About fabrizioalleva

fabrizioalleva · ‎06-17-2022

Solved. by myself I've to set TIME_PREFIX in props.conf to instruct that the timestamp is the second field and not the first. It's nice to note that the problem there is now that I've some object that has the ID similiar to a UNIX TIMESTAMP. Closed

fabrizioalleva · ‎06-17-2022

Hi all, I'm working on a deploy with Universal Forwader, Heavy Forwarder and Indexer Cluster and Search Cluster. The problem is this: I'm indexing data from different csv since long time. For the first time yesterday I realized that not all the raw of my csv files are indexed at all. For example: In a csv I count 24k rows and when I perform a stats count on the index I see only 16/17k rows. Each file rotates every minutes. In the log there's anything that leads to an error. In the UNIVERSAL FORWARDE I've this in inputs.conf [batch:///var/opt/OV/shared/perfSpi/datafiles/metric/final/F5_ResurcesGroup*] disabled = 0 index = f5_metrics sourcetype = f5_metrics initCrcLength = 100000 move_policy = sinkhole In the HEAVY FORWARDER: props.conf [f5_metrics] INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER=1 HEADER_FIELD_DELIMITER =, FIELD_DELIMITER=, HEADER_FIELD_LINE_NUMBER = 0 SEDCMD-dropheader = s/^"Node.+//g SEDCMD-select_fields = s/([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*)/\1,\2,\4,\5,\9,\17,\18/g #SEDCMD-select_fields = s/([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*)/\1,\4,\5,\9,\17,\18/g TRANSFORMS-f5_fields_name_extract=f5_fields_name_extract and in the transform.conf [f5_fields_name_extract] REGEX=([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*) FORMAT=NodeID::$1 TimeStamp::$2 period_length::$3 ltmVirtualServStatClientCurConns::$4 ltmVirtualServStatVsUsageRatio1m::$5 DisplayAttribute::$6 PollingInterval::$7 #FORMAT=NodeID::$1 period_length::$2 ltmVirtualServStatClientCurConns::$3 ltmVirtualServStatVsUsageRatio1m::$4 DisplayAttribute::$5 PollingInterval::$6 WRITE_META = true Any suggestion ? Thanks Fabrizio

fabrizioalleva · ‎03-19-2021

Hi all, I'm looking for a method to put some icons into a table ( 4 or 5 foreach row), which are clickable and open different link ( one syslog, one cmdb infos, one performance and other). I've tried some solution like : https://community.splunk.com/t5/Splunk-Search/How-do-you-add-buttons-on-table-view/m-p/384712#M112364 but it's not what I'm looking for. I succeded in putting only label so somenthing like this: and the click on each link is working fine, so instead of the label I want to put an icon. Thanks in advance for any response Fabrizio

fabrizioalleva · ‎01-05-2021

Hi all, I've succeeded in enabling the button "Create New Dashboard" only for the admin user. But if I want to enable it for all the users in admin Roles? I'm trying to work with roles:this.collection.roles this.roles.id = /services/authentication/Roles/admin but nothing.. any suggestions ? Thanks Fabrizio

fabrizioalleva · ‎11-02-2020

Thanks a lot

fabrizioalleva · ‎10-30-2020

Hi all, I'm trying to populate a dropdown with dynamic values according the value coming from another dropdown, like unit measure for example: if the dropdown A contains Fruits the B will contain (1000 gr, 100 hg, 1 kG ) instead if the A cointains Liquid B will cointains (1000 ml. 100 cl. ) where 1000/100/1 will be Field For Value and gr hg and KG will be field for Label. I'm trying something like this : | makeresults | eval type="fruits" | eval unit=case(type=="fruits","1000 gr, 100 hg, 1 kg", type=="liquid","1000 ml, 100 cl", 1=1, "no vlaue") | rex field=unit "(?<A>.*)\,(?<B>.*)" | fields A B But I'm not be able to parameterize the two or three values in the fields to make the split.. Thanks

fabrizioalleva · ‎04-22-2020

Hi all, I've succeeded in making a table with custom_table_row_expansion,js which expand every rows publishing the child events of a correlated father. Now I'm tryingto apply table_cell_highlighting to colour the child new event with a color for the dalay. I've combined table_cell_highlighting.js in the dashboard. In the custom_table_row_expansion.js I set the id of the new table highlight, I made a style css inside the dashboard in the hidden panel: <panel depends="$alwaysHideCSS$"> <html> <style> .table>thead>tr>th { color: #0066ff !important; text-shadow: none; font-family : Verdana !important; } .table>thead>tr>th:hover { /*background-image: linear-gradient(to bottom, #666, #444) !important;*/ color: #000000 !important; text-shadow: none; } .table .sorts a { text-decoration: none; font-weight: bold; font-size: 12px ; color: #002966; } .table>tbody>tr { width: 20%; color: #006699; font-family : Verdana !important; } td{ font-size: 11px !important; font-family : Verdana !important; } #highlight tr.range-elevated td { background-color: #000000 !important; color: #ffffff; } #highlight tr.range-severe td { background-color: #ff0000 !important; color: #ffffff; } #highlight .table td { border-top: 1px solid #fff; } #highlight td.range-severe, td.range-elevated { font-weight: bold; } </style> </html> </panel> and the javascript is this one: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row Coloring by String Comparision of Numeric Time Value in HH:MM:SS var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for DELAY field return _(['DELAY']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = cell.value; // Apply interpretation for DELAY field if (cell.field === 'DELAY') { if (value >= "02:00:00") { $td.addClass('range-cell').addClass('range-severe'); } if (value < "02:00:00" && value > "01:30:00") { $td.addClass('range-cell').addClass('range-elevated'); } } // Update the cell content with string DELAY value HH:MM:SS $td.text(value).addClass('string'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); }); // Add custom cell renderer, the table will re-render automatically. tableView.addCellRenderer(new CustomRangeRenderer()); }); }); But nothing happened when I expand the rows. Any suggestion ? Fabrizio

fabrizioalleva · ‎04-16-2020

Hi all, starting from a csv which contains 10 items, I want to count ( in order to produce a chart ) all the matches in the index and all the matches where a specific fields is equal to 1 . So two values for each item ( the first all matches and seconds all the matches where another field = 1 ) If no matches were found the value for csv items should be 0. I hope it's clear I try to do it whitout csv, but if an item has no matches in the index that item is not shown in the chart ) Thanks Fabrizio

fabrizioalleva · ‎04-15-2020

Ok this works fine ! Thanks a lot! How can I accept this as ansswer ??

fabrizioalleva · ‎04-15-2020

It doesn't work in the dropdown the default value is not 15 ( today ) is always $day$. It seems that Splunk doesn't accept the first query which pass the today value in the token. The porpouse is to load a dropdown with the list of days, and by default to show the today value. Thanks

fabrizioalleva · ‎04-15-2020

Hello, I'm trying from an initial search to put the value into a token to use it as a default initial value for a dropdown list something like this: <form script="table_with_buttons.js"> <search> <query> | makeresults | eval day=strftime(now(), "%d") | fields day </query> <done> <set token="day">$result.day$</set> </done> </search> <init> <set token="start_day">$day$</set> </init> <row> <panel> <title>Data Inizio</title> <input type="dropdown" token="start_day"> <label>Giorno $start_day$</label> <fieldForLabel>giorno</fieldForLabel> <fieldForValue>giornoid</fieldForValue> <search> <query>|inputlookup day.csv| table dayid day</query> </search> <choice value="$start_day$">$start_day$</choice> <default>$start_day$</default> </input> </panel> </row> <form> at runtime what I obtain is shown in the picture : Any Suggestion ? Thanks Fabrizio

fabrizioalleva · ‎03-16-2020

Opsssss. I've tried this but I dont wait for the result to come back!!!!!! Now I've tried and I wait and the results came back I'm sorry!!!!!!!!

fabrizioalleva · ‎03-16-2020

Hi all, is there a way to pass to a report the filename of a csv as variable, to use it as lookup file ? Example: | savedesearch my_report file=my_file.csv where my_report | some search | lookup $file$

fabrizioalleva · ‎01-27-2020

Hi, in the last days I've succeded in establishing the right comunication between HF and IDX. So now when i bring up the port 9996 all the other forwarding still work fine. Only the one which runs on 6514 (hf) ---> 9996 (idx_cl ) give me those messagges in metrics.log: 01-27-2020 14:41:26.012 +0100 INFO Metrics - group=tcpin_connections, a.b.c.d:40386:6514, connectionType=rawSSL, sourcePort=40386, sourceHost=a.b.c.d, sourceIp=a.b.c.d, destPort=6514, kb=0, _tcp_Bps=0, _tcp_KBps=0, _tcp_avg_thruput=0, _tcp_Kprocessed=0, _tcp_eps=0, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0 Any suggestion? Thanks

fabrizioalleva · ‎01-22-2020

I've tried even this way, but after the deployment, was alway the same. In all the NO-SSL app's input.conf I put _TCP_ROUTING = default-autolb-group and in the SSL one : _TCP_ROUTING=splunkindexer-ssl but it is always the same.

Posts	23
Solutions	2
Karma Given	0
Karma Received	0
Member Since	‎04-18-2019

Online Status	Offline
Date Last Visited	‎04-13-2023 08:56 AM

Splunk doesn't index csv at all

Clickable icon on table

dashboards.js enabling Create New Dashboard only f...

Dynamically load a dropdown from a value chosen f...

Combining custom_table_row_expansion.js and table_...

Looping in csv items to count how many values ma...

Setting token for a dropdwn with a search and init

Same report but different lookup file

Forwarder SSL and NO-SSL Forwarding

Select only some fields from csv to index

Re: Splunk doesn't index csv at all