Key3val
For my purposes, Timestamp and Field1 uniquely identify a set of events that I would like to merge together.
I would like the formatted results to look like this:
Timestamp Field1 Key1 Key2 Key3
2017-01-01 AAA Key1val Key2val Key3val
Note that in the raw data, Field2 contains the values I would like to appear as column headers, with corresponding row values from Field3.
I have tried various things using eval, stats, eventstats, and appendcols, but have not been able to achieve the desired effect. Is anything like this possible using SPL?
... View more
07-29-2016
06:49 AM
lookup does not, but you may be able to achieve what you're looking for by using a KV Store instead.
See this link for configuring a KV Store from a CSV file:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureKVstorelookups
And see this link for examples of using a where clause with the KV Store (in the "Filters and queries" section):
http://dev.splunk.com/view/SP-CAAAEZH
... View more
07-28-2016
01:48 PM
5 Karma
I have done something similar with a very simple dashboard using primarily HTML (ex: home.xml):
<dashboard>
<label>Home</label>
<row>
<panel>
<title>Panel 1</title>
<html>
<div>
<li><a href="/app/yourapp/dashboard1">Dashboard 1</a></li>
<li><a href="/app/yourapp/dashboard2">Dashboard 2</a></li>
</div>
</html>
</panel>
</row>
</dashboard>
Within the html tags you can do pretty much whatever you want as far as the presentation goes.
Then I modified default.xml under $SPLUNK_HOME/etc/apps/yourapp/default/ui/nav to make my home dashboard the default dashboard and add it to the navigation:
<nav search_view="search" color="#65A637">
<view name="home" default='true' />
... other dashboards/dropdowns that reflect my app's structure
</nav>
... View more
07-28-2016
08:14 AM
Are you trying to achieve something like this? I only have two dropdowns in my example, but the key is the link statement in the drilldown for the single value:
<form>
<label>Dashboard - Link to second dashboard</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<choice value="1">Choice 1</choice>
<choice value="2">Choice 2</choice>
<choice value="3">Choice 3</choice>
<default>1</default>
</input>
<input type="dropdown" token="field2">
<choice value="1">Choice 1</choice>
<choice value="2">Choice 2</choice>
<choice value="3">Choice 3</choice>
<default>1</default>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>index=_audit | stats count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<drilldown>
<link>/app/sandbox/second_dashboard?field1=$field1$&field2=$field2$</link>
</drilldown>
</single>
</panel>
</row>
</form>
Then in the "receiving" or low level dashboard, you should be able to reference the tokens passed on the query string:
<dashboard>
<label>Second Dashboard</label>
<row>
<html>
<div>
Field 1: $field1$<br/>
Field 2: $field2$
</div>
</html>
</row>
</dashboard>
... View more
07-28-2016
07:39 AM
Thank you - I used custom JavaScript to solve a similar issue previously, but your question made me reconsider whether there was a way to do it purely with SPL.
... View more
07-27-2016
11:21 AM
3 Karma
If I understand correctly, you can do this with a combination of streamstats and eval . In the below example, streamstats appends the previous col1 value to the current record. The eval statement then sets col1 to blank if the value hasn't changed.
your base search
| sort col1 col2
| streamstats current=f window=1 global=f last(col1) as last_col1
| eval col1=if(col1==last_col1,'',col1)
| table col1 col2 col3
This link gave me some guidance on using the streamstats statement:
https://answers.splunk.com/answers/87382/comparing-fields-with-previous-events.html
... View more
07-26-2016
11:16 AM
2 Karma
I believe it's your port - you want to use the management port, which is typically 8089, but you can confirm by going to Settings -- Server Settings -- General Settings.
... View more
07-25-2016
01:59 PM
1 Karma
Based on your example, you should be able to set the width and height using jQuery:
$('input5-input').css('width','400px');
$('input5-input').css('height','300px');
or CSS:
input#input5-input {
width: 400px;
height: 300px;
}
... View more
07-21-2016
09:07 AM
If you're talking about embedding the PHP page inside your dashboard, you should be able to do that with a iFrame tag like this:
<row>
<panel>
<title>Panel 1</title>
<html>
<iframe src="http://www.google.com" width="100%" height="500" frameborder="0" />
</html>
</panel>
</row>
... View more
07-21-2016
08:10 AM
One approach would be to add something like the following to the end of your query:
| eval color=1 | rangemap field=color default=severe
and add this option to your single value XML:
<option name="classField">color</option>
Below is a complete example that worked for me:
<single>
<search>
<query>index=_internal | head 1 | eval myday=strftime(_time,"%A")
| fields myday
| eval color=1 | rangemap field=color default=severe
</query>
<earliest></earliest>
<latest></latest>
</search>
<option name="classField">color</option>
</single>
This is a variation of an approach that is described here:
https://answers.splunk.com/answers/103239/change-color-of-single-value-visualization.html
Depending on how comfortable you are with CSS, another approach would be to include a custom CSS file that overrides the single-result class.
... View more
07-21-2016
06:07 AM
1 Karma
Assuming you have downloaded the app's .tgz file from splunkbase, there are a couple of ways to install any Splunk app:
*From the UI*
From your Splunk home page, click on the gear icon next to "Apps" in the upper lefthand corner of the page. Click "Install app from file" and follow the prompts (click restart Splunk when prompted.)
Using Splunk CLI Command
From a DOS prompt, navigate to the directory containing the .tgz file and run the following commands:
splunk install app name of the tgz file
splunk restart
Technically, there is a third way by unpacking the .tgz file, but it is a little more involved. The above steps are the easiest. Please inform if you run into any issues.
... View more
07-11-2016
06:38 AM
1 Karma
This will require JavaScript, and below is some code I just tested out:
In your dashboard XML, add a script attribute to your form or dashboard tag:
<form script="yourjavascript.js">
and add an id attribute to your text field:
<input type="text" token="yourtoken" id="yourfieldid"></input>
Create yourjavascript.js in the following directory (create the subfolders if they don't already exist):
$SPLUNK_HOME\etc\apps\<yourapp>\appserver\static
and add the following code:
require([
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!"
], function(mvc) {
$('button').on("click", function(e) {
// find text field with id starting with yourfieldid
$('[id^=yourfieldid]:text').val('')
});
});
Restart Splunk for the new JavaScript file to be recognized. My example assumes that there is only one button on your dashboard.
... View more
07-06-2016
11:41 AM
1 Karma
See the answer posted here:
https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html
I tweaked the code sample from the above post to match the date format example you provided:
your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y")
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y")
| eval diff = tostring((ot - it), "duration")
| table in_time, out_time, diff
For reference, below are the various date/time format variables Splunk uses:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
... View more
07-05-2016
10:02 AM
1 Karma
Below is a sample of JavaScript I use to set a token:
require([
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var tokens = mvc.Components.get("default");
tokens.set("check_status", "true");
});
Presumably your JavaScript would have some code to check whether or not to set the token. Also, depending on your logic, you may want to unset the token as well like this:
tokens.unset("check_status");
Not sure how familiar you are with using JavaScript in Splunk, but your JavaScript file would go here (create the folders if they don't already exist):
$SPLUNK_HOME\etc\apps\<yourapp>\appserver\static
and you would reference it in your XML like this, by adding a script attribute to your form or dashboard tag:
<form script="yourjavascript.js">
... View more
06-22-2016
05:24 AM
I am running Splunk 6.3.3, and my setup.xml looks like the following and doesn't prompt me to re-enter previously entered credentials:
<block title="Add Account Info" endpoint="storage/passwords" entity="_new">
<input field="name">
<label>Username</label>
<type>text</type>
</input>
<input field="password">
<label>Password</label>
<type>password</type>
</input>
</block>
I wonder if there is a discrepancy in either your endpoint or entity value.
... View more
06-21-2016
10:52 AM
1 Karma
I believe you'll need to move your Column2/Column3/Column4 if statements outside of the Column1 if statement. Then, in its place, set some indicator that indicates when to apply the styles.
The problem is that when cell.field equals "Column1", it can't be equal to Columns 2, 3, or 4 - at least not until the next iteration of the "loop". You would need to do something like this:
var setClass = 'false'; // make this a global variable
if (cell.field == "Column1") {
if (cell.value == "String1" || cell.value == "String4" ) {
setClass = 'true';
} else {
setClass = 'false';
}
if (setClass == 'true') {
if (cell.field == 'Column2' ) {
if (cell.field == 'Column3' ) {
if (cell.field == 'Column4' ) {
}
But I'm not sure if you'll be able to set a global variable from within your extension of TableView.BaseCellRenderer. Also, I'm assuming that your complete JavaScript is following the example shown by user Flynt in this post:
https://answers.splunk.com/answers/230164/how-to-get-a-table-cell-color-to-change-depending.html
... View more
06-20-2016
10:26 AM
5 Karma
The Python and splunkd logs would be the place to start. You can run the following query to get e-mail related activity:
index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\python.log" sendemail
If you run the same search but with splunkd.log instead, there's a field called ssname that gives the search that triggered the alert.
... View more
06-20-2016
08:53 AM
1 Karma
That looks perfect - he would just need to add | sort parent Version before the stats clause if he wants the order to be identical to his first example, but otherwise this is an elegant solution.
... View more
06-17-2016
09:58 AM
1 Karma
It sounds like you may want to have a CSV lookup table that contains your various domains, and then include the lookup table as a subsearch to your main query. See this link for a similar problem and how a lookup table was incorporated:
https://answers.splunk.com/answers/83846/use-lookup-table-to-specify-hosts-to-search.html
Also, here is info on configuring CSV lookup tables:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/ConfigureCSVlookups
... View more
06-08-2016
05:02 AM
I see - in that case, there are a couple of ways this could be done:
JavaScript
Edit the following JavaScript file used by the dashboard:
$SPLUNK_HOME$\etc\apps\simple_xml_examples\appserver\static\autodiscover.js
and add these three lines to the bottom of the file, before the last });
$('#panel2').hide();
$('#panel1').width('100%');
$('#panel2').width('0%');
CSS
Edit the following CSS file used by the dashboard:
$SPLUNK_HOME$\etc\apps\simple_xml_examples\appserver\static\dashboard.css
and add these lines to the bottom of the file:
div#panel1 {
width: 100% !important;
}
div#panel2 {
width: 0% !important;
display: none !important;
}
... View more
06-07-2016
02:05 PM
Can you try single-quotes in your eval statements instead of double-quotes?
... View more
06-07-2016
11:07 AM
If I understand correctly, make a copy of
$SPLUNK_HOME\etc\apps\<your app>\default\data\ui\nav\default.xml
and place it in
$SPLUNK_HOME$\etc\apps\<your app>\local\data\ui\nav\default.xml
(You may need to create the local folder structure if it doesn't already exist.)
Then, you can edit your local copy of default.xml. You can either comment out or remove entirely the following line:
<view name="search" default='true' />
Restart Splunk and you should no longer see Search in the top nav.
... View more
06-06-2016
11:17 AM
What mode are you searching in? (See the dropdown list on the right under the search icon.) Interesting fields do not show up in Fast Mode - they only show up in Smart or Verbose Mode. I'm not sure if there's a way to make them show up by default.
... View more
05-26-2016
06:29 AM
1 Karma
Using your example, this worked for me:
chartview.options["charting.fieldColors"]='{"sth":0x65a637}';
... View more
