Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jrfreeze
jrfreeze
Explorer
Member since:
04-11-2019
04-04-2022
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 0 |
| Member Since | 04-11-2019 |
Activity Feed
- Posted Re: How can dedup with multiple fields returns fewer results on Dashboards & Visualizations. 04-04-2022 08:28 AM
- Karma Re: How can dedup with multiple fields returns fewer results for somesoni2. 04-04-2022 08:27 AM
- Posted How can dedup with multiple fields returns fewer results on Dashboards & Visualizations. 04-04-2022 08:19 AM
- Karma Re: Can I perform stats count on a substring using regex? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Group by two or many fields fields for horsefez. 06-05-2020 12:48 AM
- Karma Re: How to sort data in chronological order by month, not alphabetically? for sunilsk1. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to sort by subtotal? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to sort by subtotal? for gcusello. 06-05-2020 12:47 AM
- Karma Is it possible to divide results into buckets of varying sizes? for Glenn. 06-05-2020 12:45 AM
- Karma Re: Is it possible to divide results into buckets of varying sizes? for Stephen_Sorkin. 06-05-2020 12:45 AM
- Posted Re: How to add a time input to a form - missing search editing icon on Dashboards & Visualizations. 08-23-2019 05:26 AM
- Posted How to add a time input to a form - missing search editing icon on Dashboards & Visualizations. 08-22-2019 07:54 AM
- Tagged How to add a time input to a form - missing search editing icon on Dashboards & Visualizations. 08-22-2019 07:54 AM
- Tagged How to add a time input to a form - missing search editing icon on Dashboards & Visualizations. 08-22-2019 07:54 AM
- Tagged How to add a time input to a form - missing search editing icon on Dashboards & Visualizations. 08-22-2019 07:54 AM
- Posted Re: Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve on Splunk Search. 06-25-2019 10:03 AM
- Posted Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve on Splunk Search. 06-25-2019 06:58 AM
- Tagged Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve on Splunk Search. 06-25-2019 06:58 AM
- Tagged Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve on Splunk Search. 06-25-2019 06:58 AM
- Tagged Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve on Splunk Search. 06-25-2019 06:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-04-2022
08:28 AM
That did the trick - thanks!
... View more
04-04-2022
08:19 AM
I think I must be misunderstanding how dedup works. It seems to me if you add fields to the dedup field list, you should never get fewer events returned. | dedup fieldA Should get rid of all extra events with the same value of fieldA | dedup fieldA fieldB Should only get right of those where BOTH fieldA and fieldB have duplicate values, which set theory suggests to me must be the at least the same size as the those where we only get rid of duplicates for fieldA alone. But I'm getting far more results for: | dedup _time Than I do for | dedup _time wma_set wma_filename Any idea what's going on? For reference, here's the query: index="main" host="designsafe01.tacc.utexas.edu" "designsafe.storage.community" "SimCenter/Datasets" (op=download OR op=preview OR op=copy OR op=agave_file_download OR op=agave_file_preview OR op=data_depot_copy) | rex mode=sed "s/%20/ /g" | rex mode=sed field=info "s/\'/\"/g" | rex mode=sed field=info "s/\: u\"/: \"/g" | eval thepath=case(in(op,"download","preview","agave_file_download","agave_file_preview"),json_extract(info,"filePath"),op="copy", json_extract(info,"path"), op="data_depot_copy", json_extract(info,"fromFilePath")) | rex field=thepath "\/?SimCenter\/Datasets\/(?<wma_set>\w+)(?<wma_path>\/(.*\/)*)(?<wma_filename>[-\w\s\.]+)" | rex field=wma_filename ".+\.(?<wma_extension>\w*)" | dedup _time wma_set wma_filename
... View more
Labels
- Labels:
-
other
08-23-2019
05:26 AM
That does get a another date range, but I'd like to enable the time-range picker on the dashboard rather than opening each individual search in another window.
... View more
08-22-2019
07:54 AM
I would like to let users of my dashboard pick the time frame the reports in the panels search. The answer appears to be here:
https://docs.splunk.com/Documentation/Splunk/7.0.1/Viz/FormEditor
under Add a time input to a form
I have added the time input:
The next part sounds clear:
5.a. Click the search editing icon.
b. Select Edit search.
c. For Time Range Scope select Shared Time Picker.
The problem is I don't seem to have the "search editing icon" so I can't edit the search in the dashboard. Here's a snapshot of a panel in my dashboard:
None of the icons are the search editing one. They are: View Report, Select Visualization, Format Visualization and More Actions. I have dug into them and none seem to have what I need.
Any suggestions out there?
Thanks,
Joshua
... View more
06-25-2019
10:03 AM
For some reason, this site is not permitting normal field extraction strings. The line starting with "rex" should have 'wma_IP' between less than and greater than signs after the question mark. wma_IP is the name if the field holding the IP address.
I tried leaving a comment correcting it but was deleted from the comment as well.
... View more
06-25-2019
06:58 AM
I can't seem to get Splunk to run the search necessary to create a choropleth map. Here is my search:
index="main" host="designsafe01.tacc.utexas.edu" PUT /api/public/files/media/published/designsafe.storage.published
| regex "HTTP\/\d\.\d\s200"
| rex "(?[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"
| iplocation wma_ip
| stats count by Country
| geom geo_countries featureIdField="Country"
It works fine without the last line. I can use geostats to generate cluster maps without a problem.
Any time I try to use the geom command though, I get:
Error in 'SearchOperator:Geom': could not resolve
Any thoughts? I've found a couple of places with things to look for.
One person suggested I should change the settings in the lookup for geo_countries ,
but I don't see that lookup.
Isn't that supposed to be there by default?
Thanks,
Joshua
... View more
05-20-2019
11:47 AM
OK, this turned out to be a silly oversight. I had changed the "import" line, but then hadn't changed the actual connection definition is line 30 from:
connection = six.moves.http_client.HTTPSConnection(HOST, PORT)
to
connection = six.HTTPSConnection(HOST, PORT)
Now that error is solved but I still can't seem to get connected via Python. I'm thinking I need to have greater permissions maybe? Here's the new traceback:
Traceback (most recent call last):
File "a.py", line 43, in
connection.request("POST", "/services/auth/login", body, headers)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1053, in request
self._send_request(method, url, body, headers)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1093, in _send_request
self.endheaders(body)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1049, in endheaders
self._send_output(message_body)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 893, in _send_output
self.send(msg)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 855, in send
self.connect()
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1274, in connect
server_hostname=server_hostname)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 352, in wrap_socket
_context=self)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 579, in __init__
self.do_handshake()
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 808, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)
... View more
05-15-2019
07:25 AM
We use Splunk cloud and I'm trying to figure out how to use the Splunk Python SDK but I'm stuck on the first example. When I first ran a.py, I got the error:
NameError: name 'six' is not defined
Which I fixed by adding "as six" to "import splunklib.six.moves.http_client"
Now I'm stuck, getting the following when I enter python a.py:
Traceback (most recent call last):
File "a.py", line 30, in
connection = six.moves.http_client.HTTPSConnection(HOST, PORT)
AttributeError: 'module' object has no attribute 'moves
Any thoughts?
Thank you.
... View more
04-12-2019
06:52 AM
Well, I figured out a solution to my problem, although it isn't especially elegant. I put in a sed command changing one text match into the other and just counted that one:
host="our.host.com" ("Attempting new user registration" OR "Creating local user record")
| rex mode=sed "s/\'username\':\s+u\'([\w\d_]+)\'/Creating local user record for \"\1\"/"
| rex "Creating local user record for \"(?[\w\d_]+)\""
| stats dc(newuser) AS "New Users"
Now I get the same results whether I run the search directly or it runs on a schedule as I would expect.
... View more
04-11-2019
01:46 PM
There are two ways users can register for our site and I'm trying to track how many registered in the last quarter. When I run this search manually, it catches all the results from both sources. When it runs as scheduled search, the normal way it will be used for the dashboard, it only catches the results from the second one (meaning the second rex line). When I reverse the order of the rex commands, I get the results from the other one.
host="our.host.com" ("Attempting new user registration" OR "Creating local user record") |
rex "\'username\':\s+u\'(?[\w\d_]+)\'" |
rex "Creating local user record for \"(?[\w\d_]+)\"" |
stats dc(newuser) AS "New Users"
Any thoughts?
... View more
- Tags:
- splunk-cloud
