Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Redman11
Redman11
Explorer
Member since:
02-24-2016
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 02-24-2016 |
Activity Feed
- Got Karma for Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK?. 06-05-2020 12:48 AM
- Got Karma for Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK?. 06-05-2020 12:48 AM
- Got Karma for Why does the SearchManager data event fire more than once in Splunk 6.5.2?. 06-05-2020 12:48 AM
- Got Karma for Why does the SearchManager data event fire more than once in Splunk 6.5.2?. 06-05-2020 12:48 AM
- Got Karma for Re: Why does the SearchManager data event fire more than once in Splunk 6.5.2?. 06-05-2020 12:48 AM
- Posted Re: How can I anonymize fields of data that has undergone indexed extractions? on Getting Data In. 03-13-2018 08:51 AM
- Posted Re: How can I anonymize fields of data that has undergone indexed extractions? on Getting Data In. 03-13-2018 03:02 AM
- Posted Re: How can I anonymize fields of data that has undergone indexed extractions? on Getting Data In. 03-09-2018 06:02 AM
- Posted Re: Why does the SearchManager data event fire more than once in Splunk 6.5.2? on Splunk Dev. 06-08-2017 07:06 AM
- Posted Re: Why does the SearchManager data event fire more than once in Splunk 6.5.2? on Splunk Dev. 05-30-2017 01:34 AM
- Posted Why does the SearchManager data event fire more than once in Splunk 6.5.2? on Splunk Dev. 02-21-2017 01:43 AM
- Tagged Why does the SearchManager data event fire more than once in Splunk 6.5.2? on Splunk Dev. 02-21-2017 01:43 AM
- Posted Re: Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 03-07-2016 08:39 AM
- Posted Re: Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 03-07-2016 02:36 AM
- Posted Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 02-24-2016 01:14 PM
- Tagged Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 02-24-2016 01:14 PM
- Tagged Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 02-24-2016 01:14 PM
- Tagged Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 02-24-2016 01:14 PM
- Tagged Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 02-24-2016 01:14 PM
- Tagged Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? on Splunk Search. 02-24-2016 01:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 2 |
03-13-2018
08:51 AM
@jeffland No probs. Thanks again for your help.
... View more
03-13-2018
03:02 AM
@jeffland Thank you very much for taking the time to answer this, it's really appreciated. The first approach works - I end up with the field missing from both the indexed fields and the _raw which is exactly what I need, so thanks for that. The second method doesn't work though. I get the original value of the field as a single-value. Here is the props.conf for that test:
[MySourceType]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = TSV
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = DateTime
TIME_FORMAT = %Y-%m-%d %H:%M:%S
category = Structured
disabled = false
pulldown_type = true
TRANSFORMS-dropMaskedCLI = dropMaskedCLI
SEDCMD-maskedCLI = s/^([\S ]+\t)(\S+\t)(\S+\t)(.+)/\1\2\4/
The transforms.conf:
[dropMaskedCLI]
REGEX = .
SOURCE_KEY = field:Masked_CLI
DEST_KEY = field:Masked_CLI
FORMAT = Masked_CLI::-
WRITE_META = true
[accepted_keys]
is_valid = field:Masked_CLI
I'm assuming you meant the hyphen in the FORMAT command as a string literal in your example? The data I'm loading looks like this (tab-separated):
DateTime DialedNumber Masked_CLI WithheldFlag
2018-02-24 00:00:02 4789226712 07123456789 N
If you've any idea why this does not work I'd be interested to hear, but you've given me a working solution. Once again thanks very much for your help!
... View more
03-09-2018
06:02 AM
@jeffland @Dan Did you get this to work? I've the exact same problem, but following the approach above I always end up with a multi-value field containing the original field value and the replacement value specified by the FORMAT command. If I put FORMAT = $1, then I just get the original value. I can successfully use a SEDCMD to remove the value from _raw, so that part of the problem is fixed, but I'm struggling with the indexed field. This seems to be much harder to do than it should be! Any help would be much appreciated! I'm using 7.0.2. What I'd ideally like to do is drop the field completely, but I'm happy if I can at least mask it.
... View more
06-08-2017
07:06 AM
1 Karma
For info - this behaviour is still present in Splunk 6.6.1
... View more
05-30-2017
01:34 AM
Hi, no I don't yet have a solution that isn't a hack. I was going to upgrade to 6.6 and see if it is resolved then. If not, I'll raise a support case with Splunk.
... View more
02-21-2017
01:43 AM
2 Karma
I've just upgraded to Splunk 6.5.2 from 6.3.1 and the data event of the SearchManager seems to be firing twice under certain circumstances. This behaviour was not present in 6.3.1. Is this a bug? I'm aware that some of the search events have changed in 6.5 (e.g. finalized has been removed), but I can't find anything referring to this behaviour in the documentation. Some very simple code below demonstrates the problem:
JavaScript tester.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, SearchManager) {
var searchManager = new SearchManager({
autostart: false,
search: "| makeresults"
});
searchManager.data("results").on('data', function() {
console.log("data event fired");
});
searchManager.startSearch();
});
SimpleXML tester.xml
<form script="tester.js">
<label>Tester</label>
<row>
Test of data event
</row>
</form>
Console Output
data event fired
data event fired
If I use the _bump command, and then reload the tester.xml dashboard page, the data event only fires once. If I reload the page again, it fires twice, and then continues to fire twice until I call _bump again. Has anyone experienced this issue?
... View more
- Tags:
- splunk-enterprise
03-07-2016
08:39 AM
@bruceclarke: Thanks Bruce - I'll go with that.
... View more
03-07-2016
02:36 AM
@bruceclarke: Thanks for this Bruce. That looks a good fit. Is it possible to include the parameters required by the individual dashboards (country, county, town, etc) as parameters to the REST API call?
... View more
02-24-2016
01:14 PM
2 Karma
I have a large number of reports to produce according to a data hierarchy. These are to be provided to the client as PDFs. Currently I have some of these representing the top level of the hierarchy written as dashboards, as there are multiple searches within each dashboard. However, I need to bulk produce these PDFs across the data hierarchy. Here's some example usage:
I need to produce a PDF containing several searches for each of the three countries: England, Scotland, Wales (the searches need this country as a parameter)
I need to produce a PDF containing several searches for each of the counties within that country (i.e one PDF per combination of country and county). The searches will need the country and county as parameters.
I need to produce a PDF containing several searches for each of the towns within that combination of country and county (i.e. one PDF per combination of country, county and town). The searches will need the country, county, and town as parameters.
They are to be emailed out as it is not practical to grant access to the dashboards themselves.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
