Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mclane1
mclane1
Path Finder
Member since:
04-20-2016
05-31-2022
Community Statistics
| Posts | 34 |
| Solutions | 4 |
| Karma Given | 37 |
| Karma Received | 7 |
| Member Since | 04-20-2016 |
Activity Feed
- Karma Re: Removing null columns from a table for jadomaai. 05-31-2022 06:52 AM
- Posted Re: How to delete duplicate logs? on Splunk Search. 05-12-2022 07:22 AM
- Karma Re: Is it possible to use fillnull for fieldnames with a specific pattern? for somesoni2. 03-22-2022 01:23 AM
- Karma Re: How can I show results from Other? for christopherutz. 02-17-2022 01:44 AM
- Karma Re: How to export to csv the search results which used base search? for sudosplunk. 01-05-2022 01:29 AM
- Karma How to export to csv the search results which used base search? for pinksqtuason. 01-05-2022 01:29 AM
- Karma Re: How to export to csv the search results which used base search? for fsolercasanova. 01-05-2022 01:28 AM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 01-04-2022 09:46 AM
- Posted Re: How can I set a dynamic default value in a dropdown (Simple XML) on Dashboards & Visualizations. 01-04-2022 07:55 AM
- Karma Re: Change the message of "mouse over field" for niketn. 11-24-2021 07:57 AM
- Karma Re: How to change default color charts for adonio. 11-24-2021 07:08 AM
- Karma Re: How to make my computer trust splunkd's own self-signed certificate? for helderman. 10-19-2021 01:52 AM
- Karma How to make my computer trust splunkd's own self-signed certificate? for helderman. 10-19-2021 01:52 AM
- Posted Re: Use Trellis with many values by graph. on Splunk Search. 10-06-2021 02:43 AM
- Posted Use Trellis with many values by graph. on Splunk Search. 10-06-2021 02:07 AM
- Tagged Use Trellis with many values by graph. on Splunk Search. 10-06-2021 02:07 AM
- Posted Re: Hide HTML with simple checkbox on Dashboards & Visualizations. 10-05-2021 01:32 AM
- Karma Re: Timechart count by ip by fw_name over time with trellis for niketn. 10-05-2021 01:31 AM
- Got Karma for Re: Hide HTML with simple checkbox. 10-04-2021 08:08 AM
- Posted Re: Hide HTML with simple checkbox on Dashboards & Visualizations. 10-04-2021 07:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-12-2022
07:22 AM
I use something like this : <your search>
| streamstats count by _raw
| where count>1
| eval eid=_cd
| table eid
| streamstats count
| outputlookup delete_dupplicate_byeid.csv.gz You select and number your wanted selection. After you can delete step by step : <your search>
| eval eid=_cd
| search [| inputlookup delete_dupplicate_byeid.csv.gz
| eval tmp=0 | where count>=tmp*10000 AND count<=tmp*10000+9999
| fields eid | format]
| delete
... View more
01-04-2022
07:55 AM
Thank you very much for this tip. It doesn't work for me on 8.2.0 in type="multiselect" 😭
... View more
10-06-2021
02:43 AM
Use trellis in a chart (form or dashboard): <row>
<panel>
<chart>
<search>
<query>index="_internal"
| bin _time
| stats count by _time, sourcetype, status
| eval {status}=count
| fields - status, count
| fillnull value=0
| stats sum(*) as * by _time, sourcetype</query>
<earliest>-15m@m</earliest>
<latest>now</latest>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">area</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">top</option>
<option name="refresh.display">preview</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">0</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">sourcetype</option>
<option name="height">1600</option>
</chart>
</panel>
</row>
... View more
10-06-2021
02:07 AM
Hello, I don't find solution here and I managed to get it to work. First of all, if you want separate in many dashboards your seach you can do that. index="_internal"
| timechart count by sourcetype You can activate trellis by sourcetype. But in each graph you want status (by exemple). Please try this query : index="_internal"
| bin _time
| stats count by _time, sourcetype, status
| eval {status}=count
| fields - status, count
| fillnull value=0
| stats sum(*) as * by _time, sourcetype
... View more
- Tags:
- trellis
10-04-2021
07:32 AM
1 Karma
I find solution. When we have already many inputs you must specify the searchWhenChanged and set to "true" <row>
<panel>
<title>Manage alerts</title>
<input type="checkbox" token="detail_input_token" searchWhenChanged="true">
<label></label>
<choice value="hide">Hide detail</choice>
<initialValue>hide</initialValue>
</input>
<html>debug detail_input_token:$detail_input_token$</html>
<html rejects="$detail_input_token$">
<body>
<p>
<A HREF="/manager/myapp/data/lookup-table-files?ns=myapp&pwnr=-&search=mySearch&count=100" target="_blank">
Manage <B>lookup mySearch</B> (csv files).
</A>
</p>
</body>
</html>
</panel>
</row> Now it works
... View more
09-28-2021
12:56 AM
Hello <row>
<panel>
<title>Manage alerts</title>
<input type="checkbox" token="detail_input_token">
<label></label>
<choice value="hide">Hide detail</choice>
<initialValue>hide</initialValue>
</input>
<html>debug detail_input_token:$detail_input_token$</html>
<html rejects="$detail_input_token$">
<body>
<p>
<A HREF="/manager/myapp/data/lookup-table-files?ns=myapp&pwnr=-&search=mySearch&count=100" target="_blank">
Manage <B>lookup mySearch</B> (csv files).
</A>
</p>
</body>
</html>
</panel>
</row> It works in splunk 6.4.2 We migrate on splunk 8.2 and it doesn't work now. I do many change without success. Does somebody have an idea ? Thanks in advance.
... View more
05-19-2021
07:52 AM
Hello, Sorry, I'm using splunk 6.4.2 I find this command : index=_internal "INFO StreamedSearch - Streamed search connection terminated" savedsearch_name="My_Alert" | table _time, search_id, server, active_searches, elapsedTime, search, savedsearch_name And the frequency is the same. I schedule a mail for each alert, and it's the same in my outlook than on splunk.
... View more
05-18-2021
09:23 AM
Hello, I created a small alert compiling data per minute for the last 24 hours: (index=my*filter) (myConstraint) | bin span=1m _time
| eval fieldX=formule
| stats count(eval(field="OK")) AS OK, count as Total by index, field1, ..., fieldN, _time
| append [| inputlookup MyLookup.csv | addinfo | where _time > relative_time(info_max_time, "-24h")]
| stats max(OK) as OK, max(Total) as Total by index, field1, ..., fieldN, _time
| outputlookup append=f MyLookup.csv I configure the alert with earliest=-5m and latest=now Schedule window : 0 I try with and without acceleration without success. I schedule my search : * * * * * Expiration : I keep 1 h of alerts The alert runs correctly but, it runs each 5 to 10 minutes. I see in tasks the execution time is less than 15s (between 6 and 15 sec) : The goal : another alert must run each 5 min and must look last 2h to generate alerts. Directly on the real time the alert duration is 3 min. I hope the inspect the "lookup" is quicker.
... View more
Labels
- Labels:
-
alert action
-
cron
03-25-2021
04:05 AM
After some research we can add js by splunk. It works, thank you. <form script="convert_html_token1_to_divId_html_panel_with_token1.js">
<label>TEST_HTML</label>
<row>
<panel>
<table>
<title>Select one line</title>
<search>
<query>|inputlookup muLookup | table Label, URL, Purposes, Actions</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="dataOverlayMode">none</option>
<option name="count">20</option>
<drilldown>
<set token="actions">$row.Actions$</set>
<set token="html_token1">$row.Actions$</set>
</drilldown>
<fields>["Label","URL","Purposes"]</fields>
</table>
</panel>
</row>
<row>
<panel>
<title>My formated content</title>
<html>
<body>$actions$
<br/>to<br/>
<div id="html_panel_with_token1"></div>
</body>
</html>
</panel>
<panel>
<title>Javascript</title>
<html>
<iframe src="https://mySplunk/en-US/static/app/myApp/convert_html_token1_to_divId_html_panel_with_token1.js" height="200" width="1000" style="border:none;"></iframe>
</html>
</panel>
</row>
</form> Add file JS in : App->manage app->Find you App and "Edit Properties"->Upload asset convert_html_token1_to_divId_html_panel_with_token1.js require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function($, mvc,) {
var submittedTokens = mvc.Components.get('submitted');
// Listen for a change to the token html_token1 value
submittedTokens.on("change:html_token1", function(model, html_token1, options) {
var tokHTMLJS=submittedTokens.get("html_token1");
if (tokHTMLJS!==undefined)
{
$("#html_panel_with_token1").html(tokHTMLJS);
}
});
}); You can see result in https://mySplunk/en-US/static/app/myApp/convert_html_token1_to_divId_html_panel_with_token1.js
... View more
03-19-2021
02:35 AM
Thank you very much for your quick answer. Splunk is deployed in a production environment (unix) and requires root rights to be able to browse / edit / create files. Despite our a lot of attempts to change the rights, with each modification in the application (addition/update of a dashboard or other), the rights go back to root. It is therefore always complicated to ask a systems engineer to perform the manipulation with the ITIL standards that go with it. Create Dashboard : less than 1 hour Create a js file on splunk without the application : 3 days (we must ask to a lot of people and explain what we do many times) https://en.wikipedia.org/wiki/ITIL
... View more
- Tags:
- js
- production
03-18-2021
10:42 AM
Hello, I want to explain clearly to others people what to do by use case. I create a lookup myLookup.csv : Label, URL, Purposes, Actions useCase1,myUrl1, purpose of the useCase1,"Do that and that and click on <a href=""link1"" target=""_blank"">link1</a>" useCase2,myUrl2, purpose of the useCase2,"Do that and that and click on <a href=""link2"" target=""_blank"">link2</a>" useCase3,myUrl3, purpose of the useCase3,"Do that and that and click on <a href=""link3"" target=""_blank"">link3</a>" It's an exemple, in my case, I have some action more difficult. My dashboard : <form>
<label>MyLabel</label>
<row>
<panel>
<table>
<title>Select one line</title>
<search>
<query>|inputlookup myLookup | table Label, URL, Purposes, Actions</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="dataOverlayMode">none</option>
<option name="count">20</option>
<drilldown>
<set token="actions">$row.Actions$</set>
</drilldown>
<fields>["Label","URL","Purposes"]</fields>
</table>
</panel>
</row>
<row>
<panel id="header_red">
<title>My formated content</title>
<html>
<body>$actions$</body>
</html>
</panel>
</row>
</form> Result : Do that and that and click on <a href=""link1"" target=""_blank"">link1</a> 😫
... View more
- Tags:
- html
Labels
- Labels:
-
drilldown
-
panel
-
simple XML
02-19-2021
01:20 AM
Hello, any answer for this question. In search mode, like others people say : you can search <your_search> field=*_* In like command, underscore (like percent) is a wildcard (percent is ".*" and underscore is "."). You have to use match with real regex. Exemple : <your_search> | where match(field,".*_.*")
... View more
01-04-2019
01:07 AM
I downvoted this post because alert_action.conf is a conf for all alerts (not just for one alert). in addition, the file is in root access on a unix server and in an enterprise solution, we can not modify it.
... View more
11-20-2018
03:32 AM
2 Karma
Hello,
After testing your solution I want to give more information :
bginQuery | bin _time span=$your_span$ | stats count as nb by field1, field2, ... fieldn, _time | search fieldx=yourValue | TIMECHART span=$your_span$ sum(nb) BY fieldy
For the last timechart you need sum the result and not just count
... View more
10-24-2018
08:14 AM
Thanks to @maciep and @renjith.nair
I didn't know the foreach command.
|makeresults | eval Application="App1" | eval TX_P1=1 | eval TX_P2=10 | eval TX_P3=100 | eval TX_P4=1000
| eval Source="ref" | append [|makeresults | eval Application="App2" | eval TX_P1=2 | eval TX_P2=20
| eval TX_P3=200| eval TX_P4=2000| eval Source="ref"] | appendpipe [| eval Source="inc" | eval TX_P1=TX_P1-1
| eval TX_P2=TX_P2-5| eval TX_P3=TX_P3-50| eval TX_P4=TX_P4-500] | sort Application
| streamstats current=f window=1 last(TX_P1) as PREV_P1,last(TX_P2) as PREV_P2,last(TX_P3) as PREV_P3,last(TX_P4) as PREV_P4
| where Source="inc"
| foreach TX_* [eval new_<<MATCHSTR>>=<<FIELD>>."/".PREV_<<MATCHSTR>>." (".(100-(100*(<<FIELD>>/PREV_<<MATCHSTR>>)))."%)"]
| foreach new_* [eval TX_<<MATCHSTR>>=<<FIELD>>]
| fields - PREV_*, new_*, Source, _time
Regards,
... View more
10-24-2018
01:58 AM
No, just columns without "|" I don't find how to make an array in this tools
... View more
10-19-2018
08:03 AM
Please look at this example :
|makeresults | eval Application="App1" | eval TX_P1=1 | eval TX_P2=10 | eval TX_P3=100 | eval TX_P4=1000 | eval Source="ref" | append [|makeresults | eval Application="App2" | eval TX_P1=2 | eval TX_P2=20 | eval TX_P3=200| eval TX_P4=2000| eval Source="ref"] | appendpipe [| eval Source="inc" | eval TX_P1=TX_P1-1 | eval TX_P2=TX_P2-5| eval TX_P3=TX_P3-50| eval TX_P4=TX_P4-500] | sort Application
Results :
I would like to add some pipes to change the result like this:
|Application|TX_P1 |TX_P2 |TX_P3 |TX_P4 |
| App1 |0/1(100%)|5/10(50%) |50/100(50%) |500/1000(50%) |
| App2 |1/2(50%) |15/20(25%)|150/200(25%)|1500/2000(25%)|
... View more
10-16-2018
09:54 AM
Hello,
I have a fieldset input checkbox type with many value for token (mvfield).
I would like to link with another dashboard with same checkbox.
First value $myCheckBox$ is string like this : "(field=val1 OR field=val2...)"
The second value of $form.myCheckBox$ is mvfield like this : "val1,val2..."
I tried in many different ways
<drilldown target="_blank">
<eval token="myCheckBox_link_token">mvjoin($form.myCheckBox$, "&form.myCheckBox=")</eval>
<set token="path" prefix="otherDashboard?form.myCheckBox=">$myCheckBox_link_token$</set>
<link>
<![CDATA[$path$]]>
</link>
</drilldown>
=> secureHTTP://mySplunk:port/fr-FR/app/MyApp/otherDashboard %3F form.myCheckBox %3D val1 %26 form.myCheckBox %3D val2
other test :
<drilldown target="_blank">
<eval token="myCheckBox_link_token">mvjoin($form.myCheckBox$, "&form.myCheckBox=")</eval>
<link>
<![CDATA[
otherDashboard?form.myCheckBox=$myCheckBox_link_token$&form.time_tok.earliest=$time_tok.earliest$&form.time_tok.latest=$time_tok.latest$
]]>
</link>
</drilldown>
=>secureHTTP://mySplunk:port/fr-FR/app/MyApp/otherDashboard?form.myCheckBox=val1 %26 form.myCheckBox *%3D * val2&form.time_tok.earliest=-15m&form.time_tok.latest=now
Exemple ok:
<drilldown target="_blank">
<link>
<![CDATA[otherDashboard?form.myCheckBox=val1&form.time_tok.earliest=$time_tok.earliest$&form.time_tok.latest=$time_tok.latest$]]>
</link>
</drilldown>
If I have a token with "&" or "=", can not link with another dashboard, it is automatically replaced by the values "% 26" or "% 3D".
... View more
- Tags:
- splunk-enterprise
10-04-2017
08:39 AM
1 Karma
Finally, I use split(field, ",") command in query.
... View more
10-04-2017
08:23 AM
My field contain " A,B,C,D "
and I want
A
B
C
D
... View more
10-04-2017
08:22 AM
I was afraid of this answer. In reality, I have in query replace(field, ",", "<BR/>") but like you say, can actually lead to HTML injection vulnerability.
I search again other possibility
... View more
09-29-2017
07:52 AM
Hello,
Like previous post I would like interpret code in html.
Just a little change : html in token.
<dashboard>
<label>TEST</label>
<row>
<panel>
<table>
<search>
<query>index=* |stats count by sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<finalized >
<condition match=" 'job.resultCount' != 0">
<set token="tok_wimg">Number of results : <BR/>$result.sourcetype$</set>
</condition>
<condition>
<set token="tok_wimg">No result found</set>
</condition>
</finalized >
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel>
<html>
<h1>$tok_wimg$</h1>
</html>
</panel>
</row>
</dashboard>
How can I see in html
Number of results :
2
... View more
- Tags:
- splunk-enterprise
09-29-2017
05:02 AM
1 Karma
I use input text field with depends on unexisting variable.
<input type="text" token="myToken" depends="$hiddenToken$">
<default>my variable</default>
</input>
$myToken$ is default value, and you don't see it with "depends".
... View more
09-14-2017
03:08 AM
1 Karma
I must remove rangeColors and rangeValues for the good result.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-31-2022
12:32 PM
|
Karma from
Karma given to
