Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About thomasroulet
thomasroulet
Path Finder
Member since:
04-09-2019
09-01-2021
Community Statistics
| Posts | 30 |
| Solutions | 6 |
| Karma Given | 10 |
| Karma Received | 16 |
| Member Since | 04-09-2019 |
Activity Feed
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 09-01-2021 02:21 AM
- Got Karma for Re: How to pass input variable to dbxquery. 09-16-2020 07:52 AM
- Karma Splunk is generating filenames that exceed 255 characters for rayskycubed. 06-05-2020 12:50 AM
- Karma Re: CSRF problem with a reverse proxy for plaxosi. 06-05-2020 12:50 AM
- Karma Re: Splunk cloud bump for jeffland. 06-05-2020 12:50 AM
- Karma Re: Splunk 8.0 upgrade has no web server running for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: field value is being extracted as fieldname in regex. 06-05-2020 12:50 AM
- Got Karma for Re: DB Connect 3.1.4 - Unable to write records - Error in handling indexed fields. 06-05-2020 12:50 AM
- Got Karma for Re: DB Connect 3.1.4 - Unable to write records - Error in handling indexed fields. 06-05-2020 12:50 AM
- Got Karma for Re: DB Connect 3.1.4 - Unable to write records - Error in handling indexed fields. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: Using javascript (Modal) for pop-up in dashboard. 06-05-2020 12:50 AM
- Got Karma for Re: Multivalue input choice box length css. 06-05-2020 12:50 AM
- Got Karma for Re: Issue with database table name with spaces in map dbxquery search. 06-05-2020 12:50 AM
- Karma Re: About rotate settings of internal log(splunkd etc...) for yutaka1005. 06-05-2020 12:49 AM
- Karma Re: tstats timechart for DEAD_BEEF. 06-05-2020 12:49 AM
- Got Karma for Re: unable_to_write_batch in db connect add-on. 06-05-2020 12:49 AM
Topics I've Started
05-13-2020
09:33 AM
i tried to uninstall, reinstall app
i tried to change the builde version
any other ideas ?
Thanks
Regards
... View more
05-13-2020
07:56 AM
With Private App Installation, continue button not working in other languages than en-GB or en-US for installation, update, delete.
fails with fr-FR and de_DE successful with en-GB and en-US
Regards
... View more
09-17-2019
01:40 AM
i think the css below is part of the problem, especially the margin-left.
Is the margin-left really necessary?
#comments .number_display_viz-wrap_main {
display:center;
background: url("/static/app/splunk_app/boxComments_1.png");
background-repeat: no-repeat;
margin-top:35px;
margin-left:21%;
}
you could try with this :
#comments .number_display_viz-wrap_main {
background-position:center 0px;
background: url("/static/app/splunk_app/boxComments_1.png");
background-repeat: no-repeat;
margin-top:35px;
}
... View more
09-17-2019
01:12 AM
with which browser do you get this result? and which version?
... View more
09-16-2019
07:35 AM
Hello,
a little bit ugly but it could work :
`your_SPL`
| map search="|makeresults 1 | map search=$search$"
your savedsearch has to have 2 arguments :
earliest
latest
==> example: index=_* earliest=$earliest$ latest=$latest$
... View more
09-16-2019
01:45 AM
Hello,
could you try the code below ? i change some css.
<panel id="panel1">
<viz id="comments" type="number_display_viz.number_display_viz">
<search>
<done>
<condition>
<set token="boxcomment">$result.count$</set>
</condition>
</done>
<query>index=_* | stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="height">206</option>
<option name="number_display_viz.number_display_viz.bordercolor">#FFFFFF</option>
<option name="number_display_viz.number_display_viz.bordersize">2</option>
<option name="number_display_viz.number_display_viz.colorprimary">#000000</option>
<option name="number_display_viz.number_display_viz.colorprimarymode">auto</option>
<option name="number_display_viz.number_display_viz.colorsecondary">#000000</option>
<option name="number_display_viz.number_display_viz.colorsecondarymode">darker1</option>
<option name="number_display_viz.number_display_viz.max">100</option>
<option name="number_display_viz.number_display_viz.min">0</option>
<option name="number_display_viz.number_display_viz.nodatacolor">#0178c7</option>
<option name="number_display_viz.number_display_viz.padding">10</option>
<option name="number_display_viz.number_display_viz.pulserate">4</option>
<option name="number_display_viz.number_display_viz.shadowcolor">#F2F4F5</option>
<option name="number_display_viz.number_display_viz.shapebordercolor">#FFFFFF</option>
<option name="number_display_viz.number_display_viz.shapebordercolormode">static</option>
<option name="number_display_viz.number_display_viz.shapebordersize">1</option>
<option name="number_display_viz.number_display_viz.shapedropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.shapeshadow">yes</option>
<option name="number_display_viz.number_display_viz.shapetexture">solid</option>
<option name="number_display_viz.number_display_viz.sparkHeight">30</option>
<option name="number_display_viz.number_display_viz.sparkWidth">90</option>
<option name="number_display_viz.number_display_viz.sparkalign">5</option>
<option name="number_display_viz.number_display_viz.sparkalignv">70</option>
<option name="number_display_viz.number_display_viz.sparkcolorfill">#009DD9</option>
<option name="number_display_viz.number_display_viz.sparkcolorline">#0178c7</option>
<option name="number_display_viz.number_display_viz.sparkcolormodefill">auto</option>
<option name="number_display_viz.number_display_viz.sparkcolormodeline">auto</option>
<option name="number_display_viz.number_display_viz.sparkmin">0</option>
<option name="number_display_viz.number_display_viz.sparknulls">gaps</option>
<option name="number_display_viz.number_display_viz.sparkorder">bg</option>
<option name="number_display_viz.number_display_viz.sparkstyle">area</option>
<option name="number_display_viz.number_display_viz.spinnerspeedmax">20</option>
<option name="number_display_viz.number_display_viz.spinnerspeedmin">1</option>
<option name="number_display_viz.number_display_viz.style">nil</option>
<option name="number_display_viz.number_display_viz.subtitlealign">center</option>
<option name="number_display_viz.number_display_viz.subtitlealignv">80</option>
<option name="number_display_viz.number_display_viz.subtitlecolor">#919191</option>
<option name="number_display_viz.number_display_viz.subtitlecolormode">static</option>
<option name="number_display_viz.number_display_viz.subtitledrop">no</option>
<option name="number_display_viz.number_display_viz.subtitledropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.subtitlefont">number_display_viz-font4</option>
<option name="number_display_viz.number_display_viz.subtitlesize">30</option>
<option name="number_display_viz.number_display_viz.subtitletext">10 points per day</option>
<option name="number_display_viz.number_display_viz.textalign">center</option>
<option name="number_display_viz.number_display_viz.textalignv">9</option>
<option name="number_display_viz.number_display_viz.textcolor">#000000</option>
<option name="number_display_viz.number_display_viz.textdrop">yes</option>
<option name="number_display_viz.number_display_viz.textdropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.textduration">300</option>
<option name="number_display_viz.number_display_viz.textfont">number_display_viz-font1</option>
<option name="number_display_viz.number_display_viz.textmode">static</option>
<option name="number_display_viz.number_display_viz.textprecision">1</option>
<option name="number_display_viz.number_display_viz.textsize">100</option>
<option name="number_display_viz.number_display_viz.textunitposition">after</option>
<option name="number_display_viz.number_display_viz.textunitsize">30</option>
<option name="number_display_viz.number_display_viz.thickness">50</option>
<option name="number_display_viz.number_display_viz.thresholdcol1">#ebb839</option>
<option name="number_display_viz.number_display_viz.thresholdcol2">#d16f18</option>
<option name="number_display_viz.number_display_viz.thresholdcol3">#b22b32</option>
<option name="number_display_viz.number_display_viz.thresholdcol4">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdcol5">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdcol6">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdsize">20</option>
<option name="number_display_viz.number_display_viz.thresholdval2">70</option>
<option name="number_display_viz.number_display_viz.thresholdval3">90</option>
<option name="number_display_viz.number_display_viz.titlealign">center</option>
<option name="number_display_viz.number_display_viz.titlealignv">70</option>
<option name="number_display_viz.number_display_viz.titlecolor">#2c2d65</option>
<option name="number_display_viz.number_display_viz.titlecolormode">static</option>
<option name="number_display_viz.number_display_viz.titledrop">yes</option>
<option name="number_display_viz.number_display_viz.titledropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.titlesize">30</option>
<option name="number_display_viz.number_display_viz.titletext">Box Comments</option>
<option name="refresh.display">none</option>
</viz>
</panel>
<panel>
<html>
<style>
#comments .number_display_viz-wrap_main {
display:center;
background: url("/static/app/splunk_app/boxComments_1.png");
background-repeat: no-repeat;
margin-top:35px;
margin-left:21%;
}
#comments .number_display_viz-wrap_main:hover:after{
display:block;
background-color: #333;
border-radius: 3px;
font-size: 11px;
color: #eee;
z-index: 3;
padding:5px;
margin-right:5px;
animation: moveup 0.3s linear;
}
#comments .number_display_viz-wrap_item:nth-child(1) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 1";
}
#comments .number_display_viz-wrap_item:nth-child(2) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 2";
}
#comments .number_display_viz-wrap_item:nth-child(3) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 3";
}
#comments .number_display_viz-wrap_item:nth-child(4) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 4";
}
@keyframes moveup {
0% {
//for rotating effect rotate is set 25deg at beggining
transform: translateY(10px) rotate(25deg);
opacity: 0;
}
100% {
transform: translateY(0) rotate(0deg);
opacity: 1;
}
}
</style>
</html>
</panel>
... View more
09-05-2019
06:01 AM
@michaelrosello
did you solve your problem of extraction.
Did the answers help ? if this is the case, don't forget to accept an answer and vote.
... View more
09-05-2019
04:58 AM
glad to have helped.
Don't forget to vote the answer. I updated it
... View more
09-04-2019
11:59 PM
1 Karma
Ok, escape the backslashes in the query
| fields EMPID
| map search="| dbxquery query=\"select \\\"Employer Name\\\" PR, \\\"Employee Number\\\" EMPID FROM BIA_BA_EUL.\\\"View Employee Helpdesk\\\" WHERE \\\"Employee Number\\\" in ($EMPID$)\" connection=\"EMP-PR\""
... View more
09-04-2019
11:39 PM
OK one more try escape the backslashes in the query :
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select \\\"Employer Name\\\" PR, \\\"Employee Number\\\" EMPID FROM BIA_BA_EUL.\\\"View Employee Helpdesk\\\" WHERE \\\"Employee Number\\\" in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
09-04-2019
07:40 AM
Do not surround the field name or table name with double quotes but with backticks
| fields EMPID
| map search="| dbxquery query=\"select `Employer Name` PR, `Employee Number` EMPID FROM BIA_BA_EUL.`View Employee Helpdesk` WHERE `Employee Number` in ($EMPID$)\" connection=\"EMP-PR\""
... View more
09-03-2019
11:43 PM
Ok it is not a good idea to use blanks in a table name or a field...
I updated my first answer with a response to this issue.
You will not surround the field name or table name with double quotes but with backticks
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select `Employer Name` PR, `Employee Number` EMPID FROM BIA_BA_EUL.`View Employee Helpdesk` WHERE `Employee Number` in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
09-03-2019
02:55 AM
you can use Search macros.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Usesearchmacros
... View more
09-02-2019
04:58 AM
I have nothing better to offer than the first answer I made :
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select \"Employer Name\" PR, \"Employee Number\" EMPID FROM BIA_BA_EUL.\"View Employee Helpdesk\" WHERE \"Employee Number\" in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
09-02-2019
01:44 AM
The "append" command will not replace $EMPID$ with the values of $EMPID$
With the "append" command, "...".EMPID."..." will replace EMPID with the values but will be interpreted by one value in a string : "EMPID1, EMPID2, EMPID3" and not 3 values.
The map command will do this replacement and will be interpreted as 3 values.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-01-2021
06:36 AM
|
