Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About fabrizioalleva
fabrizioalleva
Path Finder
Member since:
04-18-2019
06-15-2026
Community Statistics
| Posts | 30 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 04-18-2019 |
Activity Feed
- Got Karma for Re: Splunk dbconnect doesn't show DataLab. a month ago
- Got Karma for Re: Splunk dbconnect doesn't show DataLab. 06-16-2026 05:07 AM
- Got Karma for Re: Splunk dbconnect doesn't show DataLab. 06-15-2026 11:33 AM
- Posted Re: Splunk dbconnect doesn't show DataLab on Splunk Enterprise. 06-15-2026 09:42 AM
- Posted Splunk dbconnect doesn't show DataLab on Splunk Enterprise. 06-15-2026 09:23 AM
- Posted Re: Passing search results to a python script in alert_actions on Splunk Enterprise. 04-27-2026 03:12 AM
- Posted Passing search results to a python script in alert_actions on Splunk Enterprise. 04-24-2026 09:45 AM
- Tagged Passing search results to a python script in alert_actions on Splunk Enterprise. 04-24-2026 09:45 AM
- Karma Re: Showing/counting event that there's not for gcusello. 05-24-2024 08:20 AM
- Posted Re: Showing/counting event that there's not on Splunk Search. 05-24-2024 07:56 AM
- Posted Showing/counting event that there's not on Splunk Search. 05-24-2024 06:53 AM
- Posted SplunkDB Connect and MongoDB on prem on Splunk Enterprise. 05-03-2024 06:29 AM
- Posted Re: Splunk doesn't index csv at all on Splunk Enterprise. 06-17-2022 10:44 AM
- Posted Splunk doesn't index csv at all on Splunk Enterprise. 06-17-2022 07:25 AM
- Posted Clickable icon on table on Dashboards & Visualizations. 03-19-2021 08:47 AM
- Posted dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Tagged dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Tagged dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Tagged dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Posted Re: Dynamically load a dropdown from a value chosen from another on Splunk Enterprise. 11-02-2020 01:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-15-2026
09:42 AM
3 Karma
Solved. I've found after a copy two db_inputs.conf with same checkpoint.
... View more
06-15-2026
09:23 AM
Hi all, I'm working with Splunk Enterprise 10.4.0 and after the upgrade, when I go to the Data Lab page of Splunk DB Connect APP, I see a blank a page. I tried to reinstall the application Splunk DB Connect with the last version, but nothing has changed. I've tried to stop/start the application, but nothing. The other pages are correctly shown . My java version: java -version java version "21.0.10" 2026-01-20 LTS Java(TM) SE Runtime Environment (build 21.0.10+8-LTS-217) Java HotSpot(TM) 64-Bit Server VM (build 21.0.10+8-LTS-217, mixed mode, sharing) Any Ideas?
... View more
Labels
- Labels:
-
upgrade
04-27-2026
03:12 AM
thank for your help! I've found that I've to configure alert_actions.conf.spec file in README dir of my own application. After some attempts all is wortking fine
... View more
04-24-2026
09:45 AM
Hi all, I'm trying to execute a script in a scheduled Alerts, when results of a search are greater than 0. I've created my $SPLUNK_HOME/etc/apps/[myapp]/default/alert_actions.conf, following: https://dev.splunk.com/enterprise/docs/devtools/customalertactions/configappcaa and I've this: [MyAction] is_custom = 1 label = MyAction description = open ticket payload_format = json python.version = python3 alert.execute.cmd = test.py param.datemod = param.devname = param.toner = I've put 3 params in the same file, and everything I write after = generates this error: Invalid key in stanza [MyAction] in /splunk/sh/etc/apps/monitor/default/alert_actions.conf, line 9: param.datemod (value: ). Invalid key in stanza [MyAction] in /splunk/sh/etc/apps/monitor/default/alert_actions.conf, line 10: param.devname (value: ). Invalid key in stanza [MyAction] in /splunk/sh/etc/apps/monitor/default/alert_actions.conf, line 11: param.toner (value: ). I understood that it's waiting for something after the =, I've tried ( datemod, devname, toner that are the output of the search ) but nothing. I configured the web gui alert with MyAction as Trigger Action ( the action is now running every 2 minutes ). The script is executed, because I write a static line into a file, and I see that the file is always update. But how can I pass the search results to the script ? Reading the guide it's no so clear for me. Thanks in advance for any help! Fabrizio
... View more
- Tags:
- alert_actions
- stanza
Labels
- Labels:
-
using Splunk Enterprise
05-24-2024
07:56 AM
Thanks, @gcusello, I already tried with time chart, but if I've a lot of application which work in this way, I'm not able to work with timechart, also because if I wanto to work with data after timechart I cannot. Maybe better so: DATE,APP 2024/05/24 11:04:00, APPA 2024/05/24 11:05:00,APPB 2024/05/24 11:06:00,APPA 2024/05/24 11:08:00,APPB 2024/05/24 11:09:00,APPA 2024/05/24 11:10:00,APPB 2024/05/24 11:11:00,APPA 2024/05/24 11:13:00,APPB 2024/05/24 11:14:00,APPA So I've to highlight this condition of "flapping" in 10 minutes. If The app is present, it means that it's not respondig. index=myindex | timechart span=1m by APP produces: _time, APPA, APPB And what I want to produce _time, APPA, APPB 2024/05/24 11:04:00, 1,0 2024/05/24 11:05:00, 0,1 2024/05/24 11:06:00, 1,0 2024/05/24 11:07:00,0,0 2024/05/24 11:08:00, 0,1 2024/05/24 11:09:00, 1,0 2024/05/24 11:10:00, 0,1 2024/05/24 11:11:00, 1,0 2024/05/24 11:12:00,0,0 2024/05/24 11:13:00, 0,1 2024/05/24 11:14:00, 1,0 But I want to work with this output in order to send alert to other application. Thanks
... View more
05-24-2024
06:53 AM
Hi all, we've a procedure that's writes index only where there's a KO: So I've a sequence of events like these: DATE,RESPONSE 2024/05/24 11:04:00,1 2024/05/24 11:05:00,1 2024/05/24 11:06:00,1 2024/05/24 11:08:00,1 2024/05/24 11:09:00,1 2024/05/24 11:10:00,1 2024/05/24 11:11:00,1 2024/05/24 11:13:00,1 2024/05/24 11:14:00,1 As you can se between 2024/05/24 11:06:00 and 2024/05/24 11:08:00 and 2024/05/24 11:11:00 2024/05/24 11:12:00 , there's no a KO What we want do is to produce a full output like this: 2024/05/24 11:04:00,1 2024/05/24 11:05:00,1 2024/05/24 11:06:00,1 2024/05/24 11:07:00,0 2024/05/24 11:08:00,1 2024/05/24 11:09:00,1 2024/05/24 11:10:00,1 2024/05/24 11:11:00,1 2024/05/24 11:12:00,0 2024/05/24 11:13:00,1 2024/05/24 11:14:00,1 In order to highlight the service's up/down. I've tried with a lot of method but I cannot obtain a similiar result. Any suggestion ? Thanks Fabrizio
... View more
Labels
- Labels:
-
stats
05-03-2024
06:29 AM
Hi all, I need to use SplunkDB connect to connect to a MongoDB on prem instance. I've installed Splunk DBX Add-on for MongoDB but I understand that it works only with Atlas MongoDB and not with Mongo on prem installation. I tried to follow this suggestion https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-Splunk-DB-Connect-to-search-MongoDB/m-p/210569 but the format of stanza is quite different. I try to create a connection using the MongoDB Atlas Connection Type, I receive this error: Command failed with error 40324 (Location40324): 'Unrecognized pipeline stage name: '$sql' Any suggestion ? Fabrizio
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-17-2022
10:44 AM
Solved. by myself I've to set TIME_PREFIX in props.conf to instruct that the timestamp is the second field and not the first. It's nice to note that the problem there is now that I've some object that has the ID similiar to a UNIX TIMESTAMP. Closed
... View more
06-17-2022
07:25 AM
Hi all, I'm working on a deploy with Universal Forwader, Heavy Forwarder and Indexer Cluster and Search Cluster. The problem is this: I'm indexing data from different csv since long time. For the first time yesterday I realized that not all the raw of my csv files are indexed at all. For example: In a csv I count 24k rows and when I perform a stats count on the index I see only 16/17k rows. Each file rotates every minutes. In the log there's anything that leads to an error. In the UNIVERSAL FORWARDE I've this in inputs.conf [batch:///var/opt/OV/shared/perfSpi/datafiles/metric/final/F5_ResurcesGroup*] disabled = 0 index = f5_metrics sourcetype = f5_metrics initCrcLength = 100000 move_policy = sinkhole In the HEAVY FORWARDER: props.conf [f5_metrics] INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER=1 HEADER_FIELD_DELIMITER =, FIELD_DELIMITER=, HEADER_FIELD_LINE_NUMBER = 0 SEDCMD-dropheader = s/^"Node.+//g SEDCMD-select_fields = s/([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*)/\1,\2,\4,\5,\9,\17,\18/g #SEDCMD-select_fields = s/([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*)/\1,\4,\5,\9,\17,\18/g TRANSFORMS-f5_fields_name_extract=f5_fields_name_extract and in the transform.conf [f5_fields_name_extract] REGEX=([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*) FORMAT=NodeID::$1 TimeStamp::$2 period_length::$3 ltmVirtualServStatClientCurConns::$4 ltmVirtualServStatVsUsageRatio1m::$5 DisplayAttribute::$6 PollingInterval::$7 #FORMAT=NodeID::$1 period_length::$2 ltmVirtualServStatClientCurConns::$3 ltmVirtualServStatVsUsageRatio1m::$4 DisplayAttribute::$5 PollingInterval::$6 WRITE_META = true Any suggestion ? Thanks Fabrizio
... View more
Labels
03-19-2021
08:47 AM
Hi all, I'm looking for a method to put some icons into a table ( 4 or 5 foreach row), which are clickable and open different link ( one syslog, one cmdb infos, one performance and other). I've tried some solution like : https://community.splunk.com/t5/Splunk-Search/How-do-you-add-buttons-on-table-view/m-p/384712#M112364 but it's not what I'm looking for. I succeded in putting only label so somenthing like this: and the click on each link is working fine, so instead of the label I want to put an icon. Thanks in advance for any response Fabrizio
... View more
Labels
- Labels:
-
javascript
-
simple XML
-
table
01-05-2021
07:19 AM
Hi all, I've succeeded in enabling the button "Create New Dashboard" only for the admin user. But if I want to enable it for all the users in admin Roles? I'm trying to work with roles:this.collection.roles this.roles.id = /services/authentication/Roles/admin but nothing.. any suggestions ? Thanks Fabrizio
... View more
Labels
- Labels:
-
javascript
11-02-2020
01:56 AM
Thanks a lot
... View more
10-30-2020
11:47 AM
Hi all, I'm trying to populate a dropdown with dynamic values according the value coming from another dropdown, like unit measure for example: if the dropdown A contains Fruits the B will contain (1000 gr, 100 hg, 1 kG ) instead if the A cointains Liquid B will cointains (1000 ml. 100 cl. ) where 1000/100/1 will be Field For Value and gr hg and KG will be field for Label. I'm trying something like this : | makeresults | eval type="fruits" | eval unit=case(type=="fruits","1000 gr, 100 hg, 1 kg", type=="liquid","1000 ml, 100 cl", 1=1, "no vlaue") | rex field=unit "(?<A>.*)\,(?<B>.*)" | fields A B But I'm not be able to parameterize the two or three values in the fields to make the split.. Thanks
... View more
Labels
- Labels:
-
using Splunk Enterprise
04-22-2020
06:51 AM
Hi all,
I've succeeded in making a table with custom_table_row_expansion,js which expand every rows publishing the child events of a correlated father.
Now I'm tryingto apply table_cell_highlighting to colour the child new event with a color for the dalay.
I've combined table_cell_highlighting.js in the dashboard. In the custom_table_row_expansion.js I set the id of the new table highlight, I made a style css inside the dashboard in the hidden panel:
<panel depends="$alwaysHideCSS$">
<html>
<style>
.table>thead>tr>th {
color: #0066ff !important;
text-shadow: none;
font-family : Verdana !important;
}
.table>thead>tr>th:hover {
/*background-image: linear-gradient(to bottom, #666, #444) !important;*/
color: #000000 !important;
text-shadow: none;
}
.table .sorts a {
text-decoration: none;
font-weight: bold;
font-size: 12px ;
color: #002966;
}
.table>tbody>tr {
width: 20%;
color: #006699;
font-family : Verdana !important;
}
td{
font-size: 11px !important;
font-family : Verdana !important;
}
#highlight tr.range-elevated td {
background-color: #000000 !important;
color: #ffffff;
}
#highlight tr.range-severe td {
background-color: #ff0000 !important;
color: #ffffff;
}
#highlight .table td {
border-top: 1px solid #fff;
}
#highlight td.range-severe, td.range-elevated {
font-weight: bold;
}
</style>
</html>
</panel>
and the javascript is this one:
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
// Row Coloring by String Comparision of Numeric Time Value in HH:MM:SS
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for DELAY field
return _(['DELAY']).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = cell.value;
// Apply interpretation for DELAY field
if (cell.field === 'DELAY') {
if (value >= "02:00:00") {
$td.addClass('range-cell').addClass('range-severe');
}
if (value < "02:00:00" && value > "01:30:00") {
$td.addClass('range-cell').addClass('range-elevated');
}
}
// Update the cell content with string DELAY value HH:MM:SS
$td.text(value).addClass('string');
}
});
mvc.Components.get('highlight').getVisualization(function(tableView) {
tableView.on('rendered', function() {
// Apply class of the cells to the parent row in order to color the whole row
tableView.$el.find('td.range-cell').each(function() {
$(this).parents('tr').addClass(this.className);
});
});
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
But nothing happened when I expand the rows.
Any suggestion ?
Fabrizio
... View more
04-16-2020
05:54 AM
Hi all,
starting from a csv which contains 10 items, I want to count ( in order to produce a chart ) all the matches in the index and all the matches where a specific fields is equal to 1 . So two values for each item ( the first all matches and seconds all the matches where another field = 1 )
If no matches were found the value for csv items should be 0.
I hope it's clear
I try to do it whitout csv, but if an item has no matches in the index that item is not shown in the chart )
Thanks Fabrizio
... View more
- Tags:
- csv
- splunk-enterprise
04-15-2020
03:34 AM
Ok this works fine !
Thanks a lot!
How can I accept this as ansswer ??
... View more
04-15-2020
02:27 AM
It doesn't work in the dropdown the default value is not 15 ( today ) is always $day$.
It seems that Splunk doesn't accept the first query which pass the today value in the token.
The porpouse is to load a dropdown with the list of days, and by default to show the today value.
Thanks
... View more
04-15-2020
01:16 AM
Hello,
I'm trying from an initial search to put the value into a token to use it as a default initial value for a dropdown list something like this:
<form script="table_with_buttons.js">
<search>
<query>
| makeresults
| eval day=strftime(now(), "%d")
| fields day
</query>
<done>
<set token="day">$result.day$</set>
</done>
</search>
<init>
<set token="start_day">$day$</set>
</init>
<row>
<panel>
<title>Data Inizio</title>
<input type="dropdown" token="start_day">
<label>Giorno $start_day$</label>
<fieldForLabel>giorno</fieldForLabel>
<fieldForValue>giornoid</fieldForValue>
<search>
<query>|inputlookup day.csv| table dayid day</query>
</search>
<choice value="$start_day$">$start_day$</choice>
<default>$start_day$</default>
</input>
</panel>
</row>
<form>
at runtime what I obtain is shown in the picture :
Any Suggestion ?
Thanks
Fabrizio
... View more
03-16-2020
11:00 AM
Opsssss. I've tried this but I dont wait for the result to come back!!!!!!
Now I've tried and I wait and the results came back I'm sorry!!!!!!!!
... View more
03-16-2020
10:26 AM
Hi all,
is there a way to pass to a report the filename of a csv as variable, to use it as lookup file ?
Example:
| savedesearch my_report file=my_file.csv
where
my_report
| some search
| lookup $file$
... View more
01-27-2020
05:48 AM
Hi,
in the last days I've succeded in establishing the right comunication between HF and IDX. So now when i bring up the port 9996 all the other forwarding still work fine.
Only the one which runs on 6514 (hf) ---> 9996 (idx_cl ) give me those messagges in metrics.log:
01-27-2020 14:41:26.012 +0100 INFO Metrics - group=tcpin_connections, a.b.c.d:40386:6514, connectionType=rawSSL, sourcePort=40386, sourceHost=a.b.c.d, sourceIp=a.b.c.d, destPort=6514, kb=0, _tcp_Bps=0, _tcp_KBps=0, _tcp_avg_thruput=0, _tcp_Kprocessed=0, _tcp_eps=0, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0
Any suggestion?
Thanks
... View more
01-22-2020
06:55 AM
I've tried even this way, but after the deployment, was alway the same.
In all the NO-SSL app's input.conf I put
_TCP_ROUTING = default-autolb-group
and in the SSL one :
_TCP_ROUTING=splunkindexer-ssl
but it is always the same.
... View more
01-22-2020
05:42 AM
Ok,
Probably the easiest way is to configure the 9997 port on indexer in SSL, and all the comunication will go over SSL
But If I want to configure the other port ?
Does the Heavy Forwarder support a configuration like the one I've posted in my question ?
Fabrizio
... View more
01-22-2020
01:31 AM
Hi all,
I've an enviroment like this:
1 Search Head Cluester ( 3 servers ) ;
1 Indexers Cluster ( 4 server );
1 Deployment Server;
1 Cluster Master;
1 Heavy Forwarder;
and N universal forwarder.
On each server, of the indexer cluster, I've opened the 9997 port to receive and ingest data.
I configured the Heavy forwarder to send data to the IDX cluster through an'APP with an outputs.conf like this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
indexerDiscovery = idxc1
useACK = true
autoLBVolume = 65536
[indexer_discovery:idxc1]
master_uri = https://[cm_ip]:8090
pass4SymmKey = **********
This output is not SSL and all the data which use this output are ingested from IDX cluster.
Now I've to send from the same Heavy Forwarder other data but in SSL. So after creating the certificates for Indexers and for the forwarders, after copying the RootCA on each server, I've created an app on the forwarder with an inputs.conf like this:
[tcp-ssl://6514]
disabled = false
sourcetype = syslog
index = ads
[SSL]
serverCert = $SPLUNK_HOME/etc/certs/hforwarder.pem
sslPassword = ***********
requireClientCert = false
and outputs.conf like this :
[tcpout]
defaultGroup=splunkindexer-ssl
[tcpout:splunkindexer-ssl]
autoLBFrequency = 30
compressed = false
server = idx1:9996,idx2:9996,idx3:9996,idx4:9996
clientCert = $SPLUNK_HOME/etc/certs/splunk.pem
useSSL=true
sslPassword = ***********
On the each indexers node I've create an app to open the 9996 port on SSL, with an inputs.conf like this:
[tcp-ssl://9996]
disabled = false
[SSL]
serverCert = $SPLUNK_HOME/etc/certs/splunk.pem
sslPassword = **********
requireClientCert = false
After deploying this configuration the first flow through the 9997 doesn't receive any data and not all data are forwarded through 9996.
With tcpdump I see the right flow from the source to Heavy Forwarder (6514) , I see some data receveived from the indexer cluster on 9996 but no data where indexed on ads index and on other index.
So now I ask myself what should be wrong and if a forwarder can support two outputs.conf so configured.
Any help is appreciated and welcome
Fabrizio
... View more
09-24-2019
05:41 AM
Ok,
I've solved with a SED command as
https://answers.splunk.com/answers/564940/remove-fields-at-index-time-from-a-csv-file.html
But is there another way to solve it ?
... View more
