Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About devicenul1
devicenul1
Path Finder
Member since:
05-07-2014
06-05-2020
Community Statistics
| Posts | 38 |
| Solutions | 1 |
| Karma Given | 10 |
| Karma Received | 10 |
| Member Since | 05-07-2014 |
Activity Feed
- Karma Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for jacobtom. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time?. 06-05-2020 12:47 AM
- Got Karma for Re: Using eval to generate a dollar value and 2 decimals. 06-05-2020 12:47 AM
- Karma PDF Report is being shrunk for nirt. 06-05-2020 12:46 AM
- Karma Edit Form/Dashboard XML manually , Splunk does not refresh unless XML edited through GUI for DanMurad. 06-05-2020 12:46 AM
- Karma Re: Edit Form/Dashboard XML manually , Splunk does not refresh unless XML edited through GUI for nfilippi_splunk. 06-05-2020 12:46 AM
- Karma Re: DB Connect MS SQL Datetime for linu1988. 06-05-2020 12:46 AM
- Karma Re: DBConnect, $earliest$ and $latest$ for gfreitas. 06-05-2020 12:46 AM
- Karma TypeError: TableView.BaseRowExpansionRenderer is undefined for SumanthS. 06-05-2020 12:46 AM
- Karma Re: SplunkJS and HTML Dashboard for nfilippi_splunk. 06-05-2020 12:46 AM
- Karma Re: PDF Export and Eval for somesoni2. 06-05-2020 12:46 AM
- Karma Re: PDF Export and Eval for somesoni2. 06-05-2020 12:46 AM
- Got Karma for DB Connect MS SQL Datetime. 06-05-2020 12:46 AM
- Got Karma for DBConnect, $earliest$ and $latest$. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
09-11-2014
11:11 AM
1 Karma
Got this from support:
What happened is that on Saturday, 09/06/2014 - we passed a magic point where the epoch time returned 1410065408, which is (10^10)%(2^32).? Due to a bit of difference between the way Windows handles unsigned integers (it considers them 32 bit vs 64 bit), the value passed was being truncated.
So all in all, what does this impact Any 32-bit install of Splunk - Windows & Linux 64-bit installs of Splunk - Windows
This includes versions 5.x,6.x, and 6.1.x of Splunk.
... View more
09-11-2014
08:17 AM
6 Karma
I encountered this Tuesday(9/9/2014) and ended up putting a ticket in ... the rep I called into said that this is a bug they are currently working on. I can tell you I am running 6.1.1 but from the short conversation I had with him it sounded like it was all current versions running on Windows machines. I just sent another message asking for an update but I got the impression that this was a priority and they were going to issue a fix for it ASAP.
... View more
06-26-2014
05:30 AM
Strange below is my response from Splunk regarding versions that this is not working in
I can definitively say that the code you have here works fine in Splunk 6.0.4 (build 207768).
And fails in Splunk 6.1.1 (build 207789).
So I'm guessing this problem just comes around here and there. As I've tested in 6.0 (don't remember change version) and 6.1.1
... View more
06-20-2014
04:54 AM
Almost forgot to update this, I created a case for this issue and it is a confirmed bug. I've been working through the process this week but still have no ETA from Splunk on fix.
... View more
06-20-2014
04:50 AM
We were evaluating the DB Connect app with the data models to help build a self-service business intelligence platform. But there were too many problems with the implementation. I believe the DB Connect documentation says that if the field from your query is in a date / time format that is all you need to do. But we couldn't get that to work so we ran into similar problems your running into. Changes were another concern of ours as the db-mon tail thing wouldn't go back to import data that changed unless the rising column changes.
... View more
06-18-2014
08:17 AM
The space idea was a good work around, it still doesn't line up for me but it is a good thought. I know it's not excel but it kind of stinks you can't just pick a justification on a table (left or right) and it's applied to all data in the table.
... View more
06-17-2014
12:35 PM
The above convert actually ended up being bad news bears for me. We had total columns and it was causing values with formatting to be excluded from the total. I had to go back to no CONVERT in the SQL but doing the |addtotals first then | eval Column=tostring(Column,"commas")
... View more
06-17-2014
12:32 PM
1 Karma
Just a warning ... if your totaling these numbers (something like | addtotals row=f col=t column1 column2 column3 ) make sure you do the totals before you do the evals as changing the numbers to strings and formatting them with commas will exclude them from your total columns. Eval Column=tostring will also cause value to be left aligned as it's now a string and no longer a number in PDF exports.
... View more
06-17-2014
07:38 AM
Not sure of the specifics of your case but you can check my question that seems to be similar. Long story short, we were unable to get it to work in my scenario. The inputs.conf and props.conf in my question was updated to portray the information linu1988 was trying to express.
http://answers.splunk.com/answers/135908/db-connect-ms-sql-datetime
... View more
06-13-2014
11:29 AM
That makes complete sense ... if you come back and make an answer I'll mark it for you ^^. I worked around this by converting our columns in SQL, something like:
CONVERT(varchar(12), CONVERT(MONEY, table.column), 1) as MoneyColumn
... View more
06-13-2014
10:42 AM
I'm going to mark this as the answer as I think you were trying to get across the concept that you can't use SplunkJS within splunk. It's an additional component you download and wire for your own web apps. I was assuming (Since the documentation between the web framework and SplunkJS link to each other) that they were all useable inside Splunk. This would be the foundational thing I wasn't understanding.
... View more
06-13-2014
10:27 AM
I am using the integrated PDF generation. It just seems odd to me that it is so small ... like I said there is a good 20 / 25% of the page it could use.
... View more
06-13-2014
06:01 AM
did that make it a bit more clear? something still not making sense?
... View more
06-12-2014
01:54 PM
Experiencing the Exact same issue ... were you able to get it resolved? I'm using the code straight from the example, the documentation doesn't list BaseRowExpansionRenderer at all.
Example code:http://dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVM
my code: http://pastebin.com/8Ypy0tTe
... View more
06-12-2014
06:41 AM
6.1.1 known issues:
Events format settings like list, table, max lines, wrapping do not apply to PDF reports and are not used. (SPL-67491)
Were using Eval to do comma formatting on some fields:
eval Merch=tostring(Merch,"commas")
and noticed that in the generated pdf fields formatted with commas are not in line like they are with the dashboard. The other numbers are right aligned, they are left aligned
(dashboard)
|Merch |
| 1,260.00|
(exported pdf)
|Merch |
|1,260.00 |
... View more
06-12-2014
06:35 AM
I'm also having this problem, the more we use it for reporting the more we are printing PDFs. Seems like it's only using like 75% of the page. Documentation doesn't list any configuration changes you can make and I don't see this in the list of known issues for 6.1.1. Any thoughts / ideas / suggestions on next steps?
... View more
06-12-2014
05:49 AM
I added a bit more clarification to what I'm trying to accomplish to my post above. I feel like there is a foundational thing here I'm not understanding and to me the documentation isn't making clear.
I did start with a simple XML dashboard and converted to HTML. But like your example above, that is a lot of javascript for just a one SingleView component. Is it all necessary? I can't strip out all that unnecessary stuff, keep jus the CSS files, follow the dashboards style guide and use SplunkJS example code?
I know it's something I'm missing, I just don't know what it is.
... View more
06-12-2014
05:19 AM
Yes, I tried both the reload all objects and just views ... the views one doesn't work, the all objects one will sometimes work.
... View more
06-11-2014
01:28 PM
I'm having this exact same problem with Version 6.1.1 ... Any other ideas here, I've tried everything listed but it will not refresh custom dashboards. Doing a ?showsource=1 shows the out of date code.
... View more
06-10-2014
01:48 PM
Trying to build a simple HTML dashboard but there seems to be some foundational thing I'm not understanding. I've created a simple dashboard and converted to HTML, in the editor I've narrowed it down to just this:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<title>test HTML | Splunk</title>
<link rel="shortcut icon" href="{{SPLUNKWEB_URL_PREFIX}}/static/img/favicon.ico" />
<link rel="stylesheet" type="text/css" href="{{SPLUNKWEB_URL_PREFIX}}/static/css/bootstrap.min.css" />
<link rel="stylesheet" type="text/css" media="all" href="{{SPLUNKWEB_URL_PREFIX}}/static/css/pages/dashboard-simple-bootstrap.min.css" />
<link rel="stylesheet" type="text/css" media="all" href="{{SPLUNKWEB_URL_PREFIX}}/static/app/search/dashboard.css" />
</head>
<body>
<!--
BEGIN LAYOUT
This section contains the layout for the dashboard. Splunk uses proprietary
styles in <div> tags, similar to Bootstrap's grid system.
-->
<div class="dashboard-body container-fluid main-section-body" data-role="main">
<div class="span 12 dashboard-header clearfix">
<h2>test HTML</h2>
</div>
<div class="dashboard-row">
<div class="dashboard-cell" style="width: 100%;">
<div class="dashboard-panel">
<div class="panel-head">
<p>panel-head</p>
</div>
<div class="panel-body">
<p>panel-body</p>
<div class="splunk-view" id="single1"></div>
</div>
</div>
</div>
</div>
</div>
<!--
END LAYOUT
-->
<script type="text/javascript">
var deps = [
"splunkjs/mvc",
"splunkjs/mvc/singleview",
"splunkjs/mvc/searchmanager"
];
require(deps, function() {
var SingleView = require("splunkjs/mvc/singleview");
var SearchManager = require("splunkjs/mvc/searchmanager");
new SingleView({
id: "single1",
managerid: "search1",
beforeLabel: "count of Events",
el: $("#single1")
});
new SearchManager({
id: "search1",
earliest_time: "-15m",
latest_time: "now",
search: "index=_internal | stats count"
});
});
</script>
</body>
</html>
But it's just an empty page with just panel-head and panel-body showing up, the styles seem to be all messed up too. I suspect that I must create a new Splunk app and build the dashboards html pages in my custom app. Is that what I'm missing?
What my code is trying to accomplish, a working dashboard (minimal code) using the example code from the Web Framework Toolkit for the SingleView form component.
What I'm trying to accomplish, understanding how to start a Dashboard using a sample / examples from the documentation / web framework toolkit with minimum amount of required code.
... View more
05-20-2014
01:52 PM
No errors in dbx.log.
I've just worked around this by keeping the data in the DB And doing a DBQuery with a conversion on the epoch time for the $earliest$ and $latest$ time range values. Again, thank you for your help with this problem but I'm considering this closed at this point and just keeping our data in the DB.
... View more
05-20-2014
01:40 PM
The $earliest$ and $latest$ variables are in epoch time, so I just wrote a stored procedure that converts it to DATE and runs the query based on that.
SQL:
Create Procedure [dbo].[procedureName]
@EpochBeginDate INT,
@EpochEndDate INT
AS
BEGIN
Set NOCOUNT ON
DECLARE @BeginDate DATE;
DECLARE @EndDate DATE;
IF @EpochBeginDate IS NULL
BEGIN
--Defaulting to three months ago
SELECT @BeginDate = DATEADD(MONTH, -3, GETDATE());
END
ELSE
BEGIN
--adding EpochBeginDate to 01-01-1970
SELECT @BeginDate = DATEADD(s, @EpochBeginDate, '19700101');
END
IF @EpochEndDate IS NULL
BEGIN
--Defaulting to Today
SELECT @EndDate = GETDATE();
END
ELSE
BEGIN
--adding EpochEndDate to 01-01-1970
SELECT @EndDate = DATEADD(s, @EpochEndDate, '19700101');
END
-- Insert statements for procedure here
SELECT
FROM
WHERE
END
... View more
