Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jsoderling
jsoderling
New Member
Member since:
02-01-2019
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-01-2019 |
Activity Feed
- Posted Re: Add search field based on value of another field on Splunk Search. 03-26-2019 06:17 AM
- Posted Re: Add search field based on value of another field on Splunk Search. 03-25-2019 07:25 AM
- Posted Re: Add search field based on value of another field on Splunk Search. 03-25-2019 05:19 AM
- Posted Re: Add search field based on value of another field on Splunk Search. 03-21-2019 10:02 AM
- Posted Add search field based on value of another field on Splunk Search. 03-21-2019 08:50 AM
- Tagged Add search field based on value of another field on Splunk Search. 03-21-2019 08:50 AM
- Tagged Add search field based on value of another field on Splunk Search. 03-21-2019 08:50 AM
- Posted How to pass a dropdown token value to a query and pass the token label to a panel title? on Dashboards & Visualizations. 03-14-2019 10:50 AM
- Tagged How to pass a dropdown token value to a query and pass the token label to a panel title? on Dashboards & Visualizations. 03-14-2019 10:50 AM
- Tagged How to pass a dropdown token value to a query and pass the token label to a panel title? on Dashboards & Visualizations. 03-14-2019 10:50 AM
- Tagged How to pass a dropdown token value to a query and pass the token label to a panel title? on Dashboards & Visualizations. 03-14-2019 10:50 AM
Topics I've Started
03-26-2019
06:17 AM
I was never able to pass a new field to the query using a separate token. Splunk was always waiting for data input. I solved the issue by using the radio button's statement to add the field (Logon_ID).
<input type="radio" searchWhenChanged="true" token="priv_login_tok">
<label>Login Status</label>
<choice value="4624 Logon_ID!=0x0">Successful</choice>
<choice value="4625">Failed</choice>
<initialValue>4624</initialValue>
... View more
03-25-2019
07:25 AM
I think your comment didn't fully update.
... View more
03-25-2019
05:19 AM
This solution somewhat works. When I change values, the new search field doesn't change.
... View more
03-21-2019
10:02 AM
Thank you. This solution works as long, but I need to use "!=" with my new search field. The token is dropping the "!".
... View more
03-21-2019
08:50 AM
I have a dashboard panel with a radio input. If the user choose Selection A (4624), I need to add a field to the search. I've tried using eval with if in the search to add the new field, but it either errors out or never processes. Thanks.
<input type="radio" token="priv_login" searchWhenChanged="true">
<label>Login Status</label>
<choice value="4624">Successful</choice>
<choice value="4625">Failed</choice>
<initialValue>4624</initialValue>
<change>
<condition>
<set token="panellabel">$label$</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<title>$panellabel$ Privileged Account Logins</title>
<search>
<query>index=con_wineventlog_security src="gord*" (Account_Name="*.SA" OR Account_Name="*.*.WA") EventCode=$priv_login$ | stats count(EventCode)</query>
<earliest>$priv_agg_tok.earliest$</earliest>
<latest>$priv_agg_tok.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
... View more
- Tags:
- add
- splunk-enterprise
03-14-2019
10:50 AM
I want to pass a dropdown token value to a query and pass the token label to a panel title. Using to pull the label changes the value of the token in my query.
form>
Accounts Audit
<panel>
<input type="time" token="Enable_Acct_tok" searchWhenChanged="true">
<label>Time Frame</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="event_code_tok" searchWhenChanged="true">
<label>Event</label>
<choice value="4720">Created</choice>
<choice value="4725">Deleted</choice>
<choice value="4726">Disabled</choice>
<choice value="4722">Enabled</choice>
<choice value="4738">Modified</choice>
<initialValue>4720</initialValue>
<default>4720</default>
</input>
<single>
<title>$event_code_tok$ Accounts Total</title>
<search>
<query>index="con_wineventlog_security" sourcetype="WinEventLog:Security" EventCode=$event_code_tok$ stats dc("Account_Name")</query>
<earliest>$Enable_Acct_tok.earliest$</earliest>
<latest>$Enable_Acct_tok.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>60m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
