Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About pgoldweic
pgoldweic
Communicator
Member since:
04-04-2019
05-27-2025
Community Statistics
| Posts | 62 |
| Solutions | 3 |
| Karma Given | 23 |
| Karma Received | 6 |
| Member Since | 04-04-2019 |
Activity Feed
- Posted Re: splunk-utils/search: GetData API Version undefined on Splunk Dev. 09-10-2024 11:39 AM
- Posted Re: splunk-utils/search: GetData API Version undefined on Splunk Dev. 09-10-2024 11:31 AM
- Posted Re: Date time formatting variables not producing result I expected on Splunk Search. 10-27-2023 08:46 AM
- Karma Re: Date time formatting variables not producing result I expected for yuanliu. 10-27-2023 08:45 AM
- Posted Date time formatting variables not producing result I expected on Splunk Search. 10-26-2023 03:19 PM
- Tagged Date time formatting variables not producing result I expected on Splunk Search. 10-26-2023 03:19 PM
- Tagged Date time formatting variables not producing result I expected on Splunk Search. 10-26-2023 03:19 PM
- Tagged Date time formatting variables not producing result I expected on Splunk Search. 10-26-2023 03:19 PM
- Karma Re: how to merge two datasets on a non 'primary key' field ? for isoutamo. 09-13-2023 11:08 AM
- Karma Re: how to merge two datasets on a non 'primary key' field ? for yuanliu. 09-13-2023 11:08 AM
- Karma Re: how to merge two datasets on a non 'primary key' field ? for bowesmana. 09-13-2023 11:08 AM
- Posted Re: how to merge two datasets on a non 'primary key' field ? on Splunk Search. 09-12-2023 01:04 PM
- Posted Re: how to merge two datasets on a non 'primary key' field ? on Splunk Search. 09-12-2023 08:21 AM
- Posted how to merge two datasets on a non 'primary key' field ? on Splunk Search. 09-11-2023 10:06 AM
- Tagged how to merge two datasets on a non 'primary key' field ? on Splunk Search. 09-11-2023 10:06 AM
- Posted Re: Load issues while using Splunkjs stack for app running outside of Splunk on Splunk Dev. 04-19-2022 08:10 AM
- Got Karma for How to resolve Load issues while using Splunkjs stack for app running outside of Splunk?. 04-17-2022 05:32 AM
- Karma Re: splunk UI/dashboard in external app for ryanoconnor. 03-21-2022 02:38 PM
- Posted Re: splunk UI/dashboard in external app on Dashboards & Visualizations. 03-21-2022 02:37 PM
- Posted Re: splunk UI/dashboard in external app on Dashboards & Visualizations. 02-22-2022 11:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-10-2024
11:43 AM
Hi @pgoldweic - I did not receive a response back. I was told to email the dev team's support directly: webplatform@splunk.com or hit up their Slack channel: #webplatform
... View more
06-10-2024
12:41 PM
"join is one of the most inefficient SPL commands, and has a lot of limitations, by using sub searches, that you can hit even without knowing you hit them" Then deprecate its use.
... View more
10-27-2023
08:46 AM
Thanks @yuanliu ! That definitely does it. I was sure I had tried this already, but somehow, I seem to have missed that particular format string and was skipping the percent before the Z. Thanks again for replying!
... View more
09-12-2023
11:39 PM
1 Karma
Hi here is old answer about SQL join equivalence in SPL. https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-join-and-the/m-p/391288/thread-id/113948 r. Ismo
... View more
01-31-2023
02:24 PM
Note that this statement in this solution is wrong | eval utc_time = relative_time(epoch_time,strftime(epoch_time,"%z")."h") as it will convert offset to a 4 digit TZ offset (in my case +1100) and append h, so will do a relative_time addition of 1100 hours to my time, whereas it should be +11h.
... View more
11-04-2022
07:22 AM
1 Karma
Hey @mleati , That is a good point, if you look at the code of this example I provided: https://github.com/splunk/react_search_example - An app outside of Splunk using Splunk Utils to search against Splunk That examples does indeed show how to do post-process searches for apps outside of Splunk. For apps within Splunk, the @splunk/search-job package can help you out easily, we have Post Process capability built-in. Hope that helps! Note that if you are using the Splunk UI Toolkit, searches and API calls should be done with our packages if they relate strictly to UI, so I wouldn't recommend trying to make an app with the Splunk UI toolkit and referencing the old Splunk JavaScript SDK or SplunkJS/Splunk Web Framework and mixing functionality just yet.
... View more
04-19-2022
08:10 AM
Hi @eliav2 , yes, I should have updated this post a while ago but forgot to do so. Essentially, what I discovered was that the javascript 'require' call (which I mention above in the post) was timing out when several Splunk queries were being access simultaneously. This in particular, is not a Splunk limitation, but a timing limitation in that function. I was able to temporarily do away with this timeout by changing the parameters being passed to 'require'. Specifically, I ended up with this call: // Configure the web site's base URL require.config({ baseUrl: "static/", waitSeconds: 0 }); Note the 'waitSeconds' value above., which would normally not be included. Ultimately though, I ended up understanding the reality that Splunk's performance is the real culprit when writing this type of applications, and I did what I could to 'optimize' the queries that I was running simultaneously on one web page (even sequencing some of them to avoid some of the concurrency). This continues to be an issue for us and we haven't really found a good solution to the problem in general. If you find out some other way please post it here. Good luck with your optimization!
... View more
06-30-2021
01:19 PM
I seem to be experiencing the same issue as reported here with a very small/simple csv file that suggests to me that only csv columns which have *at least* one non-empty value in them are being imported. Could somebody please confirm whether this is expected behavior (hopefully not) or some sort of bug?.
... View more
06-27-2021
06:56 AM
1 Karma
If you need to make search queries from react you have to pass "splunkjs/mvc/searchmanager" to your react application. The source code you can see here https://github.com/ivfisunov/splunk-react-app
... View more
11-12-2020
07:23 AM
Thanks @renjith_nair once again for replying. However, this reply makes it clear to me that you misunderstood what my question was about. Specifically, I am already displaying results of searches in views (chart views, tables, etc.), so my question was *not* about how to display results in those components. My question is specifically about how to obtain the set of results programmatically when the search is done, without using the canonical example shown in my post. Therefore, an alternate answer for my question -since my post already shows the canonical approach for this- would come in the form of a method call to apply to a search or view object, etc. to obtain these results. I also understand that I could probably make a REST call to obtain these results from within the 'search:done' handler, but I was curious to see if there was a way that would avoid *both* the canonical approach and also the REST call.
... View more
09-29-2020
11:03 AM
Thanks for your reply! It looks like I've deleted my original response to this post by mistake :-(. I understand this as a clever work-around for the fact that the feature is not supported (as built-in) in bar charts. I am not familiar yet with some of the commands in your query, but I'll them up as they seem pretty useful. Thanks!
... View more
05-20-2020
09:44 AM
I've been trying to reproduce simple custom drilldown behavior as documented in https://dev.splunk.com/enterprise/docs/developapps/webframework/codeexamplefw/splunkjsstack/drilldownjavascript/ but nothing appears to work for me (that is, 1- click events in my chart don't seem to be producing any effects in the console; 2- the default onDrilldown function only appears to get called from one of the charts in my page -and produces an error-.
What could be wrong? (note: I'm simply trying to produce some custom logging behavior at this point).
... View more
05-18-2020
09:36 AM
I've been able to find the answer to my question after I kept experimenting. Turns out that option #2 above is the correct one. I was originally confused by the fact that the search was returning no results, but eventually I figured out that it was due to a mistake I had made when creating the search query.
... View more
04-29-2020
11:44 AM
Oh, I see. It didn't occur to me that Splunk could be rounding out, but it now makes sense. Thanks!
... View more
04-14-2020
11:32 AM
1 Karma
That seems useful. Thanks @DalJeanis ! I'll be accepting your answer to the post.
... View more
02-19-2020
09:26 AM
I've just updated the question to include more information that should answer your questions. Thanks.
... View more
02-13-2020
10:35 AM
Thanks @camillak, it looks like the code is about creating a custom replacement for the search manager. It could certainly be useful if one is writing a Splunk app. However, I am writing apps outside of Splunk and would rather not have to do that kind of customization. But it's useful to know it's possible though. Thanks again!
... View more
01-16-2020
02:06 PM
I'm wondering if it is possible to use the chart visualizations from splunkjs to display data that is neither in Splunk nor it should be imported into Splunk. The use case is an app external to Splunk with a dashboard that includes some panels with Splunk-based data and others with other types of data. It would be convenient to use the same type of visualization for the two different types of data, but I'm wondering whether this is possible or not. NOTE: I've read answers to many similar questions but they all involve importing the data into Splunk one way or the other. In this case I am not interested in importing any data, but simply visualizing it.
... View more
11-27-2019
10:24 AM
Having read numerous posts explaining how to use "charting.seriesColors", I concluded that to set the (unique) bar color of a timechart I would need to set this property to a 1 element array (my sought after color). (note: I have something like "|timechart count " as the search associated with each ChartView) However, I have several ChartView instances on my javascript page and I'd like them to use a distinct color each. When I try setting the above property on each of these charts to a distinct 1-element array (each array using a distinct color, such as "charting.seriesColors": [0xcc5068]), this does not appear to work, and all the instances end up using the same color. Why is this? Is there a way to achieve what I'm looking for?
... View more
11-02-2019
01:35 PM
OK, come back and click Accept on your answer to close the question.
... View more
04-07-2020
08:16 PM
1 Karma
@pgoldweic I think it may not work for Scheduled dashboard as it has custom CSS and token. You can try once with Smart PDF Exporter for Splunk app, but I have personally not tried that.
... View more
I also have the same question
... View more
