About Hoekb03

Hoekb03 · ‎07-11-2023

Hi all, I use splunk enterprise with the free license at home. This week I upgraded to version 9.1.0.1 and I was happy to see "search" is now available in dark mode as well. It can be set in the user preferences. But... the free license has just one user, and user preferences is not available for that user it seems. Is there a way to acivate dark mode for search with the free license? Bart.

Hoekb03 · ‎07-26-2022

It's not that highlighting stops after 20 lines, in my case there are comment lines after line 20, when I remove the line on 20 the rest works fine. Syntax auto fill also stops working in my example I just noted. I tried it at home where I use 9.0 with no problem at all. I'll just wait for a new version @ the office. I'll accept your answer for now.

Hoekb03 · ‎07-25-2022

My query doesn't do the trick btw, still curious about the cause of the highlighting not working.

Hoekb03 · ‎07-25-2022

Hi, I've created this rather complicated piece of SPL. To make it a bit more understandable I added some comment lines. In the screenshot you can see the SPL syntax highlighting stops working correctly from line #20. The strange thing is that when I remove line 20 all together it works fine, and there are more comment lines further on. Whatever comment I put on that position causes this behaviour. Line removed, it works fine: Comment ```test comment``` breaks the thing down again. It's just a minor cosmetic thing, but I'd like to know what's happening here and why. We're using splunk Enterprise 8.1.10.1 on my site. Any thoughts appreciated!

Hoekb03 · ‎12-18-2020

Great solution @sideview , I've been struggling with a split by concurrency problem a couple of days. The concurrency command works fine when I just search for events with a single value used fot the split, when I search for all events with all "split by values" the numbers aren't right. I found out myself why, and thought it would be impossible. Your spooky bit of SPL solves it nicely, and running it line by line looking at the results I understand why. Thanks! My not correctly working code: index=mfpublic sourcetype=SMF030 SMF30JNM=JOB* SMF30CLS=* | stats earliest(_time) as start latest(_time) as stop by SMF30JNM SMF30CLS | eval _time=start, duration=stop-start | concurrency duration=duration | timechart limit=20 span=15m max(concurrency) by SMF30CLS And the working code with your solution: index=mfpublic sourcetype=SMF030 SMF30JNM=JOB* SMF30CLS=* | stats earliest(_time) as start latest(_time) as stop by SMF30JNM SMF30CLS | eval _time=start, duration=stop-start | eval increment = mvappend("1","-1") | mvexpand increment | eval _time = if(increment==1, _time, _time + duration) | sort 0 + _time | fillnull class value="NULL" | streamstats sum(increment) as post_concurrency by SMF30CLS | eval concurrency = if(increment==-1, post_concurrency+1, post_concurrency) | timechart limit=0 span=15m max(concurrency) as max_concurrency last(post_concurrency) as last_concurrency by SMF30CLS | filldown last_concurrency* | foreach "max_concurrency: *" [eval <<MATCHSTR>>=coalesce('max_concurrency: <<MATCHSTR>>','last_concurrency: <<MATCHSTR>>')] | fields - last_concurrency* max_concurrency* Thanks again!

Hoekb03 · ‎09-30-2020

Hi, I'm trying to use https://skyvector.com in an iframe using this code. The $url$ token comes from another panel, it contains the skyvector url. <row rejects="$show_main$"> <panel> <html> <iframe src="$url$" width="1500" height="700">></iframe> </html> </panel> </row> The page shows in an iframe with this message: "If you can read this, enable javascript. It may also help to reload this page by pressing F5, Ctrl+R, Command+R or clearing your browser cache." When I right click the frame in Firefox and then "This Frame -> Show Only This Frame" or "Open Frame in New Tab" the page is shown correctly. As is the case in this iframe tester http://www.tinywebgallery.com/blog/advanced-iframe/free-iframe-checker I think it's an issue with allowing use of javascript in embedded pages, tried web.conf but can't find a setting for this. Any ideas? Bart.

Hoekb03 · ‎10-14-2018

Same issue here with a previous update. This seems to have fixed it. Thx!

Hoekb03 · ‎06-29-2018

I use a simple query to determine the amount of data I've sent to splunk: index=x |eval esize=len(_raw) |timechart sum(esize) span=1h This is pretty expensive when ran over long timeranges. I also tried this: |dbinspect index=x |eval date=strftime(startEpoch,"%F") |chart sum(rawSize) over date |rename sum(*) -> * The results are different, dbinspect reporting lower values than len(_raw). Any ideas on a cheap way to get the right results?

Hoekb03 · ‎12-23-2016

Had to use CDATA around the link to get the XML right but it works fine. Thanx!

Hoekb03 · ‎12-23-2016

Both answers are basically the same. The good news: it works! Thanks!

Hoekb03 · ‎12-22-2016

Hi, I have this timechart. I want to drill down to another search with a timerange starting 10 minutes before the moment in the timechart (which I can pass to the drilldown search as token using "$click.value$) and ending 5 minutes later. I tried to calculate the time in the search string of the drilldown as "earliest=timestamp-600, that does not work. Here is the table for the timechart. When clicking on the first element I want the drilldown from 14:20 until 14:35 2016-12-21 14:30:00 493.293571 800 567 2016-12-21 14:45:00 472.051973 800 560 2016-12-21 15:00:00 512.801327 800 552 2016-12-21 15:15:00 430.072523 800 537 2016-12-21 15:30:00 380.293680 800 523 2016-12-21 15:45:00 304.686207 800 510 2016-12-21 16:00:00 260.215492 800 492 2016-12-21 16:15:00 239.603977 800 468 The drilldown in the chart: <drilldown target="blank"> <link>workload_drilldown?timestamp=$click.value$</link> </drilldown> Timestamp is passed to the drilldown: workload_drilldown?timestamp=1482412500.000 In the target I can use the token like this: latest=$timestamp$ What I would like is something like this earliest=$timestamp$-600 latest=$timestamp$+300 Any ideas?

Posts	11
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎07-01-2016

Online Status	Offline
Date Last Visited	‎07-12-2023 03:33 AM

Splunk Enterprise free - user preferences

Why SPL syntax highlighting not working correctly?

Iframe url with javascript

len(_raw) vs |dbinspect rawSize

How to modify the timerange token in drilldown?

Splunk Enterprise free - user preferences

Re: SPL syntax highlighting not working correctly

Re: SPL syntax highlighting not working correctly

Why SPL syntax highlighting not working correctly?

Re: How to use the concurrency command to timechar...

Iframe url with javascript

Re: Why is the KV Store Process Failing After Upgr...

len(_raw) vs |dbinspect rawSize

Re: How to modify the timerange token in drilldown...

Re: How to modify the timerange token in drilldown...

How to modify the timerange token in drilldown?