Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dbcase
dbcase
Motivator
Member since:
12-15-2015
06-05-2020
Community Statistics
| Posts | 704 |
| Solutions | 24 |
| Karma Given | 11 |
| Karma Received | 57 |
| Member Since | 12-15-2015 |
Activity Feed
- Got Karma for How to adjust chart column width?. 08-24-2021 03:26 AM
- Got Karma for Re: Dashboard: Set Token When Dashboard is Open. 09-09-2020 06:31 PM
- Got Karma for Add to a dynamic dropdown. 08-20-2020 09:18 AM
- Got Karma for Re: Condition value using a drilldown. 07-21-2020 06:10 PM
- Karma Re: String concatentation (strcat command) is duplicating results for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How can I set a default "yes" radio button that can change to "no" with user input? for kamlesh_vaghela. 06-05-2020 12:49 AM
- Karma Re: How can I set a default "yes" radio button that can change to "no" with user input? for niketn. 06-05-2020 12:49 AM
- Got Karma for Unset a token if it is equal to a value. 06-05-2020 12:49 AM
- Got Karma for Re: What is wrong with my regex? "Regex: missing terminating ] for character class". 06-05-2020 12:49 AM
- Got Karma for Re: How to find the time duration between logins. 06-05-2020 12:49 AM
- Got Karma for Re: How to find the time duration between logins. 06-05-2020 12:49 AM
- Got Karma for Re: Histogram of counts. 06-05-2020 12:49 AM
- Got Karma for How to get the top 10 values using timechart?. 06-05-2020 12:49 AM
- Got Karma for Re: How to get the top 10 values using timechart?. 06-05-2020 12:49 AM
- Got Karma for Condition value NOT equal to....whatever. 06-05-2020 12:49 AM
- Got Karma for If a token is equal to a value run query 1 if it is equal to another value run query 2. 06-05-2020 12:49 AM
- Got Karma for Re: Tricky regex. 06-05-2020 12:49 AM
- Got Karma for Re: Tricky regex. 06-05-2020 12:49 AM
- Got Karma for Re: Seems to be complicated regex day. 06-05-2020 12:49 AM
- Got Karma for Re: Another regex. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
06-17-2025
03:11 AM
Thanks @simon21. This worked a treat. To go one step further - if you are using classic dashboard, you can simply put the css in the source code. Create a new hidden row by using depends="$alwaysHideCSSStyle$" . Then put the css code within <panel> -> <html> -> <style> tags <row depends="$alwaysHideCSSStyle$"> <panel> <html> <style> div.leaflet-popup-content tr:first-child { display: none; } div.leaflet-popup-content tr:nth-child(2) { display: none; } </style> </html> </panel> </row>
... View more
05-16-2025
04:43 PM
I know it has been a while since this question was asked but here is a simple xml dashboard that will show all the other dashboards in the app along with the descriptions and links to them. It is populated dynamically with a rest search. All you would need to do would be to edit the app nav to look something like the below example if you call the dashboard "overview". If you don't call it "overview" then change the first view element to whatever you named the dashboard. Specifically, it is looking for the name that is shown in the URL bar, not the editable label in the dashboard. Navigation <nav search_view="search">
<view name="overview" default="true" />
<view name="search" />
<view name="analytics_workspace" />
<view name="datasets" />
<view name="reports" />
<view name="alerts" />
<view name="dashboards" />
</nav> Dashboard <dashboard version="1.1" theme="dark">
<label>Overview</label>
<row id="cards">
<panel>
<table>
<search>
<query>| rest /servicesNS/-/$env:app$/data/ui/views splunk_server=local
| rename eai:acl.app as app
| search isDashboard=1 app=$env:app$ title!=$env:page$
| table label description app title
| sort label</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/$row.app$/$row.title$</link>
</drilldown>
</table>
</panel>
</row>
<row id="styles_row">
<panel>
<html>
<style>
/* Hide the styles panel */
#styles_row {
display: none;
}
/* Remove search tools (refresh, etc) */
.element-footer.dashboard-element-footer {
display: none !important;
}
/* Remove hover background color */
#statistics .results-table tbody td.highlighted {
background-color: #FAFAFA !important;
}
/* Remove hover background color dark mode */
.dashboard-panel[class*="dashboardPanel---pages-dark"] #statistics .results-table tbody td.highlighted {
background-color: #31373B !important;
}
#statistics.results-table {
padding: 10px;
box-sizing: border-box !important;
}
/* Style the table to make it just a simple container element */
body table {
width: 100% !important;
min-width: 100% !important;
display: block;
box-sizing: border-box !important;
border: none !important;
-webkit-box-shadow: none !important;
box-shadow: none !important;
}
[id^="cards"] table tbody td {
font-family: Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif !important;
}
/* Hide the table header */
thead {
display: none;
}
/* Make the tbody a grid layout */
tbody {
display: grid;
grid-template-columns: 33% 33% 33%;
box-sizing: border-box !important;
column-gap: 10px;
row-gap: 10px;
border: none !important;
}
/* Bold the dashboard title */
tr td:nth-child(1) {
font-weight: bold;
}
/* Make the card text black in light mode */
tr td:nth-child(2) {
color: #000000 !important;
}
/* Make the card text white in dark mode */
.dashboard-panel[class*="dashboardPanel---pages-dark"] tr td:nth-child(2) {
color: #FFFFFF !important;
}
/* Hide the 3rd (app) and 4th (title) columns */
tr td:nth-child(3), tr td:nth-child(4) {
display: none;
}
/* Turn the table rows into cards */
tbody tr {
border-radius: 5px;
border: 1px solid #999999;
padding: 10px;
}
tbody tr, tbody tr td {
box-sizing: border-box !important;
display: block;
background: #FAFAFA !important;
}
.dashboard-panel[class*="dashboardPanel---pages-dark"] tbody tr, .dashboard-panel[class*="dashboardPanel---pages-dark"] tbody tr td {
background: #31373B !important;
}
.table td {
padding-top: 0 !important;
padding-bottom: 0 !important;
}
</style>
</html>
</panel>
</row>
</dashboard>
... View more
07-23-2024
01:19 PM
Sorry, I am too used to Linux. I believe the equivalent btool command on windows is: $splunkhome$/bin/splunk.exe btool web list settings | FINDSTR max_upload
... View more
06-21-2024
05:14 AM
The same solution should work <row rejects="$hide_panel$">
<panel>
<table>
<search>
<done>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</condition>
</done>
<query>| makeresults
| timechart count span=1d partial=f</query>
<earliest>0</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
... View more
08-04-2023
11:05 AM
thanks a lot !!
... View more
12-20-2022
06:19 AM
Thanks this worked for me
... View more
01-24-2019
01:22 PM
@dbcase - If you are not sure of word rest in your data, you can just use rex field=x1 "\/\S+\/(?<word>\S+)
... View more
10-24-2018
05:00 PM
HI @dbcase
Thanks for posting on Splunk Answers.
I'm glad to see that you are using the Karma bounty feature! However, it won't work if you don't engage with the user trying to answer your question. Please approve the question below so the user can receive their Karma points. Or, if the solution didn't help you, please explain why so that they — or someone else — can.
Thanks!
... View more
10-15-2018
03:58 PM
... | rex "sites\/\d+\/(?:templates\/)?(?<APIcall>[^?\s]+)"
Returns these results for APIcall:
Match 1
Group APIcall 160-173 alarmSessions
Match 2
Group APIcall 730-736 deltas
Match 3
Group APIcall 1284-1291 cmsInfo
Match 4
Group APIcall 1863-1878 actionTemplates
Match 5
Group APIcall 2442-2447 rules
Match 6
Group APIcall 3013-3065 network/instances/13b0ce18140337362f.1.0/points/isOn
Match 7
Group APIcall 3667-3682 actionTemplates
Your intro made it look to me like you wanted everything after sites/somenumber except in the 4th you specifically said the result should be actionTemplate so I skipped /templates/. However, you did not say that #6 should be just isOn so I include the longer result for that one. If you wanted just what MuS returned, you are also all set.
... View more
09-28-2018
07:49 PM
@dbcase, thanks for that. From the output, the last record has a type of failure as "streaming" and gives me a 1 under success since the StatusIndex is 2. So it works for the last record.
TypeOfFailures Failures Success
1726 0 0
3152 0 0
9385 0 0
STREAMING 0 1
Now for others (3 out of 4), the type of failures are coming as integers. What do you have in Properties.Args? Is that field extracted from JSON and has only the string values?
... View more
08-28-2018
09:21 AM
@dbcase, Splunk does provide you that through depends attribute to your visualization element i.e. could be row, panel, input, visualizations like table, chart, html etc. Only when token/s in depends are set the respective visualization will be displayed.
In the <panel> where toknoncvr and tokcvr are used... add depends token to display them only when they are set....
<row depends="$tokcvr$,$toknoncvr$">
<panel>
<single>
<search>
<query>| makeresults
| fields - _time
| eval percentage=0
| eval percentage=round((($tokcvr$/$toknoncvr$)*100),2)
| table percentage</query>
</search>
<option name="numberPrecision">0.00</option>
<option name="unit">%</option>
</single>
</panel>
</row>
... View more
08-23-2018
02:50 PM
1 Karma
Hi Niketnialy,
This one worked perfect
<input type="time" searchWhenChanged="true">
<label>Enter time range</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
<change>
<set token="displayTime">($label$)</set>
</change>
</input>
... View more
01-12-2019
01:07 PM
@dbcase If your problem is resolved, please accept the answer to help future readers and to give the answerer the promised Karma points.
... View more
06-22-2018
08:34 PM
Hi @dbcase,
What about forwarding data from the source itself using
http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system
... View more
06-13-2018
05:00 PM
If this has worked for you, please accept @somesoni2's answer (I have converted is comment to an answer for that purpose) so that future readers can know that this has been answered.
Thanks!
... View more
06-08-2018
11:38 AM
Solved it by going another direction, here is the relevant XML
<fieldset submitButton="false" autoRun="false">
<input type="time" token="time_field1" searchWhenChanged="true">
<label>Select a time period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="radio" token="dummy" searchWhenChanged="true">
<label>Search by:</label>
<choice value="Premise">Premise</choice>
<choice value="MAC">MAC</choice>
<change>
<condition value="Premise">
<set token="displaypremise"></set>
<unset token="displaymac"></unset>
<unset token="form.premise_id_field"></unset>
</condition>
<condition value="MAC">
<unset token="displaypremise"></unset>
<set token="displaymac"></set>
<unset token="form.premise_id_field"></unset>
</condition>
</change>
</input>
<input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$displaypremise$">
<label>Enter a Premise ID</label>
<fieldForLabel>premiseid</fieldForLabel>
<fieldForValue>premiseid</fieldForValue>
<search>
<query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex "Premise=\s+(?<premiseid>\d+)"|dedup premiseid</query>
<earliest>$time_field1.earliest$</earliest>
<latest>$time_field1.latest$</latest>
</search>
<delimiter> </delimiter>
<change>
<set token="panelyes"></set>
</change>
</input>
<input type="multiselect" token="premise_id_field" searchWhenChanged="true" depends="$displaymac$">
<label>Enter a MAC ID</label>
<fieldForLabel>premiseid</fieldForLabel>
<fieldForValue>premiseid</fieldForValue>
<search>
<query>index="blah_camera_status" sourcetype=access_combined_blah_camerastatus |rex max_match=0 "Mac=\s+(?<premiseid>[a-fA-F0-9\.:-]{12,17})"|mvexpand premiseid|dedup premiseid</query>
<earliest>$time_field1.earliest$</earliest>
<latest>$time_field1.latest$</latest>
</search>
<delimiter> </delimiter>
<change>
<set token="panelyes"></set>
</change>
</input>
</fieldset>
... View more
06-04-2018
11:42 AM
1 Karma
found it
<input type="time" token="time_field">
<label>Please select a time period</label>
<change>
<set token="tokDisplaySelectedTime">$label$</set>
</change>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
... View more
05-31-2018
03:19 PM
This seemed to work
index=wls "request from premise"|rex "X-Forwarded-For:\s+(?<ipaddr>\d+.\d+.\d+.\d+)"|rex "request from premise\s+(?<premiseid>\d+)"|dedup ipaddr|search [search index=main source=*access* |rex “HTTP.\d+.\d+.\s+(?<status>\d+)”|rex "blah.com.\s+(?<ipaddr>\d+.\d+.\d+.\d+)"|where status=400|dedup ipaddr|table ipaddr]|stats list(premiseid) as "Premise ID" by ipaddr
... View more
05-30-2018
09:39 AM
@dbcase, I have converted @somesoni2 's comment to Answer. Please accept to mark this question as answered! 🙂
... View more
05-29-2018
01:09 PM
Try adding this eval before the iCamera2 eval
...| eval rssiid=tonumber(trim(rssiid)) |eval rssiid=if(cmodel="iCamera2-C....."
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
