Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mgarciar
mgarciar
Path Finder
Member since:
04-26-2016
12-02-2022
Community Statistics
| Posts | 26 |
| Solutions | 3 |
| Karma Given | 20 |
| Karma Received | 6 |
| Member Since | 04-26-2016 |
Activity Feed
- Posted Re: Html dashboards deprecation: still get warning after using SPA - template solution on Dashboards & Visualizations. 12-02-2022 01:05 PM
- Karma Splunk web stuck at Loading page.. for att35. 06-05-2020 12:50 AM
- Karma Re: Splunk install on MacOS is not working for garrettdavidson. 06-05-2020 12:49 AM
- Karma Re: Why are Javascript files not loading after update to Splunk 6.5.0? for rjthibod. 06-05-2020 12:48 AM
- Karma Re: Chart increment problem (decimal not integer) for niketn. 06-05-2020 12:48 AM
- Karma Re: Splunk 6.5 has deprecated the refresh interval option. What is the new alternative? for gokadroid. 06-05-2020 12:48 AM
- Karma Re: How to hide a textbox input in a dashboard? for jeffland. 06-05-2020 12:48 AM
- Karma Re: How to drill down from a Splunk dashboard to an external URL? for wschulze. 06-05-2020 12:48 AM
- Karma Re: Why are Javascript files not loading after update to Splunk 6.5.0? for ehudb. 06-05-2020 12:48 AM
- Karma Re: What does datamodel do? for Jeremiah. 06-05-2020 12:48 AM
- Karma Re: Issue with Python modules when attempting to execute app script. "ImportError: No module named searchcommands" for adambloom. 06-05-2020 12:48 AM
- Got Karma for Re: Is there an easy way to implement a dynamic navigation menu for an application based on permissions?. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Search does not return all event data on a field. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Search does not return all event data on a field. 06-05-2020 12:48 AM
- Got Karma for Splunk 6.5 has deprecated the refresh interval option. What is the new alternative?. 06-05-2020 12:48 AM
- Got Karma for Splunk 6.5 has deprecated the refresh interval option. What is the new alternative?. 06-05-2020 12:48 AM
- Got Karma for Splunk 6.5 has deprecated the refresh interval option. What is the new alternative?. 06-05-2020 12:48 AM
- Karma Re: Reliable way to specify span to bucket numeric values for martin_mueller. 06-05-2020 12:47 AM
- Karma What are my options to export large amounts of Splunk data from UI, CLI or using REST? for sat94541. 06-05-2020 12:47 AM
- Karma Re: Where should I run my report that populates a summary index? for Jeremiah. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 |
12-02-2022
01:05 PM
Same problem here ! ... anybody has an update on this please ?
... View more
11-12-2019
10:39 AM
This is the answer
... View more
04-20-2019
09:37 AM
Hi experts,
I have an alert that triggers a custom script (python), this script executes several validations on the data and creates a service using the passed session key to execute other 2 SPLs.
At some point the session key is expiring and script fails to execute SPLs.
I’m using the deprecated functionality for custom alerts.
Is there any way to increase the lifetime of the session key ?
Do I need to move to the new custom alert framework to avoid this issue?
I know I can move my code to a separate script that runs in a cron job outside splunk but then it’s more services to maintain plus having to use a username/password to create a splunk service.
The actual process is very convenient in that sense.
Thanks !
... View more
09-18-2017
07:14 AM
There is not field extraction at all. The value is "as is". That's the value coming from the Api (with the exception of the none). The _time field is just set to be the system date/time (for now).
There is not field extraction, props, transform, anything related with the "timestamp" field.
... View more
09-18-2017
07:03 AM
Hi Giuseppe,
Thank you for your suggestions. That will probably allow me to extract the correct value at search time.
But the problem persists right?, the question is more: why I'm getting that none value inserted on the field? Is it that timestamp is a reserved field maybe?
... View more
09-18-2017
06:48 AM
Hi,
I'm ingesting events from a Python script that is calling an API. This script writes to splunk the events as shown on my original post. When I do a search, like this:
index=main source=mysource | head 1
I can see Splunk returns a single event, everything looking good. But when add:
| table timestamp
where timestamp is a field from the json formatted event it returns two values, none and the actual date time value (as shown on the original picture). The none is not visible anywhere.
... View more
09-16-2017
05:50 AM
Splunk is using the current time to set the _time field value and not timestamp.
... View more
09-15-2017
02:14 PM
Sorry actually shows both values: none and the actual field value
... View more
09-15-2017
02:11 PM
props.conf
[mysourcetype]
DATETIME_CONFIG = CURRENT
MAX_EVENTS = 1000
TRUNCATE = 100000
But I did find something interesting ... I did a export raw events and this is what I got:
_raw field contains the event as in the original message
_time fields shows fine
timestamp field shows none
... View more
09-15-2017
01:18 PM
Hi all,
I have a problem with a field call "timestamp".
I have created a custom python script and added as "Data input". The script is executed every 5 minutes and makes an API call, parse the json response and send it to the indexer.
This is a sample raw event:
{"rev_pingdeath_count": 0, "fwd_tiny_count": 0, "dst_address": "X.X.X.X", "timestamp": "2017-09-15T16:05:00.000Z", "start_timestamp": "1505491512000000", "fwd_cwr_count": 0, "user_src_location": null, "rev_synrst_count": 0, "fwd_xmas_count": 0, "server_app_latency_usec": 0, "rev_rst_count": 0, "dst_is_internal": "true", "user_dst_businessUnit": null, "fwd_bytes": 1022, "fwd_synfin_count": 0, "rev_ack_count": 8, "user_dst_pod": null, "total_perceived_latency_usec": 0, "bandwidth_bytes_per_second": "0", "user_src_department": null, "user_src_businessUnit": null, "rev_psh_count": 4, "dst_hostname": "appServerXXXX", "user_src_lifecycle": null, "rev_pkts": 8, "fwd_nc_count": 0, "src_address": "Y.Y.Y.Y", "rev_finnoack_count": 0, "user_src_pod": null, "dst_enforcement_epg_name": [], "rev_nc_count": 0, "rev_cwr_count": 0, "user_src_datacenter": null, "fwd_synrst_count": 0, "fwd_ack_count": 7, "srtt_available": "SRTT_NONE", "rev_allzero_count": 0}
There is only one timestamp field on each event, as far I have been able to see, but when I do a ** index=main source=mysource | head 1 | table timestamp** I get the following data:
Where is the none value coming from ??. This none is present in every single event.
Splunk version 6.5.2, single instance.
Thanks and regards,
... View more
01-29-2017
09:20 PM
There is a html tag available on the XML dashboards.
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#html
You should be able to add a static image with the tag.
... View more
01-11-2017
06:48 AM
I had a similar issue and solved by replacing:
var http = new splunkjs.JQueryHttp();
with
var http = new splunkjs.SplunkWebHttp();
Of course is not documented anywhere as far as I can tell.
... View more
01-11-2017
06:46 AM
Looking at the splunkjs code I found the "SplunkWebHttp" which seems to be using the standard " /splunkd/__raw" path.
Replacing the line:
var http = new splunkjs.JQueryHttp();
with
var http = new splunkjs.SplunkWebHttp();
Solved the issue.
I couldn't find any documentation about this. Seems all samples assume you want to use a proxy server.
... View more
01-09-2017
08:29 PM
Hi all,
I have a custom web page calling Splunk services using SplunkJS SDK. After migrating to 6.5, the page started failing with this message:
XMLHttpRequest cannot load https://(hostname):(port)/services/auth/login?output_mode=json. Request header field X-Splunk-Form-Key is not allowed by Access-Control-Allow-Headers.
The code is the following:
function getJSONConnectionParams(username,password,hostname){
return JSON.parse('{"username":"'+username+'","password":"'+password+'","scheme":"https","host":"'+hostname+'","port":8089}');
}
var http = new splunkjs.JQueryHttp();
var service = new splunkjs.Service(http,getJSONConnectionParams(splunkCurrentUser,currentPassword,getHostName()));
service.login(function(err) { ... }
The error shows up when the login function is called.
Splunk Web UI and Management port are using HTTPS, both certificates are the same. Also the crossOriginReference is enabled on the server.conf file.
Any help will be appreciated.
Thanks and regards,
... View more
12-14-2016
08:36 AM
3 Karma
Splunk 6.5.0 says refresh interval (refresh.auto.interval) option has been deprecated and I cannot find what's the new alternative for this.
I need a table to refresh itself every X seconds but not the whole dashboard.
What's the new way to accomplish this?
Thanks,
... View more
In your case is better to use the "view" tag. Only thing is if your views belong to a diff app you will need to make them global (shared so the other apps can see it) and also make sure the names are different, that way when you are referencing a specific view by name there is only one possible match.
I would use the "a href" tag to reference external website or when the dashboards have same names so I need to specify the app names. The problem is the "permissions" do not work properly.
... View more
09-26-2016
06:13 PM
Ok. If you use the
a href
tag the default permission won't work. All what I said works for if you usie the tag
view
... View more
09-26-2016
08:08 AM
Yes and if all subitems from a Menu Item are not visible, the Menu Item (Collection tag) won't be visible at all.
... View more
09-22-2016
06:31 AM
If your properly create roles and assign access permissions to the dashboards (or apps if each option is part of a separate app) based on the roles the navigation menu will automatically remove the items the user does not have access.
One limitation (as far as I know), your menu need to reference the views using the tags and not the tag.
... View more
09-22-2016
06:31 AM
If all the subitems are not accessible by the user, the whole collection will be hidden.
Would that work ?
... View more
04-28-2016
06:38 AM
2 Karma
I think I understand the problem now. So the event is a big json and Splunk is not properly parsing all fields on the big json.
We need to tell splunk to parse the specific field we need with spath and specifying the field:
yoursearch | spath output=myIpAddress path=queryResponse.entity{}.accessPointDetailsDTO.ipAddress | table myIpAddress
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Spath
But I think also is important to analyze if maybe the data input needs to be divided in multiple events rather than a single huge event.
... View more
04-28-2016
06:30 AM
I think so ... check my answer
... View more
04-27-2016
08:03 AM
I'm using the REST API app (https://splunkbase.splunk.com/app/1546/)
The event is showing all the data in splunk. Actually, if I do a search like this:
source="rest://PRIME_AccessPointDetailsAPI" | search "11.111.122.33"
Splunk will find that data, but if I do this
source="rest://PRIME_AccessPointDetailsAPI" | search queryResponse.entity{}.accessPointDetailsDTO.ipAddress="11.111.122.33"
I won't get any data back, unless the ipAddress value I use is on the list Splunk gives me on the field (second image)
... View more
