I'd like to get a list of the data inputs and - ideally - the actual search behind each input. Is it possible to do this using the REST command in the Splunk GUI? ... View more

Hi. I have an interactive dashboard with a lot of data. It has multiple panels with performance data for a large number of hosts. I have been able to get it to run by a combination of things: - the individual panels select exceptions - the users can select Top 10, Top 20, Top 50 hosts - they can select a range of up to 7 days Anything more than 7 days will return truncated data errors. Is there a way to disable all other timeframe options from the timepicker selection choices? I'd really appreciate any insights you might have. Thanks. Barbara ... View more

Hi. Let me provide some backstory. I've been assigned some dashboards. I need to make them interactive, but one has about 250 servers and the other has nearly 5000 servers. I get truncated results for the multiple panels when I try to run them. So I've been trying to narrow the results down with minimal success. Currently, I'm focusing on the smaller dashboard. I am now looking for just the outliers for each panel, but that still returns truncated results. Now I'm trying to give the user the option to select the up to the Top 50 results, but each chart is a timechart with an eval statement split by host. Here is an example: index=perfmon eventtype=Hyperspace_Perfmon counter = "Processor Queue Length" | timechart span=1m values(Value) as Value by host limit=0 useother=f |fillnull Value=0 | untable _time, host, Value | timechart span=15m sum(eval(if(Value>20,1,0))) as CPU by host $Toptoken$ usenull=f | sort -CPU This limits the number of hosts to 50, but only gives me the first 50 hosts. If I add the token, to the sort line, I only get 50 records. ... View more

Hi. My boss has asked me to create a landing page for my team. He envisions it as something like the following... Data Analytics + KPI Dashboards + Interactive Dashboards + Custom Dashboards + Summarized Dashboards The pluses listed above aren't necessarily pluses or bullet points. They could be icons. Each link or icon would be clickable and contain groups of dashboards. I know that this would be much easier to achieve with a navigation bar. I just took the Building Apps with Splunk class and could do that right now, but that's not what he's looking for. Any ideas? Thanks. Barbara ... View more

I have okta data. One of the fields - id - contains a whole string of data which includes the browser and the app and the device. The problem is that the device is not consistently in the same location. If the user is trying to access Calendar, it might list the mobile device or the operating system (for Mac or iPhone) at the beginning of the string. Androids appear to list in parens with the version in the middle of the string. Here are some examples: Mac+OS+X/10.14 (18A391) CalendarAgent/416 Mozilla/5.0 (Linux; Android 8.1.0; SM-T580) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36 Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1 I'm using spath for other fields but they come in pairs. I have no idea how to parse this since the devices aren't located in a set place in the string. Here's a look at the actual json string: { [-] action: { [-] categories: [ [-] Sign-in Failure Suspicious Activity ] message: Sign-in Failed - User is currently locked out objectType: core.user_auth.login_failed requestUri: /api/v1/authn } actors: [ [-] { [-] displayName: SAFARI id: Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1 ipAddress: XXX.XX.XXX.XXX objectType: Client } ] eventId: tevoAE1o350RMaoTKZTQFuBhQ1555012915000 published: 2019-04-11T20:01:55.000Z requestId: XK@dMhHceXrbWBajIF8MnQAABPI sessionId: targets: [ [-] { [+] } ] } Any advice? ... View more

Hi. I'm trying to connect Tableau to Splunk. I have a number of searches saved as reports. Only 6 or 7 of them are working as data sources in Tableau. And one of those only works intermittently. Please keep in mind that I am not on the Splunk administration team so I have also submitted my questions to them. All of the reports appear to have the same permissions set. In the 6 or 7 that are working, I see all the fields. In the ones that are not working, I see only the _time and timespan fields. Is there some permission that needs to be set on the index or in the back-end of Splunk that I don't have access to? My boss has asked me to try to recreate some of our Splunk dashboards in Tableau. While I have told him, it would be easier to just connect to the source of the data (e.g., SQL Server), he wants to be able to connect to Splunk, too. I'd appreciate any assistance. Thanks. Barbara ... View more