Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About fredclown
fredclown
Builder
Member since:
07-17-2013
3 weeks ago
Community Statistics
| Posts | 154 |
| Solutions | 10 |
| Karma Given | 81 |
| Karma Received | 40 |
| Member Since | 07-17-2013 |
Activity Feed
- Got Karma for Dashboard Studio Input Change Event Handler. 12-05-2025 10:59 AM
- Posted Re: Is it possible to do search time field extraction based punct on Getting Data In. 08-06-2025 08:02 AM
- Posted Is it possible to do search time field extraction based punct on Getting Data In. 08-05-2025 04:06 PM
- Got Karma for Re: Where to check the clock skew. 07-02-2025 12:08 PM
- Posted Re: How to create a central dashboard containing links to all other dashboards for users to navigate to? on Dashboards & Visualizations. 05-16-2025 04:43 PM
- Got Karma for Re: What is the splunk.secret file, and is it possible to change it?. 04-10-2025 09:00 AM
- Posted Re: Any way to use trellis layout on Dashboard Studio? on Dashboards & Visualizations. 02-18-2025 11:07 AM
- Posted Dashboard Studio Input Change Event Handler on Dashboards & Visualizations. 10-11-2024 10:49 AM
- Got Karma for Re: Introducing the 2024 Splunk MVPs!. 09-17-2024 04:00 PM
- Got Karma for Re: Introducing the 2024 Splunk MVPs!. 09-12-2024 07:33 AM
- Got Karma for Re: Is there any optimal way to get context bith before and after fir search result. 09-06-2024 11:29 AM
- Posted Can you still search logs on an indexer that is turned into a heavy forwarder on Deployment Architecture. 08-05-2024 02:52 PM
- Posted Re: How to deploy updates to inputs.conf, outputs.conf, and deploymentclient.conf files to the "C:\Program Files\Sp on Deployment Architecture. 07-29-2024 04:09 PM
- Posted Re: distsearch.conf and the web interface on Deployment Architecture. 07-26-2024 09:56 AM
- Karma Re: What's the best way to create an alert to tell whether a windows server is shutdown or down ? for gcusello. 07-26-2024 08:32 AM
- Karma Re: How to get full results from 2 queries joined together? for ITWhisperer. 07-22-2024 08:49 AM
- Posted Non replicated internal indexes on Deployment Architecture. 07-19-2024 05:35 PM
- Posted Re: Describe the pattern matching syntax used for 'punct'? on Splunk Search. 07-18-2024 11:31 AM
- Got Karma for Re: How to get full results from 2 queries joined together?. 07-17-2024 11:16 PM
- Posted Re: How to get full results from 2 queries joined together? on Splunk Search. 07-17-2024 01:48 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-06-2025
08:02 AM
Thanks, and sorry I was not clear enough. I want to do this with props and transforms so that the fields are reusable.
... View more
08-05-2025
04:06 PM
I have events in a log file and they have different formats from event to event. I'm wondering if there is any way to use the punct field to do conditional field extraction? Let's say I have these two punct formats ... ___::_---..__//:::__---_--_:______:____-___-__..._ ___::_---..__//:::__---_--_:______:___...:_-__...: Edit: I'm specifically asking about doing it with props and transforms so that the fields are reusable.
... View more
Labels
- Labels:
-
field extraction
05-16-2025
04:43 PM
I know it has been a while since this question was asked but here is a simple xml dashboard that will show all the other dashboards in the app along with the descriptions and links to them. It is populated dynamically with a rest search. All you would need to do would be to edit the app nav to look something like the below example if you call the dashboard "overview". If you don't call it "overview" then change the first view element to whatever you named the dashboard. Specifically, it is looking for the name that is shown in the URL bar, not the editable label in the dashboard. Navigation <nav search_view="search">
<view name="overview" default="true" />
<view name="search" />
<view name="analytics_workspace" />
<view name="datasets" />
<view name="reports" />
<view name="alerts" />
<view name="dashboards" />
</nav> Dashboard <dashboard version="1.1" theme="dark">
<label>Overview</label>
<row id="cards">
<panel>
<table>
<search>
<query>| rest /servicesNS/-/$env:app$/data/ui/views splunk_server=local
| rename eai:acl.app as app
| search isDashboard=1 app=$env:app$ title!=$env:page$
| table label description app title
| sort label</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/$row.app$/$row.title$</link>
</drilldown>
</table>
</panel>
</row>
<row id="styles_row">
<panel>
<html>
<style>
/* Hide the styles panel */
#styles_row {
display: none;
}
/* Remove search tools (refresh, etc) */
.element-footer.dashboard-element-footer {
display: none !important;
}
/* Remove hover background color */
#statistics .results-table tbody td.highlighted {
background-color: #FAFAFA !important;
}
/* Remove hover background color dark mode */
.dashboard-panel[class*="dashboardPanel---pages-dark"] #statistics .results-table tbody td.highlighted {
background-color: #31373B !important;
}
#statistics.results-table {
padding: 10px;
box-sizing: border-box !important;
}
/* Style the table to make it just a simple container element */
body table {
width: 100% !important;
min-width: 100% !important;
display: block;
box-sizing: border-box !important;
border: none !important;
-webkit-box-shadow: none !important;
box-shadow: none !important;
}
[id^="cards"] table tbody td {
font-family: Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif !important;
}
/* Hide the table header */
thead {
display: none;
}
/* Make the tbody a grid layout */
tbody {
display: grid;
grid-template-columns: 33% 33% 33%;
box-sizing: border-box !important;
column-gap: 10px;
row-gap: 10px;
border: none !important;
}
/* Bold the dashboard title */
tr td:nth-child(1) {
font-weight: bold;
}
/* Make the card text black in light mode */
tr td:nth-child(2) {
color: #000000 !important;
}
/* Make the card text white in dark mode */
.dashboard-panel[class*="dashboardPanel---pages-dark"] tr td:nth-child(2) {
color: #FFFFFF !important;
}
/* Hide the 3rd (app) and 4th (title) columns */
tr td:nth-child(3), tr td:nth-child(4) {
display: none;
}
/* Turn the table rows into cards */
tbody tr {
border-radius: 5px;
border: 1px solid #999999;
padding: 10px;
}
tbody tr, tbody tr td {
box-sizing: border-box !important;
display: block;
background: #FAFAFA !important;
}
.dashboard-panel[class*="dashboardPanel---pages-dark"] tbody tr, .dashboard-panel[class*="dashboardPanel---pages-dark"] tbody tr td {
background: #31373B !important;
}
.table td {
padding-top: 0 !important;
padding-bottom: 0 !important;
}
</style>
</html>
</panel>
</row>
</dashboard>
... View more
02-18-2025
11:07 AM
As of the time of writing this it is only available on single value, single value icon, and single radial visualizations. I very much would like to see them add it for line graph visualizations.
... View more
10-11-2024
10:49 AM
1 Karma
I know that not every feature in Dashboard Studio has been exposed in the UI yet. I see that you can set tokens on interaction with visualizations but I'm not seeing anything similar for inputs. Does anyone know if there is a change event handler for inputs in Dashboard Studio like there is in the XML dashboards? I've not seen anything in the docs, but I could just be looking in the wrong place. Thanks.
... View more
Labels
- Labels:
-
Classic dashboard
-
Dashboard Studio
-
token
08-05-2024
02:52 PM
We have a legacy all-in-one Splunk server. We have built out a new distributed environment that has an indexer cluster. We are phasing everything over to the new environment. As such the new search head cluster can search both the new indexers and the old all-in-one server. We plan on migrating all the UFs to start sending their logs to the new indexers soon. I have also set up the old server to be able to search the new indexers so that alerts and reports on that server will still continue to work once the inputs are sent to the new indexers. That way we can handle report migration separately and not have to do everything in one fell swoop. I was also planning on changing the old indexer into a heavy forwarder once the UFs are repointed so that any scripted inputs it has or other kinds of inputs will be sent to the new indexers. My question is if I flip it to be a heavy forwarder I know any new inputs it gets will get sent to the new indexers which should be find for alerts and reports as it can also search the new indexers. However all the existing stored logs I know those will not be migrated into the new indexers but will the old server still be able to search those logs once it is a heavy forwarder? Will it still search it's own locally indexed data as well as the new indexers? Thanks.
... View more
07-29-2024
04:09 PM
Couldn't you theoretically deploy an app with a scripted input that would make changes to files in etc/system/local? Not saying this is the best method because if it fails you could brick the forwarder, but I would think it is theoretically possible if there are no other means possible.
... View more
07-26-2024
09:56 AM
This is the new link to the documentation. https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch#Use_the_CLI
... View more
07-19-2024
05:35 PM
In the _cluster app on the cluster manager there is an indexes.conf file that specifically sets repFactor to 0 for the _introspection, _telemetry, _metrics, and _metrics_rollup indexes. Is there a reason these indexes should not be replicated? Thanks.
... View more
Labels
- Labels:
-
indexer clustering
07-18-2024
11:31 AM
punct can be super helpful for trying to diagnose issues by looking at the kinds of events in your logs. I use this pretty regularly on Windows machines when there is an issue going on. index=wineventlog
| stats latest(_raw) as _raw count by source, punct
| sort - count
... View more
07-17-2024
01:48 PM
1 Karma
Yes, if it can be done with stats that would be best. It is the Splunky way to do it.
... View more
07-17-2024
11:26 AM
Have you tried using a left (also called outer) join vs and inner join. An inner join will only give you data where the node_id appears in both sets of data. A left join will give you all the results from the base search joined where it matches in the sub search.
... View more
07-17-2024
11:06 AM
1 Karma
Is something like this what you are looking for? Set the time range picker to your desired range. index=windows EventCode=4624 Account_Name IN ("Larry","Curly","Moe")
| eval Logon_Account_Name=mvindex(Account_Name, 1)
| table _time, ComputerName, Logon_Account_Name
| sort _time
... View more
05-24-2024
08:51 AM
You can search the internal Splunk logs to see if there are any errors logged. If you run this what do you get? index=_internal sendemail sourcetype!=splunkd_ui_access sourcetype!=splunkd_remote_searches ERROR
... View more
05-24-2024
08:37 AM
This is the beauty of using DNS CNames to reference all your Splunk servers in configuration. Ideally you don't put references to any physical names in your configs. That way when you switch servers you can build your new server along side your old server and then when you want to switch to a new servers you just flip the CName over to the new server.
... View more
05-01-2024
03:21 PM
Oh, I think I just found the answer. Looks like in the alert_actions.conf file there is the hostname property that if you explicitly put https:// in front of the url then you can avoid having it tack on the web port when it sends emails. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf
... View more
05-01-2024
03:17 PM
We have a load balancer sitting in front of our search head cluster that is reverse proxying the connection to the search heads over https port 443. The search head web interfaces are running on port 8000. The issue is when our search heads send out alert emails they append 8000 to the load balancer url which doesn't work because the load balancer is listening on 443. Is there a way to tell the search heads to leave off the port or specify a different port explicitly in the alert emails?
... View more
Labels
- Labels:
-
alert action
-
email
10-25-2023
03:16 PM
1 Karma
I think this should work. You shouldn't need to include the host=* or sourcetype=* as every event has a host and sourcetype. |tstats count from datamodel={your data model} where index="es_web" AND {your data model}.action="blocked" by {your data model}.category
|sort 5 -count
... View more
10-25-2023
09:05 AM
The event code description trimming is not turned on by default. You need to specifically turn it on in a local props.conf.
... View more
10-24-2023
01:26 PM
Your second stats will not work because after the first stats you only have the User ID and count fields. The info_max_time and info_min_time fields no longer exist.
... View more
10-23-2023
02:30 PM
1 Karma
There are a number of event codes that have static descriptions of the event in each iteration of the event. This page shows how to trim off the event descriptions on ingest. This can save a lot of data. https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/Configuration
... View more
10-19-2023
03:28 PM
Something like this should work. I called the lookup db_names.csv ... change that to whatever your actual lookup is named. Everything above the comment just emulates the data you gave. | makeresults count=1
| eval _raw="DatabaseName,Instance,CPUUtilization
A,A1,10
A,A2,20
C,C1,40
C,C2,50
D,D,60"
| multikv forceheader=1
| fields - _time, _raw, linecount
```^^^^ This emulates the data you gave ^^^^```
| eval inst_cpu=Instance+"#"+CPUUtilization
| fields - Instance CPUUtilization
| inputlookup db_names.csv append=true ```<-- change the lookup name here```
| stats list(inst_cpu) as inst_cpu by DatabaseName
| mvexpand inst_cpu
| eval Instance=mvindex(split(inst_cpu,"#"), 0)
| eval CPUUtilization=mvindex(split(inst_cpu,"#"), 1)
| fillnull value="NULL" Instance CPUUtilization
| fields - inst_cpu
... View more
10-19-2023
02:57 PM
1 Karma
You could do something like this. Imagine a lookup that looks like this. ip_lookup.csv ip 10.10.53.22 127.0.0.1 192.168.0.54 index=myindex ([| inputlookup ip_lookup.csv | stats values(eval("ip=\""+src_ip+"\"")) as search | eval search=mvjoin(search, " OR ")]) This produces ... index=myindex (src_ip="10.10.53.22" OR src_ip="127.0.0.1" OR src_ip="192.168.0.54") ... or ... index=myindex ([| inputlookup ip_lookup.csv | stats values(eval("src_ip!=\""+ip+"\"")) as search | eval search=mvjoin(search, " AND ")]) This produces ... index=myindex (src_ip!="10.10.53.22" AND src_ip!="127.0.0.1" AND src_ip!="192.168.0.54") You could even just put the sub-search into a macro that references the lookup to make using it easier for reuse. An example would be like this. Macro name: my_ip_macro Macro definition: [| inputlookup ip_lookup.csv
| stats values(eval("src_ip=\""+ip+"\"")) as search
| eval search=mvjoin(search, " OR ")] Search using the macro: index=myindex `my_ip_macro`
... View more
10-19-2023
01:49 PM
What do you mean by pulling the _raw? Do you mean "pulling" as in removing _raw from the fields list? Are you using the collect command to add the events into another index? If you do and don't explicitly set a sourcetype then you will not incur a licensing hit for the data copied to the other index.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma given to
