About fredclown

fredclown

Thanks, and sorry I was not clear enough. I want to do this with props and transforms so that the fields are reusable.

fredclown

I have events in a log file and they have different formats from event to event. I'm wondering if there is any way to use the punct field to do conditional field extraction? Let's say I have these two punct formats ... ___::_---..__//:::__---_--_:______:____-___-__..._ ___::_---..__//:::__---_--_:______:___...:_-__...: Edit: I'm specifically asking about doing it with props and transforms so that the fields are reusable.

fredclown · ‎05-16-2025

I know it has been a while since this question was asked but here is a simple xml dashboard that will show all the other dashboards in the app along with the descriptions and links to them. It is populated dynamically with a rest search. All you would need to do would be to edit the app nav to look something like the below example if you call the dashboard "overview". If you don't call it "overview" then change the first view element to whatever you named the dashboard. Specifically, it is looking for the name that is shown in the URL bar, not the editable label in the dashboard. Navigation <nav search_view="search"> <view name="overview" default="true" /> <view name="search" /> <view name="analytics_workspace" /> <view name="datasets" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> </nav> Dashboard <dashboard version="1.1" theme="dark"> <label>Overview</label> <row id="cards"> <panel> <table> <search> <query>| rest /servicesNS/-/$env:app$/data/ui/views splunk_server=local | rename eai:acl.app as app | search isDashboard=1 app=$env:app$ title!=$env:page$ | table label description app title | sort label</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">100</option> <option name="drilldown">cell</option> <drilldown> <link target="_blank">/app/$row.app$/$row.title$</link> </drilldown> </table> </panel> </row> <row id="styles_row"> <panel> <html> <style> /* Hide the styles panel */ #styles_row { display: none; } /* Remove search tools (refresh, etc) */ .element-footer.dashboard-element-footer { display: none !important; } /* Remove hover background color */ #statistics .results-table tbody td.highlighted { background-color: #FAFAFA !important; } /* Remove hover background color dark mode */ .dashboard-panel[class*="dashboardPanel---pages-dark"] #statistics .results-table tbody td.highlighted { background-color: #31373B !important; } #statistics.results-table { padding: 10px; box-sizing: border-box !important; } /* Style the table to make it just a simple container element */ body table { width: 100% !important; min-width: 100% !important; display: block; box-sizing: border-box !important; border: none !important; -webkit-box-shadow: none !important; box-shadow: none !important; } [id^="cards"] table tbody td { font-family: Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif !important; } /* Hide the table header */ thead { display: none; } /* Make the tbody a grid layout */ tbody { display: grid; grid-template-columns: 33% 33% 33%; box-sizing: border-box !important; column-gap: 10px; row-gap: 10px; border: none !important; } /* Bold the dashboard title */ tr td:nth-child(1) { font-weight: bold; } /* Make the card text black in light mode */ tr td:nth-child(2) { color: #000000 !important; } /* Make the card text white in dark mode */ .dashboard-panel[class*="dashboardPanel---pages-dark"] tr td:nth-child(2) { color: #FFFFFF !important; } /* Hide the 3rd (app) and 4th (title) columns */ tr td:nth-child(3), tr td:nth-child(4) { display: none; } /* Turn the table rows into cards */ tbody tr { border-radius: 5px; border: 1px solid #999999; padding: 10px; } tbody tr, tbody tr td { box-sizing: border-box !important; display: block; background: #FAFAFA !important; } .dashboard-panel[class*="dashboardPanel---pages-dark"] tbody tr, .dashboard-panel[class*="dashboardPanel---pages-dark"] tbody tr td { background: #31373B !important; } .table td { padding-top: 0 !important; padding-bottom: 0 !important; } </style> </html> </panel> </row> </dashboard>

fredclown · ‎02-18-2025

As of the time of writing this it is only available on single value, single value icon, and single radial visualizations. I very much would like to see them add it for line graph visualizations.

fredclown · ‎10-11-2024

I know that not every feature in Dashboard Studio has been exposed in the UI yet. I see that you can set tokens on interaction with visualizations but I'm not seeing anything similar for inputs. Does anyone know if there is a change event handler for inputs in Dashboard Studio like there is in the XML dashboards? I've not seen anything in the docs, but I could just be looking in the wrong place. Thanks.

fredclown · ‎08-05-2024

We have a legacy all-in-one Splunk server. We have built out a new distributed environment that has an indexer cluster. We are phasing everything over to the new environment. As such the new search head cluster can search both the new indexers and the old all-in-one server. We plan on migrating all the UFs to start sending their logs to the new indexers soon. I have also set up the old server to be able to search the new indexers so that alerts and reports on that server will still continue to work once the inputs are sent to the new indexers. That way we can handle report migration separately and not have to do everything in one fell swoop. I was also planning on changing the old indexer into a heavy forwarder once the UFs are repointed so that any scripted inputs it has or other kinds of inputs will be sent to the new indexers. My question is if I flip it to be a heavy forwarder I know any new inputs it gets will get sent to the new indexers which should be find for alerts and reports as it can also search the new indexers. However all the existing stored logs I know those will not be migrated into the new indexers but will the old server still be able to search those logs once it is a heavy forwarder? Will it still search it's own locally indexed data as well as the new indexers? Thanks.

fredclown · ‎07-29-2024

Couldn't you theoretically deploy an app with a scripted input that would make changes to files in etc/system/local? Not saying this is the best method because if it fails you could brick the forwarder, but I would think it is theoretically possible if there are no other means possible.

fredclown · ‎07-26-2024

This is the new link to the documentation. https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Configuredistributedsearch#Use_the_CLI

fredclown · ‎07-19-2024

In the _cluster app on the cluster manager there is an indexes.conf file that specifically sets repFactor to 0 for the _introspection, _telemetry, _metrics, and _metrics_rollup indexes. Is there a reason these indexes should not be replicated? Thanks.

fredclown · ‎07-18-2024

punct can be super helpful for trying to diagnose issues by looking at the kinds of events in your logs. I use this pretty regularly on Windows machines when there is an issue going on. index=wineventlog | stats latest(_raw) as _raw count by source, punct | sort - count

fredclown · ‎07-17-2024

Yes, if it can be done with stats that would be best. It is the Splunky way to do it.

fredclown · ‎07-17-2024

Have you tried using a left (also called outer) join vs and inner join. An inner join will only give you data where the node_id appears in both sets of data. A left join will give you all the results from the base search joined where it matches in the sub search.

fredclown · ‎07-17-2024

Is something like this what you are looking for? Set the time range picker to your desired range. index=windows EventCode=4624 Account_Name IN ("Larry","Curly","Moe") | eval Logon_Account_Name=mvindex(Account_Name, 1) | table _time, ComputerName, Logon_Account_Name | sort _time

fredclown · ‎05-24-2024

You can search the internal Splunk logs to see if there are any errors logged. If you run this what do you get? index=_internal sendemail sourcetype!=splunkd_ui_access sourcetype!=splunkd_remote_searches ERROR

fredclown · ‎05-24-2024

This is the beauty of using DNS CNames to reference all your Splunk servers in configuration. Ideally you don't put references to any physical names in your configs. That way when you switch servers you can build your new server along side your old server and then when you want to switch to a new servers you just flip the CName over to the new server.

fredclown · ‎05-01-2024

Oh, I think I just found the answer. Looks like in the alert_actions.conf file there is the hostname property that if you explicitly put https:// in front of the url then you can avoid having it tack on the web port when it sends emails. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf

fredclown · ‎05-01-2024

We have a load balancer sitting in front of our search head cluster that is reverse proxying the connection to the search heads over https port 443. The search head web interfaces are running on port 8000. The issue is when our search heads send out alert emails they append 8000 to the load balancer url which doesn't work because the load balancer is listening on 443. Is there a way to tell the search heads to leave off the port or specify a different port explicitly in the alert emails?

fredclown · ‎10-25-2023

I think this should work. You shouldn't need to include the host=* or sourcetype=* as every event has a host and sourcetype. |tstats count from datamodel={your data model} where index="es_web" AND {your data model}.action="blocked" by {your data model}.category |sort 5 -count

fredclown · ‎10-25-2023

The event code description trimming is not turned on by default. You need to specifically turn it on in a local props.conf.

fredclown · ‎10-24-2023

Your second stats will not work because after the first stats you only have the User ID and count fields. The info_max_time and info_min_time fields no longer exist.

fredclown · ‎10-23-2023

There are a number of event codes that have static descriptions of the event in each iteration of the event. This page shows how to trim off the event descriptions on ingest. This can save a lot of data. https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/Configuration

fredclown · ‎10-19-2023

Something like this should work. I called the lookup db_names.csv ... change that to whatever your actual lookup is named. Everything above the comment just emulates the data you gave. | makeresults count=1 | eval _raw="DatabaseName,Instance,CPUUtilization A,A1,10 A,A2,20 C,C1,40 C,C2,50 D,D,60" | multikv forceheader=1 | fields - _time, _raw, linecount ```^^^^ This emulates the data you gave ^^^^``` | eval inst_cpu=Instance+"#"+CPUUtilization | fields - Instance CPUUtilization | inputlookup db_names.csv append=true ```<-- change the lookup name here``` | stats list(inst_cpu) as inst_cpu by DatabaseName | mvexpand inst_cpu | eval Instance=mvindex(split(inst_cpu,"#"), 0) | eval CPUUtilization=mvindex(split(inst_cpu,"#"), 1) | fillnull value="NULL" Instance CPUUtilization | fields - inst_cpu

fredclown · ‎10-19-2023

You could do something like this. Imagine a lookup that looks like this. ip_lookup.csv ip 10.10.53.22 127.0.0.1 192.168.0.54 index=myindex ([| inputlookup ip_lookup.csv | stats values(eval("ip=\""+src_ip+"\"")) as search | eval search=mvjoin(search, " OR ")]) This produces ... index=myindex (src_ip="10.10.53.22" OR src_ip="127.0.0.1" OR src_ip="192.168.0.54") ... or ... index=myindex ([| inputlookup ip_lookup.csv | stats values(eval("src_ip!=\""+ip+"\"")) as search | eval search=mvjoin(search, " AND ")]) This produces ... index=myindex (src_ip!="10.10.53.22" AND src_ip!="127.0.0.1" AND src_ip!="192.168.0.54") You could even just put the sub-search into a macro that references the lookup to make using it easier for reuse. An example would be like this. Macro name: my_ip_macro Macro definition: [| inputlookup ip_lookup.csv | stats values(eval("src_ip=\""+ip+"\"")) as search | eval search=mvjoin(search, " OR ")] Search using the macro: index=myindex `my_ip_macro`

fredclown · ‎10-19-2023

What do you mean by pulling the _raw? Do you mean "pulling" as in removing _raw from the fields list? Are you using the collect command to add the events into another index? If you do and don't explicitly set a sourcetype then you will not incur a licensing hit for the data copied to the other index.

fredclown · ‎10-19-2023

Posts	154
Solutions	10
Karma Given	81
Karma Received	39
Member Since	‎07-17-2013

Online Status	Offline
Date Last Visited	a month ago

Is it possible to do search time field extraction ...

Dashboard Studio Input Change Event Handler

Can you still search logs on an indexer that is tu...

Non replicated internal indexes

Remove HTTP Port in Alert Email Link

Prepending String to All Email Subjects

Dashboard Drilldown Get Index of Click MV Field

Any examples of using now() inside map command?

Is it possible to use | format to get !=?

Is there only ones way to Fire JavaScript After Se...

Re: Is it possible to do search time field extract...

Is it possible to do search time field extraction ...

Re: How to create a central dashboard containing l...

Re: Any way to use trellis layout on Dashboard Stu...

Dashboard Studio Input Change Event Handler

Can you still search logs on an indexer that is tu...

Re: How to deploy updates to inputs.conf, outputs....

Re: distsearch.conf and the web interface

Non replicated internal indexes

Re: Describe the pattern matching syntax used for ...

Re: How to get full results from 2 queries joined ...

Re: How to get full results from 2 queries joined ...

Re: Query user login over a period of time

Re: Error in 'sendalert' command: Alert script ret...

Re: Splunk Migration of Search Head and Deployment...

Re: Remove HTTP Port in Alert Email Link

Remove HTTP Port in Alert Email Link

Re: need spl into datamodel search

Re: Reduce the noise out of Security EventCodes..

Re: How to display Avg of Users per Time Picker?

Re: Reduce the noise out of Security EventCodes..

Re: Left Outer Join in Splunk

Re: Filtering events using a lookup table

Re: How to pull all data using Log Event Trigger A...

Re: Pivot/UnPivot Data from json msg

Are you a member of the Splunk Community?