Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About smichalski
smichalski
Explorer
Member since:
05-28-2014
04-15-2025
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 8 |
| Member Since | 05-28-2014 |
Activity Feed
- Posted Re: Splunk DB Connect - Cannot Delete Data Lab -> inputs on Splunk Enterprise. 07-17-2024 03:06 AM
- Posted Re: paganation - query results from 1 to 100 , from 100 to 200 etc on Splunk Dev. 11-13-2020 01:17 PM
- Posted TimeRangeView properties in SearchBarView break common.js - Bug? on Splunk Dev. 11-13-2020 12:36 PM
- Tagged TimeRangeView properties in SearchBarView break common.js - Bug? on Splunk Dev. 11-13-2020 12:36 PM
- Tagged TimeRangeView properties in SearchBarView break common.js - Bug? on Splunk Dev. 11-13-2020 12:36 PM
- Got Karma for Best practice for dealing with Unicode codepoints in Splunk ?. 06-05-2020 12:48 AM
- Got Karma for Best practice for dealing with Unicode codepoints in Splunk ?. 06-05-2020 12:48 AM
- Got Karma for Best practice for dealing with Unicode codepoints in Splunk ?. 06-05-2020 12:48 AM
- Got Karma for How to force re-rendering of chart elements in HTML dashboards?. 06-05-2020 12:47 AM
- Got Karma for How to force re-rendering of chart elements in HTML dashboards?. 06-05-2020 12:47 AM
- Got Karma for How to force re-rendering of chart elements in HTML dashboards?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does a single single-value panel cause SplunkJS exception "Cannot read properly 'length' of undefined" in Splunk 6.3.0. 06-05-2020 12:47 AM
- Got Karma for Re: Why does a single single-value panel cause SplunkJS exception "Cannot read properly 'length' of undefined" in Splunk 6.3.0. 06-05-2020 12:47 AM
- Karma Re: Retrieving the user role in an HTML dashboard via JS for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Retrieving the user role in an HTML dashboard via JS for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Retrieving the user role in an HTML dashboard via JS for Rocket66. 06-05-2020 12:46 AM
- Posted Re: Why doesn't the kb and tcp_KBps numbers line up? on Dashboards & Visualizations. 01-30-2020 11:39 AM
- Posted Best practice for dealing with Unicode codepoints in Splunk ? on Splunk Search. 07-17-2017 08:05 AM
- Tagged Best practice for dealing with Unicode codepoints in Splunk ? on Splunk Search. 07-17-2017 08:05 AM
- Tagged Best practice for dealing with Unicode codepoints in Splunk ? on Splunk Search. 07-17-2017 08:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 0 | |||
| 3 | |||
| 0 |
07-17-2024
03:06 AM
My apologies for bringing that old topic up again, but it's the only one about the error message and I stumbled across it while investigating on the same issue (different app version, but not the latest, so it might be fixed). In summary, I could trace the problem back to local.meta, which listed a user as object owner whose Splunk account had been removed. Solution was to either re-assign the object to a valid user, or remove the owner entry (= assigns it to nobody).
... View more
11-13-2020
01:17 PM
@sarit_s: You can set an offset; actually you have to when dealing with a very large result that breaches the internal limits. Maybe the following pages can help you on your usecase: https://community.splunk.com/t5/Developing-for-Splunk-Enterprise/Change-Default-limit-of-100-results-using-JAVA-SDK/m-p/102775/highlight/true#M999 https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches/searchresultsmodel/
... View more
11-13-2020
12:36 PM
Hey guys, according to the Splunk documentation for compref_searchbar, the properties of the internal timerange created by the search bar are configurable via timerange_* (see URLs below) . However, when I try to set the dialogOptions property via timerange_dialogOptions (using the mypresetsettings example dictionary given in the documentation for compref_timerange), I get a JS exception within my SimpleXML dashboard: common.js:1114 Uncaught TypeError: str.replace is not a function
at Object.replaceTokens (common.js:1114)
at Object.computeValue (common.js:1114)
at child._pullPropertyValue (common.js:1114)
at child._setBinding (common.js:1114)
at common.js:1114
at Function._.each._.forEach (common.js:1114)
at child._updateBindingsForProperties (common.js:1114)
at child.<anonymous> (common.js:1114)
at triggerEvents (common.js:725)
at child.trigger (common.js:725)
at configure (dashboard.js:1178)
at initialize (dashboard.js:1178)
at Backbone.View (dashboard.js:669)
at constructor (dashboard.js:1178)
at child (dashboard.js:669)
at _createTimeRange (dashboard.js:1178) The basic example given in the WebFramework documention works fine otherwise. But once I try to limit the time range picker, it fails. Can anybody tell my, what (or if) I'm doing wrong? I've been trying Splunk 8.0.5 and 8.1.0 in the last version of Google Chrome - same result. The script is 1:1 identical with the documentation, except the timerange_* properties set. I also tried defining it via the options and settings before rendering the search bar, but no visible effect. Probably, because porperties like dialogOptions or presets are only evaluated during the initialization phase, making subsequent changes useless. EDIT from the 17-NOV-2020: After further investigations, I believe this is a bug, eventually happening in method _updateBindingsForProperties(): For some reasons, Splunk wants to replace tokens in the TimeRangeView properties when created by the SearchBarView . But once the passed property is an object or array (e. g. try passing timerange_foo: {} or timerange_foo: [] ), str.replace() will fail. Unfortunately, I may not file a bug report - would have to task a customer for this. But is any developer reading here to confirm my observation? Dashboard: demo.xml <form script="demo.js">
<label>demo</label>
<row>
<panel>
<html>
<div id="mysearchbarview"></div>
</html>
<table>
<search base="example-search">
<query>| search *</query>
</search>
</table>
</panel>
</row>
</form> Script: demo.js require([
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/searchbarview",
"splunkjs/mvc/simplexml/ready!"
], function(SearchManager, SearchBarView) {
// Create the search manager
var mysearch = new SearchManager({
id: "example-search",
status_buckets: 300,
required_field_list: "*",
preview: true,
cache: true,
autostart: false, // Prevent the search from running automatically
search: "index=_internal | head 500"
});
// Create the searchbar
var mysearchbar = new SearchBarView({
id: "example-searchbar",
managerid: "example-search",
timerange_earliest_time: "-24h@h",
timerange_latest_time: "now",
timerange_dialogOptions: {
showPresets: false,
showCustomRealTime: false,
showCustomAdvanced:false
},
el: $("#mysearchbarview")
}).render();
// Listen for changes to the search query portion of the searchbar
mysearchbar.on("change", function() {
// Reset the search query (allows the search to run again,
// even when the query is unchanged)
mysearch.settings.unset("search");
// Update the search query
mysearch.settings.set("search", mysearchbar.val());
// Run the search (because autostart=false)
mysearch.startSearch();
});
// Listen for changes to the built-in timerange portion of the searchbar
mysearchbar.timerange.on("change", function() {
// Update the time range of the search
mysearch.settings.set(mysearchbar.timerange.val());
// Run the search (because autostart=false)
mysearch.startSearch();
});
}); https://docs.splunk.com/DocumentationStatic/WebFramework/1.5/compref_searchbar.html https://docs.splunk.com/DocumentationStatic/WebFramework/1.5/compref_timerange.html Thanks
... View more
Labels
- Labels:
-
simple XML
-
Splunk Web Framework
-
SplunkJS
01-30-2020
11:39 AM
Sorry guys for bringing this old topic up, but as the main question remained kinda unexplained, I'd be glad to see it finally clarified. I've to deal with the same confusion about the values and it drives me crazy, as it makes thruput troubeshooting really annoying. I've got a Splunk 7.3.3 in front of me running for several hours with Metric events that are gathered within a 60s time interval:
[...] kb=95143.5849609375, _tcp_Bps=2064499.2670550928, _tcp_KBps=2016.112565483489, _tcp_avg_thruput=2016.112565483489, _tcp_Kprocessed=95143.5849609375, _tcp_eps=2806.537391302746 [...]
Latest docs (currently 8.01) still say what brian has quoted above:
https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Aboutmetricslog#Tcpout_Connections_messages
But no matter how I try to align _tcp_KBps and kb (bits or bytes), they don't fit:
(95143 / 8 bit) / 60 sec ~ 198
95143 / 60 sec ~ 1586, which is still far away from the 2016
Funny to mention: _tcp_avg_thruput is identical to _tcp_KBps in my example, but should be measured in bytes(!) according to the documentation.
Any idea, why these values don't line up and which one to trust?
... View more
07-17-2017
08:05 AM
3 Karma
Dear Splunkers,
I face logs, where special characters have been encoded into Unicode codepoints (e. g. \u0301 instead of é ). While Splunk is able to process and store such logdata in general, searching for it gave me some headache:
Despite the raw events contain the encoded characters, Splunk decides to decode or convert the characters at some point, causing the search to return no results. For example: Within an eventsearch, I can search for the encoded string (here: \u0301 ) as part of a keyword or a value of the field _raw (the backslash must be escaped, understandably). But ...
... if checking the automatically extracted fields under "Interesting Fields", SplunkWeb displays the decoded string (here: é ).
... if searching for the encoded OR decoded string within an automatically extracted field, Splunk finds nothing.
... if placing an eval or where before, the decoded string becomes searchable.
... if performing an in-search field extraction, the encoded string becomes searchable.
Personally I expected, that the automatically extracted field becomes decoded, while the _raw field stays encoded. I tested different charsets for indexing, but couldn't discover any differences. Therefore I wonder: What's the right way to deal with codepoints in Splunk?
My current solution to make events searchable bases on defining a calculated field as itself, so that users can filter for the logdata just like they are used to in their eventsearches. It works, But I deem that more a workaround than an actual solution.
Best regards, Sven
Help for setting up a test scenario
1. Create a JSON sample file with the following content:
(e. g. with CR LF + ANSI for Windows, or LF UTF-8 for Linux)
{
"description": "04 - Tempe\u0301rature de liquide",
"timestamp": "1499871600"
}
2. Upload sample file to Splunk ("Add data" menu in SplunkWeb)
Use predefined sourcetype _json
Use Charset UTF-8 or ISO-8859-1 , for example
Use index main
3. Verify the result by checking the eventsearch
index="main" sourcetype="_json"
4. Search for the description value by adding the snippets behind the square brackets to your eventsearch
[Snippet Number: Returns Result Yes/No]
[A: N] "*04 - Tempe\u0301rature*"
[B: Y] "*04 - Tempe\\u0301rature*"
[C: Y] _raw="*04 - Tempe\\u0301rature*"
[D: N] description="04 - Tempe\\u0301rature*"
[E: Y] | eval description=description | search description="04 - Température de liquide"
[F: Y] | where like(description,"04 - Température de liquide")
[G: Y] | rex "\"description\":\s\"(?<description>[^\"]+)\"" | search description="04 - Tempe\\u0301rature*"
[H: N] | rex "\"description\":\s\"(?<description>[^\"]+)\"" | search description="04 - Température*"
... View more
10-28-2015
01:52 PM
1 Karma
Oh, I hadn't seen your answer before sending my comment above. Thanks for providing some clarity!
... View more
10-28-2015
01:46 PM
1 Karma
Hi frobinson_splunk, the query above is just an example to make reproduction of the issue easy 🙂 The actual issue we ran into after testing upgrading from Splunk 6.1.1 to 6.3.0 was the following:
Imagine an (HTML) dashboard containing multiple postprocessing searches. The base searches deliver multidimensional longterm data (e. g. via | WHERE _time >= relative_time(now(),"-3mon@mon") AND _time < relative_time(now(),"-0mon@mon") | bucket _time span=1d | stats count by _time, country, service, return_code ), from which postprocessing searches draw their charts (e. g. | timechart span=1d sum(count) by service) ). Parallely, there are postprocessing searches which grab the base search's result to only display an overall value of the last month as a single value element (e. g. | WHERE service="foo" | WHERE _time >= relative_time(now(),"-1mon@mon") AND _time < relative_time(now(),"-0mon@mon") | timechart span=1mon sum(count) as count) ). That way, the result table for the single value will lead to a single row containing a _time column and a count column.
In 6.1, this approach of limiting the time range worked fine. Since 6.3.0 (or 6.2, I cannot tell), it produces a SplunkJS exception when adding the numberPrecision option and changing its value to "0.00". The issue seems to be related to the _time column: When that column is removed (e. g. by | fields - _time ) or not passed on (e. g. by using | stats sum(count) as count ), the single value elements gets displayed. So yes, removing _time works as a solution 🙂 Though I still need getting used to that implementation. It's strange that you don't have to remove the _time column when leaving the numberPrecision to default ("0").
Another solution would be turning the result into a string ( index=_internal | timechart count | head 1 | eval count=round(count/1000000,2) . " Mio." ). But then the numberPrecision option has no effect of course ...
... View more
10-16-2015
11:33 PM
Hi everybody,
While checking our dashboards for migration to Splunk 6.3.0, I faced an issue with the redesigned single-value elements which truly base on a "single" value. Setting the numberPrecision option to another value than default (= 0) seems to cause a SplunkJS error that breaks the dashboard.
For tracking down the issue, I ended up on using the "simple_single" dashboard from the dashboard examples v4.0. Within that dashboard, we find an example for a single-value element without decorations:
<single>
<title>No decorations</title>
<search>
<query>index=_internal | timechart count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showTrendIndicator">0</option>
<option name="showSparkline">0</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="drilldown">none</option>
</single>
If I just change numberPrecision to "0.00" the dashboard works fine. If I add an | head 1 to the search, the dashboard breaks. When changing to | head 2 and larger, the dashboard works again. Unfortunately, we designed most of our single value searches to return just one value, in order to avoid Splunk displaying the wrong one.
Error messages of browsers:
Chrome 46.0.2490.71 JS console: "Uncaught TypeError: Cannot read property 'length' of undefined"
Firefox 41.0.2 JS console: "TypeError: C.split(...)[1] is undefined mvc.js:6:2048500"
Am I configuring anything wrong or am I facing a bug here?
Cheers, Sven
... View more
02-17-2015
05:58 AM
3 Karma
Hi everybody,
inside our Splunk 6.1 HTML dashboards, we use a custom CSS to increase the charts' font-size and JS to hide and display element-groups on user interaction. Basically, this does work. Unfortunately on charts that had been hidden at the initialization of the dashboard and displayed subsequently, larger legends get partially cut off or unreadably condensed.
I assume that is because Splunk renders the Highcharts invisibly with some default values, so that a re-displayed chart gets spoiled when the browser applies the custom CSS belatedly. If you change the height of the chart manually by dragging its resize-bar, the chart gets re-rendered with the correct proportions and everything looks fine again. Is there a way to bin re-rendering/re-drawing/re-freshing of a single chart or all charts to something else, like clicking a link? So that re-rendering is triggered when the show/hide link is clicked.
I experimented on something like the following (jQuery) which would work, but it ignores a defined height and sets the chart back to 250px default:
$('a#mylink').on("click", function(event) {
element1.render();
});
Any better ideas?
Cheers, Sven
... View more
06-12-2014
05:07 AM
Thanks again, alacercogitatus 🙂 I tried to use your code, but standing just at the beginning of JS programming, I don't know how to access the role-array outside of myResults. I searched through various tutorials and tried to solve this on my own, but couldn't find any solution. Basically, I'm looking for something like this:
var roles = new Array;
myResults.on("data", function() {
_.each(myResults.data().rows, function(column, rowCount) {
[...]
roles.push(role);
});
alert(roles[0]);
});
alert(roles[0]);
Currently, the second alert will return an "undefined" result. Any idea?
... View more
06-02-2014
04:36 AM
Thanks alacercogitatus, this brings me one step closer. But how did you manage to pass the user role into an JS array or object? Passing a search-result to an array or object has been one of my unanswered questions for some time now ...
... View more
05-28-2014
01:26 AM
Hi there,
does anybody know how to retrieve the user role inside the JS section of an HTML dashboard? The goal behind this is to display different content inside a dashboard, depending on the user who is logged in to Splunk Web.
I'm aware that it's possible to grab the current username via Splunk.util.getConfigValue("USERNAME");, but using the username instead of the role is beyond question. When searching the forum for an answer, I stumbled over references to the Splunk SDK, showing how to grab the userdata for an external script. But that's not what I'm looking for and using the SDK is not favored anyway. Any ideas? The solution needs to work on Splunk 6.0 and 6.1.
Best regards, Sven
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-15-2025
11:00 AM
|
