Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spike021
spike021
Explorer
Member since:
01-20-2016
06-05-2020
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 01-20-2016 |
Activity Feed
- Got Karma for Is it possible to use Jenkins to automate a Splunk App build?. 06-05-2020 12:48 AM
- Karma Re: Why is my regex not matching for a multivalue field? for alemarzu. 06-05-2020 12:47 AM
- Posted Re: Is it possible to use Jenkins to automate a Splunk App build? on Installation. 05-31-2016 02:25 PM
- Posted Re: Is it possible to use Jenkins to automate a Splunk App build? on Installation. 05-31-2016 02:23 PM
- Posted Is it possible to use Jenkins to automate a Splunk App build? on Installation. 05-31-2016 01:19 PM
- Tagged Is it possible to use Jenkins to automate a Splunk App build? on Installation. 05-31-2016 01:19 PM
- Tagged Is it possible to use Jenkins to automate a Splunk App build? on Installation. 05-31-2016 01:19 PM
- Tagged Is it possible to use Jenkins to automate a Splunk App build? on Installation. 05-31-2016 01:19 PM
- Posted Re: Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? on Splunk Search. 01-25-2016 11:44 AM
- Posted Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? on Splunk Search. 01-25-2016 11:16 AM
- Tagged Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? on Splunk Search. 01-25-2016 11:16 AM
- Tagged Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? on Splunk Search. 01-25-2016 11:16 AM
- Tagged Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? on Splunk Search. 01-25-2016 11:16 AM
- Tagged Using eval for a search. Drilldown XML ignores my lookup link and just re-uses the original search query, but with it narrowed down to the cell selection? on Splunk Search. 01-25-2016 11:16 AM
- Posted Re: Why is my regex not matching for a multivalue field? on Splunk Search. 01-21-2016 02:01 PM
- Posted Re: Why is my regex not matching for a multivalue field? on Splunk Search. 01-21-2016 01:59 PM
- Posted Re: Why is my regex not matching for a multivalue field? on Splunk Search. 01-21-2016 11:36 AM
- Posted Re: Why is my regex not matching for a multivalue field? on Splunk Search. 01-21-2016 11:11 AM
- Posted Re: Why is my regex not matching for a multivalue field? on Splunk Search. 01-21-2016 11:03 AM
- Posted Re: Why is my regex not matching for a multivalue field? on Splunk Search. 01-21-2016 08:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 |
05-31-2016
02:25 PM
Oh, just in case I didn't clarify enough, this is an App that also includes Python-based scripted inputs. So there needs to be test coverage for them, which would probably need to be run from within the Splunk environment (or at least run using a bash shell script that runs them manually with ./splunk cmd python).
... View more
05-31-2016
02:23 PM
Hi @shaskell,
The reason I'm looking into this is mainly that it will be an official application released by my company, and as such needs to have some kind of testing/building process that can be run as necessary.
Currently I have a process similar to yours where I work out of a local directory with a git master, commit changes, create the tar, and re-upload to Splunk as an upgrade.
However, that process does not always work. It may be the Splunk installation itself, but regardless I'm trying to figure out the best, uniform way to update the app for testing, and then for the real world so that errors can be avoided as much as possible.
Also, in my case, the project will need functionality testing with integration tests and unit tests as it is a release requirement.
I'll explore and definitely update the post if I figure out a solid way.
... View more
05-31-2016
01:19 PM
1 Karma
Pretty much just what the title says.
I'm not looking for Jenkins integration. I mean using Jenkins like with any other build process setup, but for a Splunk App.
Right now I'm developing an App but the process for getting new builds is very rough, and I run into issues where I constantly need to make small changes in order to get updates working. If I could automate any of the build process it would be very helpful.
Thanks!
... View more
01-25-2016
11:44 AM
So even if I comment out the tag block, I still have the same issue where clicking on the cell pretty much performs the query again, except with something appended so it gets narrowed down to anything with the cell's contents.
I use dedup, but I used dedup earlier and it worked ok for doing the new search with the drilldown.. so I'm very confused.
... View more
01-25-2016
11:16 AM
Sorry for the mouthful in the title.
I'm using a drilldown in the XML for a component in a dashboard which worked fine until I changed the query building the component to use 'eval'.
Originally I'd be able to click the cell, get the string within, and open a new tab in the browser with a separate custom search going using that cell's string.
I changed the backend query to get the table's data a different way. I'd like to launch a new search with the cell's string. What I did in the process was, for the moment, just using the URL for the search I wanted, except with $click.value$ inserted to get the unique result. Probably not the best way in general (any tips?) but it suited my needs for that particular moment.
However, I have a newer search query for the functionality I want. The data itself displays just fine in the table. But when I click a cell, I get redirected to a new search that pretty much uses the original search query (the newest one that uses eval), except it inserts the cell's string as a qualifier, so that the new results are filtered down just to events with that string. Technically that's right, but I don't want the new search to use eval at all. It should pretty much do what I had it do before, which is just "index=... etc. | table "A", "B". The weird thing is that I double checked the XML "source" and my drilldown link is still there..
I hope that use case makes sense... Is it possible it has to do with how I start the new search? I looked through this Answers board a bit as well as the docs and I have to say I'm a bit confused on the best way to just drilldown to a new search using SimpleXML, not Advanced XML.
Thanks!
... View more
01-21-2016
02:01 PM
Although sometimes it still happens even when there are elements in that dictionary, so I'm not totally sure.
... View more
01-21-2016
01:59 PM
Thanks! I think the issue might be related to "empty" dictionaries. Occasionally for that section I don't have results, so the json looks like:
{
"timestamp": "2016-01-21T14:44:28",
"SOME_FIELD": "etc.",
"ANOTHER_FIELD": "...",
"IMPORTANT": {},
"test": [
[
"something",
1.0
]
]
}
... View more
01-21-2016
11:36 AM
I might need to play around with the regex a bit more. Occasionally the Key field is getting data from other fields, probably since you used _raw.
... View more
01-21-2016
11:11 AM
That worked! Processing took a bit longer than I expected but that definitely seems to have done the job!
Thank you so much, alemarzu! I know it was a bit back and forth the past few hours trying to figure it out.
... View more
01-21-2016
11:03 AM
I think so! Would you mind pasting the query? Some of it is a bit blurry in the screenshot.
... View more
01-21-2016
08:51 AM
I think we're getting closer. The values are showing up now. The problem is I don't think having all the keys as field names works. Each event has its own set of keys. So I think it'd be better to have a "Keys" field that contains all possible keys for someevent.IMPORTANT. The ordering of those keys should match the ordering of their respective values in a "Values" field. So three columns. Something like "EVENT_NAME", "Keys", "Values".
Otherwise I get a list of probably over a hundred fields, where each possible key in IMPORTANT is a field and not every event has a value for that key.
Still hoping this makes at least some sense.
... View more
01-21-2016
08:26 AM
My props/transforms are default right now since it seemed like Splunk could already pull out the top-level fields, as mentioned in my other comment a moment ago.
Maybe that's the problem.
... View more
01-21-2016
08:23 AM
So I actually added an example event that you might have missed.
{
"timestamp": "2016-01-21T14:44:28",
"SOME_FIELD": "etc.",
"ANOTHER_FIELD": "...",
"IMPORTANT": {
"a_string": 3,
"another_strong": 44,
"maybe_another...":95
},
"test": [
[
"something",
1.0
]
]
}
Originally my idea just for the absolute minimum (to at least show I'm able to retrieve that part of the JSON data) was to use a | table "timestamp", IMPORTANT.key, IMPORTANT.values .
Maybe that isn't a good way to go about this?
Splunk already recognizes the rest of the fields at the top level. So if I do | table "timestamp", "ANOTHER_FIELD" then it works fine
... View more
01-21-2016
08:19 AM
Well I do get:
IMPORTANT.a_string IMPORTANT.another_strong IMPORTANT.maybe_another...
But the values aren't populating, plus these fields should then be separated per events rather than being actual field names. I think what's happening right now is it sets all the keys from IMPORTANT in the first event as the field names, but there are many events, each with different keys in IMPORTANT. So just setting it the current way doesn't work since those keys will usually be different.
Usually I'll probably do something like | table "timestamp", IMPORTANT
So that I get three columns. First would be timestamp since each event has a unique timestamp. Second column would be the keys, and third would be values. Or something similar to that.
Does that make more sense? Hopefully it does.
... View more
01-21-2016
08:04 AM
Hmm. If I do that, it grabs each key of the dictionary, and turns them into the fields of the table. So I get a bunch of fields called "IMPORTANT_key_" and the integer value isn't shown at all.
... View more
01-21-2016
07:54 AM
I just added a comment with a sample event.
... View more
01-21-2016
07:53 AM
Odd formatting.
So a typical event looks something like this. Priority is to get the keys from the "IMPORTANT" dictionary, but values as well in their own field would be very useful if I could get this to work properly
{
"timestamp": "2016-01-21T14:44:28",
"SOME_FIELD": "etc.",
"ANOTHER_FIELD": "...",
"IMPORTANT": {
"a_string": 3,
"another_strong": 44,
"maybe_another...":95
},
"test": [
[
"something",
1.0
]
]
}
... View more
01-21-2016
07:24 AM
Mentioned it below, but it looks something like: index="myindex" | rex max_match=0 field="A" "(?[\da-z\.-]+\.[a-z\.]{2,6})\n(?\d{1,3})" | table "A", "C", "D"
So nothing particularly complicated, just to get data output, which isn't happening at all yet.
... View more
01-21-2016
07:23 AM
I hadn't before, so I just tried that but I still don't seem to be getting any results. My full search query winds up looking like: index="myindex" | rex max_match=0 field="A" "(?[\da-z\.-]+\.[a-z\.]{2,6})\n(?\d{1,3})" | table "A", "C", "D" so nothing absurdly complicated here just trying to get things working correctly.
... View more
01-20-2016
05:30 PM
I looked through quite a few posts on here and couldn't find an appropriate answer, so please bare with me.
I have events coming into Splunk in JSON format. The top-level fields are extracted fine. However, a nested map/dictionary is giving me issues. When I run a search to get the values from that inner dictionary, it works in that I get a resulting table like:
A B
--- ---
x y
z
y
z
s m
n
u - (- means None)
So, the y and z both belong to x and occasionally there are more than 2 items per each x. This happens for any x in A.
Since the cell in the table makes the values in B look separated by a newline, I created a regular expression that I've verified to correctly grab the logical groups for each y and z, if, for instance, they were just in a text box like this:
y
z
y
z
y
z
So the regex would properly grab the two as many times necessary, separately.
What I want to do is pull out each pair and separate the two items into two new fields, say C and D, and then later have a table where I have C and D grouped to field A.
The regex part of the command:
rex field="A{}{}" "(?<C>[\da-z\.-]+\.[a-z\.]{2,6})\n(?<D>\d{1,3})"
Note: the A{}{} together makes up the multivalue field, B, and A is just A as in the earlier part of my example.
The issue I'm running into is that when I pipe what should be the output from that statement into the table command, I don't get anything.. The regex is definitely confirmed working on a site like http://regexr.com/ just for sanity-checking.
So there must be something I'm missing. Maybe the initial table with my example just looks like newlines separate the two values into rows when it doesn't. In which case I tried using a \s as the separator rather than \n and it still doesn't work.
Or maybe there's a super simple explanation for an obvious mistake I'm making.
Regardless I would appreciate some help very much.
Thanks in advance.
... View more
