Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About crazyeva
crazyeva
Contributor
Member since:
06-05-2012
06-05-2020
Community Statistics
| Posts | 109 |
| Solutions | 2 |
| Karma Given | 14 |
| Karma Received | 18 |
| Member Since | 06-05-2012 |
Activity Feed
- Got Karma for Re: How to transpose a table to make the values in Column 1 the header labels?. 08-30-2020 05:18 PM
- Karma Re: splunk always starts at 127.0.0.1:8000 for kml_uvce. 06-05-2020 12:47 AM
- Karma Re: Can mobile access app access to none-https searchheads? for sni_splunk. 06-05-2020 12:47 AM
- Karma Re: Can mobile access app access to none-https searchheads? for roym_splunk. 06-05-2020 12:47 AM
- Karma Re: how to set token from a table for renjith_nair. 06-05-2020 12:47 AM
- Karma Re: How to transpose a table to make the values in Column 1 the header labels? for javiergn. 06-05-2020 12:47 AM
- Got Karma for How to transpose a table to make the values in Column 1 the header labels?. 06-05-2020 12:47 AM
- Karma Re: how does transaction command work? for MuS. 06-05-2020 12:46 AM
- Karma Re: timechart an average count for Ayn. 06-05-2020 12:46 AM
- Karma Re: loop search? for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Is it possible to group results by their tag? for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: Is it possible to group results by their tag? for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: xml use Comparison "<" for nfilippi_splunk. 06-05-2020 12:46 AM
- Karma Re: How to filter or extract fields before indexing time for Ayn. 06-05-2020 12:46 AM
- Karma Re: How to filter or extract fields before indexing time for kristian_kolb. 06-05-2020 12:46 AM
- Got Karma for multi line event, break with a empty line. 06-05-2020 12:46 AM
- Got Karma for Re: forwarding too slow. 06-05-2020 12:46 AM
- Got Karma for Re: forwarding too slow. 06-05-2020 12:46 AM
- Got Karma for does universalforwarder support SEDCMD?. 06-05-2020 12:46 AM
- Got Karma for does universalforwarder support SEDCMD?. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-13-2017
08:49 PM
Splunk can extract fields when events contain "key=value" strings
Could I tell splunk to extract fields automatically for me when meets "key:value" or "key\s*:\s*value" strings?
... View more
09-13-2016
06:38 PM
To verify your suggestion, I tried this but can not repeat my issue again.
|loadjob SID events=t
It returned more than 1000 events. Splunk version 6.4
I forgot why I used "load" and "pid", and what I searched 3 years ago.
Any one have the same issue, could you plz post your search conditions?
... View more
05-17-2016
12:00 AM
thank you!
but I still can not find those fields defination.
and this command can only display conf in ../etc/system and ../etc/apps, but not in ../etc/users?
... View more
05-16-2016
07:20 PM
Hi Guys
I am trying to delete some Fields configured by someone else, but I can't find where they are.
First of all, they are Chinese Characters. I want to replace them with Az.
I searched in Splunk Web, "Field extractions" with the sourcetype name or any of the field names, but nothing found. Then I grepped all the *.conf from $SPLUNK_HOME$, but no result returned.
I know they are normally in props.conf or transforms.conf. I checked every one of them, but failed to find anything. However, the FIELDs are there extracted when I do the search!
Where else could they be?
Thank you!
... View more
03-05-2016
10:30 PM
It happened to be "Yes", I have dbconnect and defined some inputs there. Does that impact so much?
... View more
02-25-2016
12:01 AM
I recently upgraded Splunk from 6.0 to 6.3.2. Everything seems right, but the 'Data inputs' page has the same issue as the old version with a green 'Add Data' button linking to nowhere. Its url: 'http:///en-US/manager/search/datainputstats', from menu: 'Settings', 'Data inputs'. I realized only one of my Splunk servers gets into this situation and it is my main Search Head.
Now I upgraded it to Splunk 6.3.3 (untar the .tgz file and cover to old folder) trying to solve this problem, but failed.
Is there anyone can help to upgrade Splunk partly?
... View more
Labels
- Labels:
-
search head
-
upgrade
01-26-2016
08:55 PM
I just want to hide web service without breaking its indexing process.
Is there any command as ./splunk stop splunkweb?
... View more
01-21-2016
10:57 PM
Hi, my page string :
<form>
<panel>
<search>
<query>
index=_internal earliest=-1h
|stats c
</query>
<preview>
<set token="to_display">$result.c$</set>
</preview>
</search>
<html>
<h1>total: $to_display$</h1>
</html>
</panel>
</form>
when query excuted, on the xml page will correctly display the 'stats count value' as total:200
but before that , when the token is not set yet, it shows total:$to_display$ directly for a while then changes to its value, could i hide the token name or set it with a default value such as "-" ?
... View more
01-21-2016
05:29 PM
thank you
still a lot to learn from 'Simple XML Reference'
but my issue is not about a drilldown search. it's just html display style. there will be no 'click' to set tokens
the result table will not appear.
values just shows in html as:
hello, a demo~
value_of_row1_col1
value_of_row1_col2
value_of_row2_col1
value_of_row2_col2
... View more
01-21-2016
04:26 AM
<form>
<panel>
<search ref="a savedsearch">
<preview>
<set token="value">$result.count$</set>
</preview>
</search>
<html>
<h1>$value$</h1>
</html>
</panel>
</form>
Xml code a bit complicate and structure like above
... View more
01-21-2016
02:25 AM
1 Karma
awesome cool !
thank you very much !
I did not find 'header_field' argument in Search Reference v6.2.3. I need update it.
by the way I find a solution using xyseries command. but it's not so convenient as yours
Edit:
transpose 's width up to only 1000
xyseries seams will breake the limitation
|eval tmp="anything"|xyseries tmp a b|fields - tmp
... View more
01-21-2016
02:01 AM
1 Karma
orange table:
a b
--------
fld1 1
fld2 2
fld3 3
fld4 4
I want to change it to:
fld1 fld2 fld3 fld4
--------------------------------
1 2 3 4
Where 'fldx' are the header labels
However, using the transpose command results in:
row1 row2 row3 row4
----------------------------------
fld1 fld2 fld3 fld4
1 2 3 4
How do I get the desired result?
... View more
01-21-2016
01:18 AM
Hi
suppose search result:
col1 col2
1 2
then
<preview>
<set token="row1_col2">$result.col2$</set>
</preview>
will set value "2" for "$row1_col2$"
but if search result as:
col1 col2
1 2
3 4
how could i get the value of "row2_col2" ?
... View more
12-28-2015
11:59 PM
Still thanks to @ppablo_splunk, I will try not to mess up everything this time.
I found a solution myself.
in css file:
.singleValue {
font-size: 1em;
font-weight: bold;
}
.singleValue .green {
font-size: 2em;
color: #00ff00;
}
.singleValue .red {
font-size: 6em;
color: #ff0000;
}
.singleValue .blue {
font-size: 4em;
color: #0000ff;
}
#image_overlay_panel #parsing_queue {
position: absolute;
top: 430px;
left: 292px;
}
in xml file:
<search id="parsing_queue">
<query>index=_internal
| stats count
| rangemap field=count green=0-50 blue=51-100 red=101-200 default=green
</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<preview>
<set token="parsing_queue">$result.count$</set>
<set token="parsing_range">$result.range$</set>
</preview>
</search>
and:
<div class="singleValue">
<div class="$parsing_range$" id="parsing_queue">$parsing_queue$</div>
</div>
... View more
12-28-2015
05:34 PM
Thanks to @ppablo_splunk for your help, By another misoperation, I deleted your post about code editing suggestion. Could I reinstate it?
... View more
12-27-2015
11:36 PM
According to app 'Splunk 6.x Dashboard Examples', dashboard 'Image Overlay with Single Values', it's cool to display a single value on an image, Picture: http://postimg.org/image/sjvjqy5vn/
But is it possible to define color range for result values?
I added the rangemap command to its search string:
<search id="merging_queue">
<query>index=_internal earliest=-5m
| stats count
| rangemap field=count high=1000-1800 elevated=1801-2000 guarded=2001-2500 default=gray</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<preview>
<set token="merging_queue">$result.count$</set>
</preview>
</search>
and add singlevalue color range definition to its css file:
.singleValue {
font-size: 4em;
font-weight: bold;
.singleValue .singleResult {
font-size: 3em;
vertical-align: -4px;
margin: 0px 6px;
}
.singleValue .high .singleResult {
color: #ff7e00;
}
.singleValue .elevated .singleResult {
color: #ffb800;
}
.singleValue .guarded .singleResult {
color: #4da6df;
}
#image_overlay_panel #merging_queue {
position: absolute;
top: 430px;
left: 292px;
}
But it seems the <preview> element will not take rangemap value
... View more
12-23-2015
10:20 PM
for some reason, i disabled https by adding 'enableSplunkdSSL = false' to server.conf
then i found mobile access on my phone unable to login to my searchhead
any solution to my scenario?
... View more
12-10-2015
06:56 AM
Thank you! Just replacing fieldformat with eval has solved my problem.
I have tried |tstats . That should be much prettier for my requirement.
But I still get a problem: I am not checking only last 5 days' statistics.
I mean the results should remain only the fileds(indexes) that have some events indexed in the last 5 days, so I won't see those 'blank' or 'null' or '0' after sorted by -_time, at least not in the first 5 lines.
I used |search [search tstats count where index=* earliest=-5d by _time index|return 100 index ] after |tstats command, trying to restrict indexes range, but failed.
Is there any way to get rid of my turbid search? as http://postimg.org/image/a8w4tdtd3/
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
