Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About gabriel_vasseur
gabriel_vasseur
Contributor
Member since:
03-14-2016
01-15-2025
Community Statistics
| Posts | 137 |
| Solutions | 8 |
| Karma Given | 73 |
| Karma Received | 39 |
| Member Since | 03-14-2016 |
Activity Feed
- Got Karma for Re: How to remove \ (backslash) using from URLs rex sed?. 12-10-2024 11:32 AM
- Got Karma for Re: How to run btool as REST command or via Search GUI?. 10-24-2024 01:50 PM
- Got Karma for Re: Is there a Splunk Version Control app?. 09-13-2023 01:28 PM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 09-11-2023 07:44 AM
- Karma Re: How to change a Simple XML table height when no results is found? for Paul_Dixon. 09-11-2023 07:40 AM
- Posted Re: How to execute javascript after a search on Splunk Search. 07-05-2023 08:24 AM
- Karma Re: Can an HTML button with value be done without using JS and CSS scripts? for niketn. 07-05-2023 05:16 AM
- Posted Dashboard prebuilt panel not using JS/CSS from the dashboard on Dashboards & Visualizations. 07-05-2023 02:29 AM
- Got Karma for Re: How to export a dashboard as a PDF file and still maintain the same screen layout?. 06-29-2023 11:21 AM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-27-2023 05:27 AM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-27-2023 02:23 AM
- Posted Re: How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-27-2023 01:22 AM
- Posted Re: How do you make a table that reduces in height when your dashboard search returns no results? on Splunk Search. 06-26-2023 06:45 AM
- Posted How to change a Simple XML table height when no results is found? on Dashboards & Visualizations. 06-26-2023 06:44 AM
- Posted Re: How do you make a table that reduces in height when your dashboard search returns no results? on Splunk Search. 06-26-2023 01:59 AM
- Posted Re: Is there a Splunk Version Control app? on Knowledge Management. 05-17-2023 02:57 AM
- Posted Re: Splunk Enterprise Security: How to backup and version control correlation searches used on Splunk Enterprise Security. 05-17-2023 02:54 AM
- Posted Re: Source Control Management on Knowledge Management. 05-17-2023 02:53 AM
- Posted Re: Version control management for Splunk Dashboards, Reports and Alerts on Dashboards & Visualizations. 05-17-2023 02:50 AM
- Posted Re: Version control management for Splunk Dashboards, Reports and Alerts on Dashboards & Visualizations. 05-17-2023 02:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-11-2023
07:44 AM
With high expectations I tried it and sadly it didn't work for me. However, building on your idea that it didn't like the CSS to be initially empty I eventually found the following solution: <dashboard version="1.1" theme="light">
<label>GABS Test css</label>
<row>
<panel>
<table id="doneID">
<title>Test</title>
<search>
<done>
<condition match="'job.resultCount' == 0">
<set token="doneTableHeightCSS">height: 50px !important;</set>
<set token="doneTableAlertCSS">position:relative; top: -130px !important;</set>
</condition>
<condition>
<set token="doneTableHeightCSS"></set>
<set token="doneTableAlertCSS"></set>
</condition>
</done>
<query>
| stats count
| search count=5
</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
</table>
</panel>
</row>
<row depends="$never_set$">
<panel>
<html>
<style>
#doneID .splunk-table {
1;
$doneTableHeightCSS$
}
#doneID .alert-info{
1;
$doneTableAlertCSS$
}
</style>
</html>
</panel>
</row>
</dashboard> More than happy to give you the credit for it. If you re-submit it I'll accept it as a solution.
... View more
- Tags:
- Thi
07-05-2023
08:24 AM
This doesn't work. It produces an error when the javascript is loaded. I've tried: $("#NameSearchID").on( "search:done", function() { Referring to this in the simple XML: <row>
<panel>
<table>
<search id="NameSearchID">
... Do you have a full working example?
... View more
07-05-2023
02:29 AM
I have things with IDs in my prebuilt panel, e.g.: <input type="link" id="submit_button6">
<choice value="submit">Gabriel</choice>
</input> And javascript and css loaded in my dashboard: <form version="1.1" script="GV-Utils:submit_button.js" stylesheet="GV-Utils:submit_button.css"> The panel works when it's in the simple XML of the dashboard, with the CSS applied and the JS triggering actions when the button is clicked as designed, but if I put the panel verbatim in a prebuilt panel and reference it in the dashboard the CSS is not applied and the JS doesn't happen. The reason I'd like that part of the dashboard in a prebuilt panel is so that users of my app (ES Choreographer | Splunkbase) can safely customise this part of the dashboard without touching the dashboard XML. If users touch the simple XML of the dashboard, it creates a "local" version of the whole dashboard which takes precedence over the "default" version and that for ever prevents this dashboard from being upgraded when the app is upgraded. Any ideas?
... View more
Labels
- Labels:
-
CSS
-
javascript
-
panel
-
simple XML
06-27-2023
05:27 AM
I don't understand your question about timing. The solution should not depend on the time it takes to run the search. It shouldn't depend on the search either. It doesn't work with "| stats count | where count>0" which is about the simplest search I can think of that produces no results. It takes no time at all, just however long it take to load the dashboard. A few seconds the first time, a fraction of a second when refreshing the page. Either way the CSS just doesn't work. I tried your suggestion but it yields the exact same behaviour. Have you got access to a Splunk Cloud instance of the same version (9.0.2303.201)? If yes, can you reproduce the issue?
... View more
06-27-2023
02:23 AM
It needs to work with Edge. I did check with Opera and got the exact same behaviour: doesn't work on first load, but if I go to "edit source" and back it starts working, but then doesn't work again if I reload the page.
... View more
06-27-2023
01:22 AM
Thanks for having as look. I thought this was going to be much more straightforward... I've now updated the original post with a lot more information. Hopefully that'll help?
... View more
06-26-2023
06:45 AM
Done: How to change a Simple XML table height when no re... - Splunk Community
... View more
06-26-2023
06:44 AM
The solution in Solved: Re: How do you make a table that reduces in height... - Splunk Community does not work anymore, at least not for Splunk Cloud version 9.0.2303.201. Hopefully it's just a simple tweak that's needed? **UPDATE** I'm adding a screenshot and the code that I use that used to work: <dashboard version="1.1" theme="dark">
<label>TEMP GABS test css</label>
<row>
<panel>
<table id="table1">
<search>
<done>
<condition match="'job.resultCount' != 0">
<set token="table1TableHeightCSS"></set>
<set token="table1TableAlertCSS"></set>
</condition>
<condition match="'job.resultCount' == 0">
<set token="table1TableHeightCSS">height: 50px !important;</set>
<set token="table1TableAlertCSS">position:relative; top: -130px !important;</set>
</condition>
</done>
<query>| stats count
| where count>0</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>| stats count
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row depends="$never_set$">
<panel>
<html>
<style>
#table1 .splunk-table{
$table1TableHeightCSS$
}
#table1 .alert-info{
$table1TableAlertCSS$
}
</style>
</html>
</panel>
</row>
</dashboard> **UPDATE2** If I go in and out of the edit source mode, it starts to work: But if I just reload the dashboard from scratch it doesn't. I've cleared all my browser's data (cookies, cache, etc) and restarted my browser (edge version 114.0.1823.51) and can confirm the same behaviour.
... View more
Labels
- Labels:
-
simple XML
06-26-2023
01:59 AM
This solution doesn't work anymore. We're on Splunk Cloud version 9.0.2303.201. Hopefully it's just a simple update that's needed?
... View more
05-17-2023
02:57 AM
1 Karma
You might like https://splunkbase.splunk.com/app/6895 to track changes to your knowledge objects. It's no effort, doesn't require git or anything else, and works equally well on-prem and in cloud.
... View more
05-17-2023
02:54 AM
You might like https://splunkbase.splunk.com/app/6895 to track changes to your knowledge objects. It's no effort, doesn't require git or anything else, and works equally well on-prem and in cloud. And it sounds like you should probably have a look at my ES Choreographer app: https://splunkbase.splunk.com/app/6309 as presented at .conf21 https://conf.splunk.com/files/2021/recordings/SEC1441A.mp4
... View more
05-17-2023
02:53 AM
You might like https://splunkbase.splunk.com/app/6895 to track changes to your knowledge objects. It's no effort, doesn't require git or anything else, and works equally well on-prem and in cloud.
... View more
05-17-2023
02:50 AM
You might like my new app https://splunkbase.splunk.com/app/6895 which allows you to track changes to knowledge objects . It's no effort, doesn't need any 3rd party software (so no git required for instance) and works equally well on-prem and in cloud.
... View more
- Tags:
- splunk
05-17-2023
02:50 AM
You might like my new app https://splunkbase.splunk.com/app/6895 which allows you to track changes to knowledge objects . It's no effort, doesn't need any 3rd party software (so no git required for instance) and works equally well on-prem and in cloud.
... View more
05-17-2023
12:30 AM
I did resolve this issue for us, as per my other post on this page. Weirdly it didn't involved the calculated_risk_score field as we just don't have that field at all. Weird!
... View more
04-19-2023
06:30 AM
I deleted everything and tried again, this time I specified the collection should be created in the Enterprise Security app and it worked. Still very confused about the "showing entries for: abc".
... View more
04-19-2023
05:48 AM
Talking about this app in case it's ambiguous: https://splunkbase.splunk.com/app/1724
I have used it to create a KV store, as apparently that's the only way to do so in splunk cloud. I have also created a corresponding lookup definition.
However, the resulting object is unusable. I keep getting:
"Error in 'inputlookup' command: Lookup failed because collection 'xyz' in app 'lookup_editor' does not exist, or user 'abc' does not have read access."
Both the lookup definition and the collection are global and readable by anyone. What am I missing?
When I edit the KVstore in the lookup editor, I can see a dropdown "showing entries for: abc". I'm really confused by this. How can the content of a lookup (KV store or not) depend on the user?
... View more
- Tags:
- kvstore
02-20-2023
02:25 AM
I have HTML sections relying on some custom CSS in a dashboard and I can make them look great in either dark or light mode like so:
<form version="1.1" stylesheet="foobar_light.css" theme="light">
Or:
<form version="1.1" stylesheet="foobar_dark.css" theme="dark">
I would ideally like not to specify in which mode the dashboard should be seen and leave it to whatever the user's preference is. The problem is dark mode with the light CSS looks awful/unreadable and vice-versa.
Is there any way I can get splunk to choose the right CSS depending on the user's theme preference?
... View more
Labels
- Labels:
-
simple XML
02-09-2023
03:18 AM
For me, the risk event timeline works for the ES built-in RIRs such as "Risk - 24 Hour Risk Threshold Exceeded - Rule". However we don't use them and we have our own RIRs, for which we had the same problem as the OP. First step is to make sure our RIRs are mentioned in the "risk_notables" event type, otherwise the option to open the risk event timeline isn't there. Then, looking at "Risk - 24 Hour Risk Threshold Exceeded - Rule" it produces the following fields: risk_object risk_object_type risk_score risk_threshold risk_event_count mitre_tactic_id_count mitre_technique_id_count source (multivalue fields with the name of RR correlations) source_count I can't confirm which ones are indeed required, but adding these to my RIR got rid of the error message. The next hurdle was "Risk event search did not return any results. Please verify notable drilldown search." This was solved by copying the drilldown search from "Risk - 24 Hour Risk Threshold Exceeded - Rule" to the drilldown search of my RIR. Now the risk event timeline works for us 🙂 Of course, it's too limited to be useful but it's nice to be aligned with what ES is doing in case it one day becomes useful.
... View more
- Tags:
- for
02-07-2023
08:07 AM
1 Karma
We have the same problem. Here is a screen shot: I would love for this question from the original poster to be answered: "Is there somewhere that defines what fields are required in the Risk Notable?"
... View more
09-08-2022
02:40 AM
2 Solutions. First one uses only commands that should be in older versions of splunk: | makeresults
| eval test=split("abc,defgh,a,asdfasdfasdfasdf,igasfasd", ",")
| eval other_important_field="blah"
| mvexpand test
| eval length=len(test)
| eventstats max(length) as max_length, min(length) as min_length
| eval longest=if(length==max_length, test, null() ), shortest=if(length==min_length, test, null() )
| stats values(longest) as longest, values(shortest) as shortest, values(test) as test by _time other_important_field If like me you don't like the idea of using mvexpand (for instance because in some cases your multivalue can be empty) you can use this alternative: It's using the newish mvmap command to massage the multivalue and then the min/max statistical function that works with strings using alphabetical order. The use of printf ensures alphabetical and numerical order are the same. | makeresults
| eval test=split("abc,defgh,a,asdfasdfasdfasdf,igasfasd", ",")
| eval test2=mvmap(test, printf("%05d", len(test) ) . " - " . test)
| eval shortest=min(test2), longest=max(test2)
| eval shortest=replace(shortest, "^\d+ - ", "" ), longest=replace(longest, "^\d+ - ", "" ) Hope this helps.
... View more
09-08-2022
02:34 AM
I had a similar issue where I needed to find the longest string in a multivalue, but I didn't want to mess with my results by using mvexpand and then gathering them back with a stats, because in some cases the multivalue could be empty. So I found this solution instead. It's using the newish mvmap command to massage the multivalue and then the min/max statistical function that works with strings using alphabetical order. The use of printf ensures alphabetical and numerical order are the same. | makeresults
| eval test=split("abc,defgh,a,asdfasdfasdfasdf,igasfasd", ",")
| eval test2=mvmap(test, printf("%05d", len(test) ) . " - " . test)
| eval shortest=min(test2), longest=max(test2)
| eval shortest=replace(shortest, "^\d+ - ", "" ), longest=replace(longest, "^\d+ - ", "" ) Hope this helps.
... View more
08-18-2022
03:49 AM
1 Karma
esix_splunk's answer is great and use rest searches worked for us on-prem, however splunk cloud doesn't allow you to query the indexers, for some security reason. I'm pretty sure they wouldn't allow a scripted input running btool on the indexers either. Someone at splunk recommended https://splunkbase.splunk.com/app/6368/ and we had no trouble getting it installed on cloud and it's working well for us. Not sure how it does it but it works.
... View more
08-18-2022
03:44 AM
I don't think https://splunkbase.splunk.com/app/1607/ has any chance of being installed in splunk cloud. Someone at splunk suggested we try https://splunkbase.splunk.com/app/6368/ which we had no trouble getting installed in cloud and it's working for us.
... View more
07-22-2022
01:04 AM
This issue arised again for us this week. Users were reporting very poor performance from splunk, although it didn't look like the platform was heavily used. The most obvious symptom was a large amount of ad-hoc searches running modular_action_invocations each taking several minutes to finish. It was interesting to read https://community.splunk.com/t5/Splunk-Enterprise-Security/modular-actions-invocations-macro/m-p/390880 that this search is triggered when a notable is expanded within Incident Review, so that is bound to happen a lot. Looking at the macro definition and running it manually, I couldn't reproduce the slowness: it seemed to complete fine. I checked what @lakshman239 recommended and everything seemed to be in order. That said I did notice that the macro starts with "tstats summariesonly=false" and I know from experience that tstats searches can be surprisingly slow even if data model summaries cover virtually all the search time window, so I changed it to "tstats summariesonly=true". This seems to have helped the issue although it's early to tell. I'm aware that I've introduced the risk of the search not returning results for recent notables, however we don't really use fancy adaptive responses so I don't think it'll impact us. I'm also aware I've made upgrading ES in the future more difficult: if that macro is updated by the upgrade, my local tweak will override the upgraded version and it might break things. But desperate times calls for desperate measures. I hope this helps and/or someone can provide a better solution.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-15-2025
11:00 AM
|
Karma given to
