Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Graham_Hanningt
Graham_Hanningt
Builder
Member since:
11-15-2015
12-02-2020
Community Statistics
| Posts | 213 |
| Solutions | 3 |
| Karma Given | 18 |
| Karma Received | 55 |
| Member Since | 11-15-2015 |
Activity Feed
- Got Karma for Re: How to change color or style of a single line in line graph. 02-28-2023 09:10 AM
- Got Karma for Re: Safe characters for field names. 11-28-2022 12:50 AM
- Got Karma for Drilldown on event annotation?. 07-11-2022 03:38 PM
- Got Karma for Re: How to change color or style of a single line in line graph. 08-20-2021 03:11 PM
- Got Karma for Re: How to get Field Values to appear in Pie Chart?. 07-04-2021 06:44 PM
- Posted fieldformat not working for Single Value visualizations for some backlevel Splunk versions, in some contexts? on Dashboards & Visualizations. 12-02-2020 11:20 PM
- Posted Re: Why has the Splunk Enterprise Trial license already expired in a brand new Docker container? on Getting Data In. 12-02-2020 05:38 AM
- Posted Override ">= 0" legend label in sankey diagram? on Dashboards & Visualizations. 11-26-2020 01:05 AM
- Posted Sankey diagram drilldown to set form tokens? on Dashboards & Visualizations. 11-25-2020 10:13 PM
- Got Karma for Drilldown on event annotation?. 10-15-2020 05:08 PM
- Got Karma for Drilldown on event annotation?. 10-07-2020 08:41 PM
- Got Karma for Subsecond minspan in auto-span timechart?. 10-06-2020 06:59 AM
- Got Karma for Re: How to omit from a timechart series that include only zeroes?. 07-22-2020 12:38 PM
- Karma Re: AppInspect check_all_lookups_are_used too restrictive? for nickhills. 06-05-2020 12:51 AM
- Got Karma for Is it best practice to constrain searches by index name?. 06-05-2020 12:51 AM
- Got Karma for AppInspect check_indexes_conf_does_not_exist too restrictive?. 06-05-2020 12:51 AM
- Got Karma for Re: Performantly overriding sourcetype per event with new replacement string, not backreference?. 06-05-2020 12:50 AM
- Got Karma for Which characters does Splunk allow in field names?. 06-05-2020 12:50 AM
- Got Karma for Which characters does Splunk allow in field names?. 06-05-2020 12:50 AM
- Got Karma for Which characters does Splunk allow in field names?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-02-2020
11:20 PM
I was almost tempted to not report this, because I've been unable to repeat it in a small test case. Some background: I've developed a dashboard in Splunk 8.1.0 that uses the fieldformat command with the tostring function to format a duration in a Single Value visualization. Here's a standalone query (with the exception of the field name, the last stage is identical to my dashboard code): | makeresults | eval seconds=12345 | fieldformat seconds=tostring(round(seconds,1),"duration") This displays the expected value in the Single Value viz: 03:25:45.0 So far, so good. However, when a colleague running Splunk 8.0.2 created a dashboard using exactly the same Simple XML, their viz showed the original field value 12345; apparently, ignoring the fieldformat command. I asked my colleague to edit their dashboard source, and change fieldformat to eval. That worked. But then, attempting to create a minimal test case for this forum, the self-contained query cited above works okay in Splunk 8.0.2. Both in the Search & Reporting app, just dynamically selecting a Single Value viz, and also when creating a new dashboard with this query behind a Single Value viz. I'm left scratching my head. Having switched to using eval instead of fieldformat in my dashboard (because I'm not sure of the Splunk version that the intended recipient of my dashboard will be running), I'm moving on. Still, I thought it was worth at least documenting this issue, in case anyone else has the same issue, or knows what's going on here. Aside: Is there a way to format inline code here? I switched to the "Source code" view and manually applied <code> elements, but now the site complains "Your post has been changed because invalid HTML was found in the message body. The invalid HTML has been removed".
... View more
Labels
- Labels:
-
panel
12-02-2020
05:38 AM
Update, November 2020: this issue has recurred, with the now-old Splunk 7.2.0-based Docker image. Not just reoccurred: I believe this issue is likely to occur periodically. I had incorrectly assumed that there was some issue with the "license clock" code in 6.6.3 that had since been solved, but that appears to be untrue. I'm leaning against ever distributing another pre-packaged, all-in-one Docker image (Splunk + app + sample data). Unless I commit to keeping up with latest the Splunk version; at least, every so often.
... View more
11-26-2020
01:05 AM
I am using Splunk 8.1.0 with the Sankey Diagram 1.5.0 app. My query for the sankey diagram conditionally, based on a form input, excludes zero values. I would like to conditionally—say, based on a token being set—override the ">= 0" legend label with "> 0". I just want to remove the "=" from that label. As a starting point, I've attempted to unconditionally override the sankey diagram CSS. For example: <panel>
<html>
<p/>
<style>
.sankey_diagram > div.legend > ul > li:nth-child(1) > span {
background-color: red;
}
</style>
</html>
</panel> but that's had no effect. (I was considering attempting pure a CSS approach: hiding the original content, then using a pseudo element to inject my override.) It's occurred to me that I could also use a JavaScript document.querySelector to set the content of that span element in the legend, but I'd prefer not to have an external .js file for this.
... View more
Labels
- Labels:
-
CSS
-
javascript
11-25-2020
10:13 PM
I am using Splunk 8.1.0 with the Sankey Diagram 1.5.0 app. I have a sankey diagram viz in a dashboard. The source and target fields of the sankey correspond to dashboard form inputs that I use to filter queries. When the dashboard user clicks on the left side of the sankey diagram (a source field value), I want to set the corresponding form input to that value. Similarly, when the user clicks on the right side of the sankey diagram (a target field value), I want to set the corresponding form input to that value. How do I do that? I've tried: <drilldown>
<condition field="source">
<set token="form.applid">$click.name2$</set>
<set token="applid">APPLID="$click.name2$"</set>
</condition>
<condition field="target">
<set token="form.poolid">$click.name2$</set>
<set token="applid">"ENQ Pool ID"="$click.name2$"</set>
</condition>
</drilldown> (where "applid" and "poolid" are the tokens set by the form inputs, and also the corresponding form input id attribute values) but that navigates to a new tab with a new search that has the "set" values appended: ... APPLID=TXCQAIC "ENQ Pool ID"=EXECSTRN I don't want to navigate to a new window. I want to remain on the same dashboard, and just update the form inputs and their corresponding tokens.
... View more
Labels
- Labels:
-
drilldown
03-04-2020
05:37 AM
@kamlesh_vaghela ,
If you feel like converting your comment into an answer, I'll accept it.
... View more
03-04-2020
05:35 AM
@kamlesh_vaghela ,
Thank you! Yes, I've tried it, and it works.
I had completely overlooked what you describe: that the inputlookup command can refer to a transforms.conf stanza name instead of the .csv file name. That explains a lot! In particular, as @nickhillscpl points out (thank you, too!) why AppInspect checks this. I "get it" now.
Thanks again to both of you for your advice, much appreciated. I'm now one step closer to that AppInspect badge.
... View more
03-04-2020
12:40 AM
1 Karma
(That is: in a Splunk environment where data is stored in multiple indexes.)
I'm almost certain that the answer is "Yes". I've seen what could be interpreted as "Yes" answers inline in other questions. For example, this statement in 2016 by @somesoni2 :
it's always advisable, from performance perspective, that you specify the index you need to search, to cut down the number of indexes/buckets to be searches.
However, I wanted a specific question for this, preferably with affirmative answers from Splunk or prominent Splunk users, that I could refer to (and point other people to).
I'm asking this question because I have learned that, as a fix for failing the AppInspect check check_indexes_conf_does_not_exist , a fellow app developer both (a) removed indexes.conf from their app and (this is specifically why I'm asking this question) (b) removed all index=... constraints from the searches in the app. So the app now constrains its searches by sourcetype , but not index .
I suspect this means that Splunk will search all indexes that the user is allowed to search. Not ideal, from a performance perspective. Unless—this is just a thought bubble; I have no evidence for this in reality—Splunk somehow keeps track of which sourcetypes are stored in which indexes: when a search specifies a sourcetype, Splunk implicitly constrains the search to only those indexes that it knows contains those sourcetypes. I doubt that this is true, but I wanted to at least raise this as a possibility; preferably, for someone to explicitly state as false in their answer.
... View more
03-04-2020
12:08 AM
Except from an AppInspect report:
[ Failure Summary ]
Failures will block the Cloud Vetting. They must be fixed.
check_all_lookups_are_used
Lookup file my_trans.csv is not referenced in transforms.conf. File: default/transforms.conf
The report is correct: my_trans.csv (not its real name) is not referenced in transforms.conf .
However, my_trans.csv is referenced by a macro in the app. From the app's macros.conf :
[myapp_exclude_my_trans]
definition = NOT [|inputlookup my_trans.csv]
From the description of this check in the AppInspect docs:
Check that all files in the /lookups directory are referenced in transforms.conf.
Why must files in the /lookups directory be referenced in transforms.conf ?
Do I really need to add:
[mylookuptable]
filename = my_trans.csv
just to satisfy AppInspect?
... View more
03-03-2020
11:49 PM
1 Karma
Background to this question
I am the developer of a Splunk app, recently published on Splunkbase, that is intended for use as a sample, in the following sense:
Scope and intended use of the app
[This] app is not intended to be a fully-fledged out-of-the-box solution [...]. Instead, the app contains sample dashboards that demonstrate some example use cases for visualizing data from [proprietary product name].
The developers of [this app] anticipate that customers will examine these sample dashboards, and then perhaps copy and adapt selected visualizations into their own bespoke Splunk apps to match their own specific requirements.
A separate website (external to Splunkbase) supplies sample data for the app, so that users who want to try out the app can do so without requiring that "proprietary product".
My problem
I covet a "Splunk AppInspect Passed" badge for the app.
However, the AppInspect report includes the following failure:
[ Failure Summary ]
Failures will block the Cloud Vetting. They must be fixed.
check_indexes_conf_does_not_exist
Apps and add-ons should not create indexes. Indexes should only be defined by Splunk System Administrators to meet the data storage and retention needs of the installation. Consider using Tags or Source Types to identify data instead index location. File: default/indexes.conf
The app contains an indexes.conf file that defines an index; the app's macros.conf file defines macros that refer to that index name; searches in the app's dashboards refer to those macros.
I want users to store the sample data for this app in an index that is specifically for that purpose. I want them to be able to delete that index at will, without worrying about deleting other, "non-sample" data. I want to help inexperienced users avoid "polluting" indexes containing their "real" data with this "sample" data.
User beware? That stance might be considered unhelpful to an inexperienced Splunk user who has just inadvertently loaded sample data into an index they shouldn't have.
I anticipate that users will refer to this app as a starting point for developing their own apps that might or might not similarly constrain searches by index (I think that such constraints will be quite likely; for example, in multi-tenant environments).
My question
Is there any way I can get that "Splunk AppInspect Passed" badge without removing indexes.conf from the app?
Yes, I could remove indexes.conf , push the task of defining a specific index onto the user, and describe how to do this in documentation, but I deliberately want to minimize the number of manual setup steps for this app.
... View more
03-03-2020
11:09 PM
Answering my own question with my solution, in case it's of use to anyone else...
That popup in Splunkbase constrains the height of images to 500px.
To capture screenshots of my Splunk app for Splunkbase, I use Google Chrome developer tools to set a custom device display size of 1400px by 500px.
This results in readable screenshots (not the thumbnails; I'm referring to the large versions presented in the popup):
https://splunkbase.splunk.com/app/4901/
(By the time you read this, it's possible I might have updated those screenshots again, possibly further tweaking their dimensions.)
Related tip: I deliberately named the screenshot image files "...-1.png", "...-2.png", etc, where the number indicates the order in which I want Splunkbase to display them in its image carousel. I was also careful to upload the files in that order. Nope. That didn't work: Splunkbase displayed them in reverse order! I deleted all screenshots, then re-uploaded them in reverse order (-5.png, -4.png, etc.). Yep, that worked. Counterintuitive!
... View more
03-03-2020
10:59 PM
From the Media tab while editing an app in Splunkbase:
Add Screenshots
Recommended screenshot size is 1200px by 900px
When you click a screenshot thumbnail on the app page, Splunkbase presents a larger version of the image in a popup. The constraints of that popup's CSS means that, in 1200px by 900px screenshots of app dashboards, text is unreadable (unless you've used "zoom" in your browser to enlarge the text; but that introduces its own issues).
What resolution should I use to ensure app screenshots are readable in Splunkbase?
... View more
- Tags:
- splunkbase
12-19-2019
05:36 PM
To return to the previous time range after clicking that link ("Link for pan/zoom"), I have found that I need to click my web browser's Back button twice, because of the way that Splunk Web sets form parameters in the URL query string after loading a dashboard.
When you initially click that link, the browser URL is exactly what $url$ sets it to. But when the dashboard at that URL loads, Splunk Web updates the URL query string ( ?... ) with the dashboard form parameters. This introduces an additional URL to the browser history, hence a second click of the Back button to return to the previous dashboard and its time range.
Or am I missing something?
... View more
12-18-2019
06:36 PM
I forgot to add: as @helge reports, I don't have to open the browser console to see these errors: they're right in your face, in the dashboard panels. It's disconcerting for users. If they report it, I can only shrug, say "it's Splunk behavior", and point them to this question.
... View more
12-18-2019
06:33 PM
Me too: I get the same "Invalid earliest_time" errors in Splunk 7.3.
In my case, the first viz in each dashboard is a timechart that I use to set $selection_earliest$ and $selection_latest$ :
<selection>
<set token="selection_earliest">$start$</set>
<set token="selection_latest">$end$</set>
</selection>
The search for every other visualization in each dashboard uses:
<earliest>$selection_earliest$</earliest>
<latest>$selection_latest$</latest>
That "master" timechart is very useful for dynamically zooming and panning within the time range set by the time picker.
But... I get those ugly "Invalid earliest_time" errors.
I thought at first this was because I was missing:
depends="$selection_earliest$,$selection_latest$"
attributes. But, nope, even with that attribute on every applicable <row> and <search> , I still get those "Invalid earliest_time" errors.
... View more
12-18-2019
12:20 AM
With apologies if this is stating the bleeding obvious: if, as I do, you want the link to set the time range of the current dashboard (to the marquee-selected time range in the chart), then your URL can consist of just the query string:
<set token="url">
<![CDATA[?earliest=$selection_earliest$&latest=$selection_latest$]]>
</set>
Related note: dashboards that I design these days typically contain a "master" timechart at the top, just under the form UI controls. Only the search for that master timechart and form UI controls refer to the values of the global time picker in the form UI controls:
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
All other searches in the dashboard—all visualizations under that master timechart—refer to the time range selected by that master timechart:
<earliest>$selection_earliest$</earliest>
<latest>$selection_latest$</latest>
The HTML visualization containing the link appears directly under the master timechart.
Having that master timechart at the top offers an easy way to zoom and pan around within the time range set by the time picker.
... View more
12-09-2019
05:38 PM
Apologies for the belated reply.
I store the app icon files in:
$SPLUNK_HOME/etc/apps/<your_app_name>/static/
as described in the Splunk dev docs heading "Add icons to your app".
I deliberately supply only the following files:
appIcon_2x.png
appIcon.png
appIconAlt_2x.png
appIconAlt.png
I don't want to supply a logo: I'm happy with the default "logo" of the app title next to the icon.
... View more
12-03-2019
01:06 AM
Mostly dev. Not production. What I'm actually doing is testing the installation of an app that I've developed after renaming the app's local directory to default, and making a few other tweaks to turn the "in-development" app into a "for-distribution" app.
In dev, I'm not really that concerned about this behavior. It's a slight annoyance. As you say, a dev license might (would?) help.
But my dev environment is not my major concern. When I think about distributing the app to other users to install on their own Splunk instances, I cringe at the thought of having to explain this behavior. The app icon should appear after you install the app using Splunk Web. You shouldn't have to "prod" Splunk—refresh, bump, restart—to make it display the custom app icon.
This seems like such an obvious, in-your-user's-face issue that I almost can't believe this really is the situation; that you have do something extra to see the custom icon. It really does make me think I'm missing something. But all of the anecdotal evidence I read confirms that, yep, what I'm experiencing is just the way it is.
... View more
12-03-2019
12:53 AM
_bump doesn't work for this, and refresh is not an option:
https://answers.splunk.com/answers/311531/debugrefresh-does-not-work-anymore-on-630-on-versi.html
... View more
12-03-2019
12:24 AM
In case it's significant: the first thing I do after starting Splunk in a new Docker container is to change the license group from Trial to Free. I do that before installing any apps.
... View more
12-03-2019
12:22 AM
Thanks for the reply and suggestions. Unfortunately, no, that doesn't help.
After experiencing this issue in an existing Splunk instance—where I had indeed installed/reinstalled the app several times, but in every case with custom icons—I deliberately started a fresh Splunk instance in a new Docker container. And I opened that Splunk Web in a browser with an empty cache.
I installed the app in that fresh Splunk. I got the default app icon. The bump endpoint didn't fix it.
I restarted Splunk, and the custom app icon appeared.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-02-2020
12:27 PM
|
Karma given to
