Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mclane1
mclane1
Path Finder
Member since:
04-20-2016
05-31-2022
Community Statistics
| Posts | 34 |
| Solutions | 4 |
| Karma Given | 37 |
| Karma Received | 7 |
| Member Since | 04-20-2016 |
Activity Feed
- Karma Re: Removing null columns from a table for jadomaai. 05-31-2022 06:52 AM
- Posted Re: How to delete duplicate logs? on Splunk Search. 05-12-2022 07:22 AM
- Karma Re: Is it possible to use fillnull for fieldnames with a specific pattern? for somesoni2. 03-22-2022 01:23 AM
- Karma Re: How can I show results from Other? for christopherutz. 02-17-2022 01:44 AM
- Karma Re: How to export to csv the search results which used base search? for sudosplunk. 01-05-2022 01:29 AM
- Karma How to export to csv the search results which used base search? for pinksqtuason. 01-05-2022 01:29 AM
- Karma Re: How to export to csv the search results which used base search? for fsolercasanova. 01-05-2022 01:28 AM
- Karma Re: Can i assign a color to a string in a field if it is present in the field ? for varun99. 01-04-2022 09:46 AM
- Posted Re: How can I set a dynamic default value in a dropdown (Simple XML) on Dashboards & Visualizations. 01-04-2022 07:55 AM
- Karma Re: Change the message of "mouse over field" for niketn. 11-24-2021 07:57 AM
- Karma Re: How to change default color charts for adonio. 11-24-2021 07:08 AM
- Karma Re: How to make my computer trust splunkd's own self-signed certificate? for helderman. 10-19-2021 01:52 AM
- Karma How to make my computer trust splunkd's own self-signed certificate? for helderman. 10-19-2021 01:52 AM
- Posted Re: Use Trellis with many values by graph. on Splunk Search. 10-06-2021 02:43 AM
- Posted Use Trellis with many values by graph. on Splunk Search. 10-06-2021 02:07 AM
- Tagged Use Trellis with many values by graph. on Splunk Search. 10-06-2021 02:07 AM
- Posted Re: Hide HTML with simple checkbox on Dashboards & Visualizations. 10-05-2021 01:32 AM
- Karma Re: Timechart count by ip by fw_name over time with trellis for niketn. 10-05-2021 01:31 AM
- Got Karma for Re: Hide HTML with simple checkbox. 10-04-2021 08:08 AM
- Posted Re: Hide HTML with simple checkbox on Dashboards & Visualizations. 10-04-2021 07:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-26-2022
04:46 PM
fieldColors gets confused by the ":" in your field names. You need to escape the ":" in your field names in the fieldColors using a "\", like this: <option name="charting.fieldColors">{"TPS_MAX\: PREVIEW":0x990000, "TPS_MAX\: COMMIT":0x999900, "TPS_MAX\: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX\: CHECK":0x9900FF, "TPS_MAX\: RESERVE":0x006600, "ParNew\: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC\: MLC_GC":0xff0000 }</option>
... View more
05-12-2022
07:22 AM
I use something like this : <your search>
| streamstats count by _raw
| where count>1
| eval eid=_cd
| table eid
| streamstats count
| outputlookup delete_dupplicate_byeid.csv.gz You select and number your wanted selection. After you can delete step by step : <your search>
| eval eid=_cd
| search [| inputlookup delete_dupplicate_byeid.csv.gz
| eval tmp=0 | where count>=tmp*10000 AND count<=tmp*10000+9999
| fields eid | format]
| delete
... View more
01-04-2022
07:55 AM
Thank you very much for this tip. It doesn't work for me on 8.2.0 in type="multiselect" 😭
... View more
10-06-2021
02:43 AM
Use trellis in a chart (form or dashboard): <row>
<panel>
<chart>
<search>
<query>index="_internal"
| bin _time
| stats count by _time, sourcetype, status
| eval {status}=count
| fields - status, count
| fillnull value=0
| stats sum(*) as * by _time, sourcetype</query>
<earliest>-15m@m</earliest>
<latest>now</latest>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">area</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">top</option>
<option name="refresh.display">preview</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">0</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">sourcetype</option>
<option name="height">1600</option>
</chart>
</panel>
</row>
... View more
05-19-2021
07:52 AM
Hello, Sorry, I'm using splunk 6.4.2 I find this command : index=_internal "INFO StreamedSearch - Streamed search connection terminated" savedsearch_name="My_Alert" | table _time, search_id, server, active_searches, elapsedTime, search, savedsearch_name And the frequency is the same. I schedule a mail for each alert, and it's the same in my outlook than on splunk.
... View more
03-25-2021
04:05 AM
After some research we can add js by splunk. It works, thank you. <form script="convert_html_token1_to_divId_html_panel_with_token1.js">
<label>TEST_HTML</label>
<row>
<panel>
<table>
<title>Select one line</title>
<search>
<query>|inputlookup muLookup | table Label, URL, Purposes, Actions</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="dataOverlayMode">none</option>
<option name="count">20</option>
<drilldown>
<set token="actions">$row.Actions$</set>
<set token="html_token1">$row.Actions$</set>
</drilldown>
<fields>["Label","URL","Purposes"]</fields>
</table>
</panel>
</row>
<row>
<panel>
<title>My formated content</title>
<html>
<body>$actions$
<br/>to<br/>
<div id="html_panel_with_token1"></div>
</body>
</html>
</panel>
<panel>
<title>Javascript</title>
<html>
<iframe src="https://mySplunk/en-US/static/app/myApp/convert_html_token1_to_divId_html_panel_with_token1.js" height="200" width="1000" style="border:none;"></iframe>
</html>
</panel>
</row>
</form> Add file JS in : App->manage app->Find you App and "Edit Properties"->Upload asset convert_html_token1_to_divId_html_panel_with_token1.js require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function($, mvc,) {
var submittedTokens = mvc.Components.get('submitted');
// Listen for a change to the token html_token1 value
submittedTokens.on("change:html_token1", function(model, html_token1, options) {
var tokHTMLJS=submittedTokens.get("html_token1");
if (tokHTMLJS!==undefined)
{
$("#html_panel_with_token1").html(tokHTMLJS);
}
});
}); You can see result in https://mySplunk/en-US/static/app/myApp/convert_html_token1_to_divId_html_panel_with_token1.js
... View more
02-19-2021
01:20 AM
Hello, any answer for this question. In search mode, like others people say : you can search <your_search> field=*_* In like command, underscore (like percent) is a wildcard (percent is ".*" and underscore is "."). You have to use match with real regex. Exemple : <your_search> | where match(field,".*_.*")
... View more
10-24-2018
06:43 PM
@mclane1, glad it worked. If any of the answers or comments helped you, feel free to vote
... View more
10-16-2018
09:54 AM
Hello,
I have a fieldset input checkbox type with many value for token (mvfield).
I would like to link with another dashboard with same checkbox.
First value $myCheckBox$ is string like this : "(field=val1 OR field=val2...)"
The second value of $form.myCheckBox$ is mvfield like this : "val1,val2..."
I tried in many different ways
<drilldown target="_blank">
<eval token="myCheckBox_link_token">mvjoin($form.myCheckBox$, "&form.myCheckBox=")</eval>
<set token="path" prefix="otherDashboard?form.myCheckBox=">$myCheckBox_link_token$</set>
<link>
<![CDATA[$path$]]>
</link>
</drilldown>
=> secureHTTP://mySplunk:port/fr-FR/app/MyApp/otherDashboard %3F form.myCheckBox %3D val1 %26 form.myCheckBox %3D val2
other test :
<drilldown target="_blank">
<eval token="myCheckBox_link_token">mvjoin($form.myCheckBox$, "&form.myCheckBox=")</eval>
<link>
<![CDATA[
otherDashboard?form.myCheckBox=$myCheckBox_link_token$&form.time_tok.earliest=$time_tok.earliest$&form.time_tok.latest=$time_tok.latest$
]]>
</link>
</drilldown>
=>secureHTTP://mySplunk:port/fr-FR/app/MyApp/otherDashboard?form.myCheckBox=val1 %26 form.myCheckBox *%3D * val2&form.time_tok.earliest=-15m&form.time_tok.latest=now
Exemple ok:
<drilldown target="_blank">
<link>
<![CDATA[otherDashboard?form.myCheckBox=val1&form.time_tok.earliest=$time_tok.earliest$&form.time_tok.latest=$time_tok.latest$]]>
</link>
</drilldown>
If I have a token with "&" or "=", can not link with another dashboard, it is automatically replaced by the values "% 26" or "% 3D".
... View more
- Tags:
- splunk-enterprise
11-27-2018
06:02 AM
wow really helpful query
... View more
10-04-2017
09:15 AM
Yes split() function or makemv command will also do. Following is run anywhere search:
| makeresults
| eval field="A,B,C,D"
| makemv field delim=","
... View more
09-14-2017
03:16 AM
@mclane1, sorry I might have missed from my example! Thanks for correction!
... View more
12-31-2016
01:45 PM
Did you take a look at http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches? It looks like you could use a base search (or maybe 3 base searches, one per combination of criteria 1 with criteriaA/B/C) and build the panels with post processing searches. That will speed up your dashboard since the raw data will only need to be loaded to execute the base search. It looked like you found something similar, but I'm not sure why you think it won't make your dashboard faster if you adapt it for your needs.
... View more
10-03-2016
11:35 PM
Hello;
I understand idea.
I have table like this :
||code||ident||otherIdent||executionTime||
|1|i1|oi1|t1|
|2|X|i1|t2|
and I can transform this table like this (with eval)
||code||ident||otherIdent||executionTime||id||executionTime1||executionTime2||...||
|1|i1|oi1|t1|i1|t1|null|...|
|2|X|i1|t2|i1|null|t2|...|
with stats values do only one line.
Very good idea.
Thank you.
... View more
05-12-2016
02:32 AM
Hello,
Thanks for this post. I have seen this solution (my post) but not user friendly.
I don't want other checkbox, just all checkbox unknown checked.
Thanks
Not possible ? End user just would like to unckeck box.
... View more
04-01-2019
02:31 AM
Action "Send email" does not allow to use your own HTML in the message. If this action's options are too limiting, you need to go for Custom alert actions, see https://docs.splunk.com/Documentation/Splunk/7.2.1/AdvancedDev/ModAlertsIntro .
For sake of completeness, "Run script" action could also help (ie. you could copy default sendmail.py and alter it to your needs, or write your own script from scratch), however this method has been deprecated in favor of Custom alert actions.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-31-2022
12:32 PM
|
Karma from
Karma given to
