About ramgnisiv

ramgnisiv · ‎12-02-2019

Based on documentation, this could also work for you: curl -k -u admin:pass https://localhost:8089/services/saved/searches https://docs.splunk.com/Documentation/Splunk/6.1.3/RESTAPI/RESTsearch#POST_saved.2Fsearches

ramgnisiv · ‎11-14-2019

It's not possible by default. Some people attempt to build add-ons that somewhat do this. This is one of them: https://splunkbase.splunk.com/app/760/#/overview It hasn't been updated for almost 6 years, so good luck with that. I bet it will do nothing, but maybe you're lucky.

ramgnisiv · ‎11-14-2019

The real challenge lies in the mapping of your data to your organisational structure. If you do not have proper Configuration Management for all your CI's, you might want to consider using something like a KV store to map the data you are gathering to your organisational structure. Once in place, maintaining the CM(DB) will be one of the challenges you'll face when wanting to report on Capacity & Performance management across your organisation. Just my 2 cents.

ramgnisiv · ‎11-14-2019

Amazing explanation, awarded with 25 karma points

ramgnisiv · ‎11-13-2019

Thanks, i'm on 7.2.5 so i'll upgrade soon and check it out then

ramgnisiv · ‎11-11-2019

Timewrap would get rid of line 1 - 21 in a single go. For removing empty buckets from timespans, please consider the cont=false COMMAND See this question+ answer: https://answers.splunk.com/answers/73385/how-to-remove-empty-buckets-in-timechart.html

ramgnisiv · ‎11-11-2019

I run this command in Splunk to get the overview of Saved Searches: | rest /servicesNS/-/-/saved/searches splunk_server=local | fields title Perhaps this can guide you in the right direction.

ramgnisiv · ‎11-11-2019

@atammana_splunk Maybe i'm on the wrong version of Splunk, but in my local instance of Splunk, i have the beta app installed, but none of my xml dashboards have the "open in Dashboard app(beta)" option in the 3-dots dropdown. What version of Splunk are you running?

ramgnisiv · ‎10-29-2019

Thank you @gaurav_maniar . I will have a go with this one. I've accepted the answer.

ramgnisiv · ‎10-28-2019

@gaurav_manier, i assume this hidden text field is still part of the overview dashboard, right? I don't see how this solution accomplished the requirement to store the tokens outside of my dashboard xml. Can you elaborate?

ramgnisiv · ‎10-28-2019

This problem had to do with the newline characters in the search Stanza in the savedsearches.conf file. 2 ways to fix this: Escape the newline characters, or put the entire saved search on a single row. I choose the latter, so by adding all of the search on the same row, the problem was solved and the savedsearch was executed from thereon perfectly. edit: typos

ramgnisiv · ‎10-28-2019

Dear Splunkers, I have an overview dashboard that dynamically drills down into several hundred dashboards. This is done by passing tokens. This works great. I also have certain settings that apply across all dashboards (overview dashboard + all drilldown dashboards). These settings are for example the earliest=-90d@d or the trendInterval >-30d Currently, i set these settings as a token on the overview dashboard and i pass these settings as tokens to the downdrill dashboards. The downsides are that the tokens become part of the url and that i cannot use these tokens in dashboards in my app that are not accessible via a downdrill. I would have to set these tokens on those non-downdrillable dashboards separately. Question: Which ways are there to store these tokens outside of my overview dashboard? For example in a lookup, or in a .conf file? Or a script that i can import? Does anyone have experience with storing tokens outside of the xml of a dashboard and calling them in your dashboard?

ramgnisiv · ‎10-16-2019

I'm resolving this issue by removing the line breaks from all saved searches. Easiest way to do it is to use a tool, e.g. http://removelinebreaks.net/ where i can Convert line breaks to None and Convert paragraphs to No paragraph. This is just a workaround, it doesn't take away the fact that the stanza's are not meant/ cannot handle/ deal with line breaks in queries.

ramgnisiv · ‎10-16-2019

So how about unformatting? To get everything back into a single line. This will solve the issue for people that use savedsearches.conf stanza's where formatted code copy pasted from splunk GUI will cause everything after the first PIPE to be ignored by the savedsearch configuration on the search head.

ramgnisiv · ‎10-16-2019

The problem was with a CSS setting. The following setting was originally in the XML: .facets-mode-active .action-bar { display: none; } This has been changed to the new setting: .facets-mode-active .action-bar { display: all; } By setting display to all this has solved the issue.

ramgnisiv · ‎10-16-2019

Probably this is caused by a CSS setting. Investigating now. When all CSS is removed, pagination is working as expected. Will update the question when CSS issue is found and resolved.

ramgnisiv · ‎10-16-2019

Hi splunkers, I'm convinced that following clean code principles starts with proper indentation. That's why all my Splunk Queries are formatted using CMD + Shift + F after i write them. This gets you from this: index="application_snow_pr" sourcetype="snow:incident" opened_at!="" correlation_id!="" priority=2 earliest=-1d@d latest=@d | eval previousdate = relative_time( relative_time(now(), "@d") , "-1d") | eval opened_atepoc = strptime(opened_at, "%Y-%m-%d %H:%S") | where opened_atepoc>=previousdate | sistats dc(correlation_id) by it_product | eval _time = relative_time( relative_time(now(), "@d") , "-1d") to this: index="application_snow_pr" sourcetype="snow:incident" opened_at!="" correlation_id!="" priority=2 earliest=-1d@d latest=@d | eval previousdate = relative_time( relative_time(now(), "@d") , "-1d") | eval opened_atepoc = strptime(opened_at, "%Y-%m-%d %H:%S") | where opened_atepoc>=previousdate | sistats dc(correlation_id) by it_product | eval _time = relative_time( relative_time(now(), "@d") , "-1d") It's 100% the same query, but it's much more understandable. However, if you use the formatted query in a savedsearches.conf stanza, you are going to find out that the savedsearch in Splunk will only reflect everything BEFORE the first Pipe | In this particular example, only the following part of the query is stored in Splunk on the Search Head: index="application_snow_pr" sourcetype="snow:incident" opened_at!="" correlation_id!="" priority=2 earliest=-1d@d latest=@d Question: Is there a way to keep formatting clean in the savedsearches.conf stanza's, but also escaping the newline characters, so the savedsearch in Splunk will execute the full search, instead of only executing the part before the first PIPE? I could go and just rewrite (remove all whitespaces and formatting from the queries) the whole conf file, but it has well over a 100 saved searches already.

ramgnisiv · ‎10-16-2019

Hi Splunkers, I have developed a dashboard that contains Single Value results in a Trellis layout. The dashboard is displaying data based on a token that is passed from a different dashboard. All is working like a charm. There is 1 problem: When the number of results exceeds 20, i want to have the pagination option so users can scroll through the results. How do i enable this? I can't find a Simple XML option for Trellis that does this. By the way: If i run the search via the Search option and i visualise it there using Trellis, i get the pagination button and i'm able to paginate through the search results perfectly. This just doesn't seem to work when i run the same search in a Dashboard Panel. O yeah, Sorting Trellis results would take care of a lot of headaches, but that doesn't seem to be possible yet with Splunk.

ramgnisiv · ‎10-08-2019

@richgalloway: Thanks for your response. All saved searches are created using savedsearches.conf and are pushed to the search head cluster using a CICD pipeline. This way we keep track of all changes done to the app. This applies for everything done in the app, so for all knowledge objects we use the pipeline and we use configuration as code. I'm not sure i understand your advice. My savedsearches.conf for this particular search looks like this: [score_sonarqube_projectcomponent_[blockers_comparison]_[1d]] action.summary_index = 1 action.summary_index._name = development_sdlcmetrics_summary_pr alert.track = 0 cron_schedule = 15 1 * * * description = {"type":"metric","id":"0083","dataCreateSource":"sonarqube","scheduleFrequency":"1d","description of metric":"comparison of average number of blockers versus number of blockers per SonarQube key per day"} dispatch.earliest_time = -1d@d dispatch.latest_time = @d display.visualizations.show = 0 enableSched = 1 request.ui_dispatch_app = sdlc_metrics request.ui_dispatch_view = search search = index=development_sdlcmetrics_summary_pr search_name="metric_sonarqube_projectcomponent_[blockers]_[1d]" earliest=-1d@d latest=@d | stats avg(blockers) as countPerKey by sonarKey | appendcols [ search index=development_sdlcmetrics_summary_pr search_name="metric_sonarqube_projectcomponent_[blockers]_[1d]" earliest=-1d@d latest=@d | stats avg(blockers) as avgCount | eval avgCount=round(avgCount,2)] | fields * | filldown avgCount | eval comparison=case(countPerKey>=avgCount,"3", countPerKey==avgCount,"2", countPerKey<avgCount,"1") | sistats avg(comparison) as score by sonarKey countPerKey avgCount | eval _time = relative_time( relative_time(now(), "@d") , "-1d") So when it is viewed via the jobInspector, i can see that the saved search is executed, but it only takes the very first part ( that part is: index=development_sdlcmetrics_summary_pr search_name="metric_sonarqube_projectcomponent_[blockers]_[1d]" earliest=-1d@d latest=@d ), probably because of the |stats command that is directly behind it.

ramgnisiv · ‎10-08-2019

Hi guys, I created a saved search that looks like this: index=development_sdlcmetrics_summary_pr search_name="metric_sonarqube_projectcomponent_[blockers]_[1d]" earliest=-1d@d latest=@d | stats avg(blockers) as countPerKey by sonarKey | appendcols [ search index=development_sdlcmetrics_summary_pr search_name="metric_sonarqube_projectcomponent_[blockers]_[1d]" earliest=-1d@d latest=@d | stats avg(blockers) as avgCount | eval avgCount=round(avgCount,2)] | fields * | filldown avgCount | eval comparison=case(countPerKey>=avgCount,"3", countPerKey==avgCount,"2", countPerKey<avgCount,"1") | sistats avg(comparison) as score by sonarKey countPerKey avgCount | eval _time = relative_time( relative_time(now(), "@d") , "-1d") The goal is to get this data into a summary index. The problem is, that when i use the jobInspector in the saved search "view recent" overview, i can see that the field "eventSearch" only contains the very first part of the query, being this: index=development_sdlcmetrics_summary_pr search_name="metric_sonarqube_projectcomponent_[blockers]_[1d]" earliest=-1d@d latest=@d I've come to learn that this happens because everything before the first search command is viewed upon as the eventSearch by Splunk. Question: How do i make sure that all of my query is ran by the saved search, up to the part just before the "sistats" command?

ramgnisiv · ‎10-01-2019

Thanks, i think I am describing something like the CIM indeed. If there was no CIM, would the approach described make sense to you?

ramgnisiv · ‎09-27-2019

Hi guys, I'm building an app that collects metrics from various sources. In the dashboard, all metrics will be shown with Trellis layout, categorised by source. My current set-up of saved searches (about 100 saved searches across 8 sources with 1 summary index) does not yet follow a naming convention for the search result fields. A lot of saved searches do not even have a defined result field. I'm thinking of creating a common field across ALL of my saved searches (potentially this will grow from 100 to 1.000) where i would call this common field something like 'metric' or in other cases 'score'. My theory behind this is that when i want to search across the output of my saved searches in my summary index, i could search with something like this: index=summary_index_name search_name=* | stats avg(metric) by saved_search_name In theory, this would make searching and splitting of data across all saved searches very easy. Each summary index populating saved search would look a little something like this: index=name_of_index | sistats avg(field_name) as metric by field_name_2 My questions: What is your opinion about this set-up using a common field name? What can go wrong when i use this type of set-up using a common field name? What else could i do to make life easy when i have a lot of saved searches and i want easy maintenance and flexibility in dashboarding?

ramgnisiv · ‎09-16-2019

Hi, i have a field that i need to trim. The field can have a number of different strings, for which i want to trim everything except 1 word. The fields can look like this: Deployment of ABC with version 3.0.348 to Acceptance Deployment of Application XYZ with version : 1.8.540 to Production I'm only interested in the ABC and XYZ part of these strings. The part that says "Deployment of " or "Deployment of Application " at the start should be removed. The part that says " with version ........" all the way to the end should be removed. What would be the best way of doing this? I've been messing about with regex, trim, replace, without success. Edit: The following regex appears to work when i try it in any regex editor online, but i cannot get this to work in splunk: .*(?:Application)? ? (.*) with.*

ramgnisiv · ‎04-01-2019

The final version i needed is based on Kamlesh's answer with the addition of the spath command | rest /servicesNS/-/-/saved/searches splunk_server=local | where search like "%`comment(%" | rex field=search "\`comment\(\"(?<comment>.*)\)\`" | fields search comment | spath input=comment | fields - search comment

ramgnisiv · ‎04-01-2019

i did it with spath, i will share it in the question

Posts	35
Solutions	4
Karma Given	27
Karma Received	4
Member Since	‎12-04-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Use .conf/lookup/script to store tokens outside of...

Proper formatting (identation) of queries in saved...

How to enable pagination in dashboard with Trellis...

Multiple stats commands in saved search do not wor...

Your opinion on creating a common field name acros...

Dynamic trim of field at both start and end

Retrieve comments from savedsearches.conf via Splu...

Use of >1 annotation using >1 epoch for earliest a...

Re: [command ]Getting the list of all saved search...

Re: export csv not showing up in splunk dashboard

Re: Splunk as a tool for capacity and performance ...

Re: How to create an alert for multiple alerts (fi...

Re: How to convert old dashboard XML to new dashbo...

Re: How to write a condition for dashboard to igno...

Re: [command ]Getting the list of all saved search...

Re: How to convert old dashboard XML to new dashbo...

Re: Use .conf/lookup/script to store tokens outsid...

Re: Use .conf/lookup/script to store tokens outsid...

Re: Multiple stats commands in saved search do not...

Use .conf/lookup/script to store tokens outside of...

Re: Proper formatting (identation) of queries in s...

Re: Keyboard Shortcut to Format Search

Re: How to enable pagination in dashboard with Tre...