About pgoldweic

pgoldweic

Thanks again for your response @yuanliu . This certainly clarifies why the OR would not work for me (these datasets are really timeless, and so the OR was resulting in an empty set). It also gives me some ideas of how to use the stats method (possibly in combination with append or similar) to try to get what I need, and your simulation comes in very handy for experimentation. Your particular solution does not really produce the results that I'm looking for (note that the resulting dataset in my example is ALL that I want as a result of the merge - nothing more), but using 'list' instead of 'values' appears to do so (just like @bowesmana suggested). Turns out that my needs changed since I posted and I happen to not need to produce this 'merge' query anymore, but I appreciate the help here and I think the suggestions were a good lesson on how to use some of the Splunk commands. Thanks again!

pgoldweic

Thanks @yuanliu and @bowesmana for your replies. While I thought that my original goal was clear, I have to agree with @yuanliu that I need to give a more concrete example of it (although I disagree that I was really thinking in SQL terms; I simply used the concept of 'primary key' to more succinctly say what I was trying to). I also believe that @bowesmana is getting closer to what I need. BTW, I am not very familiar with the use of OR in this fashion (are there any restrictions on the shape of those datasets? BTW, I happen to get an empty result set when I 'OR' my result sets), and also, I am not using the word 'dataset' in the official way (I simply meant a set of results from a Splunk query). So, for clarification purposes, here's what I have: Dataset A is [ search ...... | table a, b, c ], so for example here's a list of results: a1 b1 c1 a2 b2 c2 and dataset B is [search .... | table a, d, e, f] such as: a1 d1 e1 f1 a1 d2 e2 f2 a1 d3 e3 f3 a2 d4 e4 f4 a2 d5 e5 f5 What I need as a result of a new search is a new set of results C that look like this: a1 b1 c1 d1 e1 f1 a1 b1 c1 d2 e2 f2 a1 b1 c1 d3 e3 f3 a2 b2 c2 d4 e4 f4 a2 b2 c2 d5 e5 f5 Thanks!

pgoldweic

I am trying to merge two datasets which are results of two different searches on a particular field value common to both. The field I want to merge on is not a 'primary key' of any of the datasets, and therefore there's multiple events in each of these datasets with a given value of this field. My expected result is that for each event in the first dataset with a particular value of that field, I will end up producing n events in the resulting dataset, where n is the number of events in the second dataset that have that particular value in the field. So for example, if I have 3 events with that field value in dataset A and 4 events with that particular field value in dataset B, then I expect to have 12 events in the result dataset (after the merge). What Splunk command/s would be useful to merge these datasets in this fashion?

pgoldweic · ‎04-19-2022

Hi @eliav2 , yes, I should have updated this post a while ago but forgot to do so. Essentially, what I discovered was that the javascript 'require' call (which I mention above in the post) was timing out when several Splunk queries were being access simultaneously. This in particular, is not a Splunk limitation, but a timing limitation in that function. I was able to temporarily do away with this timeout by changing the parameters being passed to 'require'. Specifically, I ended up with this call: // Configure the web site's base URL require.config({ baseUrl: "static/", waitSeconds: 0 }); Note the 'waitSeconds' value above., which would normally not be included. Ultimately though, I ended up understanding the reality that Splunk's performance is the real culprit when writing this type of applications, and I did what I could to 'optimize' the queries that I was running simultaneously on one web page (even sequencing some of them to avoid some of the concurrency). This continues to be an issue for us and we haven't really found a good solution to the problem in general. If you find out some other way please post it here. Good luck with your optimization!

pgoldweic · ‎03-21-2022

Thanks so much @ryanoconnor for sharing all that information! Very useful indeed.

pgoldweic · ‎02-22-2022

Thanks so much for your updated post @ryanoconnor . Would be great if you could also share two files that your code requires: ."/App.css", and also "./constants", which should help with running this sample in a real environment. Or, at least share the "constants" file only, since I now realize that "App.css" might be the one created automatically by create-react-app.

pgoldweic · ‎02-04-2022

While I didn't write the original post, I hope it's okay to reply to @ryanoconnor here with a couple of follow-up questions on the code he posted. First of all, thanks so much for posting this code! Here are the questions: 1- Does the authentication (via the Authorization header) require *only* the new authentication tokens, or does it also work with session key values (retrieved via the legacy login REST endpoint)? 2- When writing these apps outside of Splunk, can we make use of Splunk css files similarly to what we could do with splunkjs? (in splunkjs-based apps, we're able to keep all the relevant splunk-related css files in a special static/splunkjs app folder). These css files could then be used within the React code (similarly to how you use App.css in the example).

pgoldweic · ‎06-30-2021

I seem to be experiencing the same issue as reported here with a very small/simple csv file that suggests to me that only csv columns which have *at least* one non-empty value in them are being imported. Could somebody please confirm whether this is expected behavior (hopefully not) or some sort of bug?.

pgoldweic · ‎11-12-2020

Thanks @renjith_nair once again for replying. However, this reply makes it clear to me that you misunderstood what my question was about. Specifically, I am already displaying results of searches in views (chart views, tables, etc.), so my question was *not* about how to display results in those components. My question is specifically about how to obtain the set of results programmatically when the search is done, without using the canonical example shown in my post. Therefore, an alternate answer for my question -since my post already shows the canonical approach for this- would come in the form of a method call to apply to a search or view object, etc. to obtain these results. I also understand that I could probably make a REST call to obtain these results from within the 'search:done' handler, but I was curious to see if there was a way that would avoid *both* the canonical approach and also the REST call.

pgoldweic · ‎11-11-2020

Thanks @renjith_nair for replying back. I am already doing what you are suggesting in your reply (using the search:done event to compare number of results and start another search). The only thing I've been missing here is the direct access to the set of results, and not just the resultCount, for example. Could you clarify what you mean when you say: -------------------------------------------------------- Actual results, I usually attach to the visualization directly with "managerid": "srchId" ------------------------------------------------------------ I'm afraid I'm not following what you're trying to say here. Please be explicit (with a line of code) in how you'd gain access to the actual result set. Thanks!

pgoldweic · ‎11-09-2020

I've actually seen this (and used this event before for other purposes) but on visual inspection, I could not find the actual results in the 'properties' object. I see resultCount, and various related items, but could not see actual results. If you see them yourself @renjith_nair , could you tell me where exactly to find them within properties.content? thanks

pgoldweic · ‎11-06-2020

I can retrieve results from my search manager by using this type of code: var mydata = mySearchManager.data("results") mydata.on("data", function() { if (mydata.hasData()) { let numRows =mydata.data().rows.length; .... (do something with the data) } }); However, the event handler above runs more than once (twice in my particular search, even though there's only one row of results). How do I prevent it from running twice? (or, alternatively, how do I retrieve the results of a search manager ONLY when it is completely done? Since I use this handler to start a difference search -when this one is done-, I want to make sure the handler doesn't run more than once -or otherwise the second search will be started more than once too-.

pgoldweic · ‎11-02-2020

We created an application (mostly Javascript, with a proxy server for communicating to Splunk) that, while running outside of Splunk, accesses Splunk Enterprise data and displays Splunkjs visualizations (using the docs at https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usesplunkjsstack/ ). Unfortunately we seem to be running into load-related issues when several users simultaneously access it, as follows: 1 - Incomplete chart displays ('waiting for data' forever) in a couple of charts that happen to depend on the completion of saved searches for their own (post process) search to get started. 2 - Other times, this error appears in the Javascript console and none of the charts load: Uncaught Error: Load timeout for modules: splunkjs/ready!_unnormalized2,splunkjs/ready!http://requirejs.org/docs/errors.html#timeout at makeError (eval at module.exports (config.js:138), <anonymous>:166:17) at checkLoaded (eval at module.exports (config.js:138), <anonymous>:692:23) at eval (eval at module.exports (config.js:138), <anonymous>:713:25) NOTE: these issues don’t come up unless there are various simultaneous (10 or so is all that it requires) loads of the application, which is why we are theorizing that they are load-related issues. In addition, our Splunk admin was present when we tested this app, and he did not see the relevant limits being reached on the back end (e.g. number of simultaneous searches, space used by the single service user employed in this application) . Could somebody please advise on what could be happening? Are there limitations specific to the Splunkjs stack that we should be aware of?

pgoldweic · ‎09-29-2020

Thanks for your reply! It looks like I've deleted my original response to this post by mistake :-(. I understand this as a clever work-around for the fact that the feature is not supported (as built-in) in bar charts. I am not familiar yet with some of the commands in your query, but I'll them up as they seem pretty useful. Thanks!

pgoldweic · ‎09-26-2020

I'd like to display up to a certain number of data points in a bar chart in a way that the rest of the items which do *not* get displayed are collapsed into one bar: "other". Is there a way to do this? I'm aware that I can simply set the maximum number of data points to display, but this provides no information about the rest, which is what I'm trying to do. I'm using the Splunjs framework to create the visualization in an app external to Splunk.

pgoldweic · ‎05-20-2020

I've been trying to reproduce simple custom drilldown behavior as documented in https://dev.splunk.com/enterprise/docs/developapps/webframework/codeexamplefw/splunkjsstack/drilldownjavascript/ but nothing appears to work for me (that is, 1- click events in my chart don't seem to be producing any effects in the console; 2- the default onDrilldown function only appears to get called from one of the charts in my page -and produces an error-. What could be wrong? (note: I'm simply trying to produce some custom logging behavior at this point).

pgoldweic · ‎05-18-2020

I've been able to find the answer to my question after I kept experimenting. Turns out that option #2 above is the correct one. I was originally confused by the fact that the search was returning no results, but eventually I figured out that it was due to a mistake I had made when creating the search query.

pgoldweic · ‎05-15-2020

Hi, I'm looking for the proper way to set the 'search' property of a PostProcessManager in splunkjs within an app that runs outside of Splunk Enterprise. Documentation on this is not clear, and my trials have been unsuccessful, as follows: myManager.set("search", <mysearchstring>) is apparently syntactically correct, but returns no results myManager.settings.set("search", <mysearchstring>) is apparently syntactically correct, but returns no results myManager.search.set(<mysearchstring>) is apparently syntactically correct but causes no update in the display myManager.query.set(<mysearchstring) is also syntactically correct but causes no update in the display NOTES: - After setting the search query, I'm also calling 'startSearch()' on the search manager, and then render() on the chart - Before responding, please note that this is for apps outside of Splunk and not otherwise. See examples for this type of apps in https://dev.splunk.com/enterprise/docs/developapps/webframework/codeexamplefw/splunkjsstack/searchcontrolseventsjs This is where the 'manager.search.set' and 'manager.query.set' are used in examples with plain SearchManager instances) Thanks in advance for any help.

pgoldweic · ‎04-29-2020

Oh, I see. It didn't occur to me that Splunk could be rounding out, but it now makes sense. Thanks!

pgoldweic · ‎04-29-2020

Thanks for your reply. I just tried your suggestion but it's not working (gives me identical results!).

Posts	58
Solutions	3
Karma Given	22
Karma Received	6
Member Since	‎04-04-2019

Online Status	Offline
Date Last Visited	2 weeks ago

how to merge two datasets on a non 'primary key' f...

How to retrieve results from search manager ONLY w...

How to resolve Load issues while using Splunkjs st...

How to display an "other" bar in a bar c...

custom drilldown for splunkjs app outside of Splun...

looking for proper way to dynamically set 'search'...

Sorting issue with numeric field, descending order

trouble creating query for single value chart with...

Unable to dynamically set "charting.data.count" in...

Can I use splunkjs charts in an app outside of Spl...

Re: how to merge two datasets on a non 'primary ke...

Re: how to merge two datasets on a non 'primary ke...

how to merge two datasets on a non 'primary key' f...

Re: Load issues while using Splunkjs stack for app...

Re: splunk UI/dashboard in external app

Re: splunk UI/dashboard in external app

Re: splunk UI/dashboard in external app

Re: Columns missing while using the Add Data to up...

Re: How to retrieve results from search manager ON...

Re: How to retrieve results from search manager ON...

Re: How to retrieve results from search manager ON...

How to retrieve results from search manager ONLY w...

How to resolve Load issues while using Splunkjs st...

Re: How to display an "other" bar in a b...

How to display an "other" bar in a bar c...

custom drilldown for splunkjs app outside of Splun...

Re: looking for proper way to dynamically set 'sea...

looking for proper way to dynamically set 'search'...

Re: Sorting issue with numeric field, descending o...

Re: Sorting issue with numeric field, descending o...