About smichalski

smichalski · ‎07-17-2024

My apologies for bringing that old topic up again, but it's the only one about the error message and I stumbled across it while investigating on the same issue (different app version, but not the latest, so it might be fixed). In summary, I could trace the problem back to local.meta, which listed a user as object owner whose Splunk account had been removed. Solution was to either re-assign the object to a valid user, or remove the owner entry (= assigns it to nobody).

smichalski · ‎11-13-2020

@sarit_s: You can set an offset; actually you have to when dealing with a very large result that breaches the internal limits. Maybe the following pages can help you on your usecase: https://community.splunk.com/t5/Developing-for-Splunk-Enterprise/Change-Default-limit-of-100-results-using-JAVA-SDK/m-p/102775/highlight/true#M999 https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches/searchresultsmodel/

smichalski · ‎11-13-2020

Hey guys, according to the Splunk documentation for compref_searchbar, the properties of the internal timerange created by the search bar are configurable via timerange_* (see URLs below) . However, when I try to set the dialogOptions property via timerange_dialogOptions (using the mypresetsettings example dictionary given in the documentation for compref_timerange), I get a JS exception within my SimpleXML dashboard: common.js:1114 Uncaught TypeError: str.replace is not a function at Object.replaceTokens (common.js:1114) at Object.computeValue (common.js:1114) at child._pullPropertyValue (common.js:1114) at child._setBinding (common.js:1114) at common.js:1114 at Function._.each._.forEach (common.js:1114) at child._updateBindingsForProperties (common.js:1114) at child.<anonymous> (common.js:1114) at triggerEvents (common.js:725) at child.trigger (common.js:725) at configure (dashboard.js:1178) at initialize (dashboard.js:1178) at Backbone.View (dashboard.js:669) at constructor (dashboard.js:1178) at child (dashboard.js:669) at _createTimeRange (dashboard.js:1178) The basic example given in the WebFramework documention works fine otherwise. But once I try to limit the time range picker, it fails. Can anybody tell my, what (or if) I'm doing wrong? I've been trying Splunk 8.0.5 and 8.1.0 in the last version of Google Chrome - same result. The script is 1:1 identical with the documentation, except the timerange_* properties set. I also tried defining it via the options and settings before rendering the search bar, but no visible effect. Probably, because porperties like dialogOptions or presets are only evaluated during the initialization phase, making subsequent changes useless. EDIT from the 17-NOV-2020: After further investigations, I believe this is a bug, eventually happening in method _updateBindingsForProperties(): For some reasons, Splunk wants to replace tokens in the TimeRangeView properties when created by the SearchBarView . But once the passed property is an object or array (e. g. try passing timerange_foo: {} or timerange_foo: [] ), str.replace() will fail. Unfortunately, I may not file a bug report - would have to task a customer for this. But is any developer reading here to confirm my observation? Dashboard: demo.xml <form script="demo.js"> <label>demo</label> <row> <panel> <html> <div id="mysearchbarview"></div> </html> <table> <search base="example-search"> <query>| search *</query> </search> </table> </panel> </row> </form> Script: demo.js require([ "splunkjs/mvc/searchmanager", "splunkjs/mvc/searchbarview", "splunkjs/mvc/simplexml/ready!" ], function(SearchManager, SearchBarView) { // Create the search manager var mysearch = new SearchManager({ id: "example-search", status_buckets: 300, required_field_list: "*", preview: true, cache: true, autostart: false, // Prevent the search from running automatically search: "index=_internal | head 500" }); // Create the searchbar var mysearchbar = new SearchBarView({ id: "example-searchbar", managerid: "example-search", timerange_earliest_time: "-24h@h", timerange_latest_time: "now", timerange_dialogOptions: { showPresets: false, showCustomRealTime: false, showCustomAdvanced:false }, el: $("#mysearchbarview") }).render(); // Listen for changes to the search query portion of the searchbar mysearchbar.on("change", function() { // Reset the search query (allows the search to run again, // even when the query is unchanged) mysearch.settings.unset("search"); // Update the search query mysearch.settings.set("search", mysearchbar.val()); // Run the search (because autostart=false) mysearch.startSearch(); }); // Listen for changes to the built-in timerange portion of the searchbar mysearchbar.timerange.on("change", function() { // Update the time range of the search mysearch.settings.set(mysearchbar.timerange.val()); // Run the search (because autostart=false) mysearch.startSearch(); }); }); https://docs.splunk.com/DocumentationStatic/WebFramework/1.5/compref_searchbar.html https://docs.splunk.com/DocumentationStatic/WebFramework/1.5/compref_timerange.html Thanks

smichalski · ‎01-30-2020

Sorry guys for bringing this old topic up, but as the main question remained kinda unexplained, I'd be glad to see it finally clarified. I've to deal with the same confusion about the values and it drives me crazy, as it makes thruput troubeshooting really annoying. I've got a Splunk 7.3.3 in front of me running for several hours with Metric events that are gathered within a 60s time interval: [...] kb=95143.5849609375, _tcp_Bps=2064499.2670550928, _tcp_KBps=2016.112565483489, _tcp_avg_thruput=2016.112565483489, _tcp_Kprocessed=95143.5849609375, _tcp_eps=2806.537391302746 [...] Latest docs (currently 8.01) still say what brian has quoted above: https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Aboutmetricslog#Tcpout_Connections_messages But no matter how I try to align _tcp_KBps and kb (bits or bytes), they don't fit: (95143 / 8 bit) / 60 sec ~ 198 95143 / 60 sec ~ 1586, which is still far away from the 2016 Funny to mention: _tcp_avg_thruput is identical to _tcp_KBps in my example, but should be measured in bytes(!) according to the documentation. Any idea, why these values don't line up and which one to trust?

smichalski · ‎07-17-2017

Dear Splunkers, I face logs, where special characters have been encoded into Unicode codepoints (e. g. \u0301 instead of é ). While Splunk is able to process and store such logdata in general, searching for it gave me some headache: Despite the raw events contain the encoded characters, Splunk decides to decode or convert the characters at some point, causing the search to return no results. For example: Within an eventsearch, I can search for the encoded string (here: \u0301 ) as part of a keyword or a value of the field _raw (the backslash must be escaped, understandably). But ... ... if checking the automatically extracted fields under "Interesting Fields", SplunkWeb displays the decoded string (here: é ). ... if searching for the encoded OR decoded string within an automatically extracted field, Splunk finds nothing. ... if placing an eval or where before, the decoded string becomes searchable. ... if performing an in-search field extraction, the encoded string becomes searchable. Personally I expected, that the automatically extracted field becomes decoded, while the _raw field stays encoded. I tested different charsets for indexing, but couldn't discover any differences. Therefore I wonder: What's the right way to deal with codepoints in Splunk? My current solution to make events searchable bases on defining a calculated field as itself, so that users can filter for the logdata just like they are used to in their eventsearches. It works, But I deem that more a workaround than an actual solution. Best regards, Sven Help for setting up a test scenario 1. Create a JSON sample file with the following content: (e. g. with CR LF + ANSI for Windows, or LF UTF-8 for Linux) { "description": "04 - Tempe\u0301rature de liquide", "timestamp": "1499871600" } 2. Upload sample file to Splunk ("Add data" menu in SplunkWeb) Use predefined sourcetype _json Use Charset UTF-8 or ISO-8859-1 , for example Use index main 3. Verify the result by checking the eventsearch index="main" sourcetype="_json" 4. Search for the description value by adding the snippets behind the square brackets to your eventsearch [Snippet Number: Returns Result Yes/No] [A: N] "*04 - Tempe\u0301rature*" [B: Y] "*04 - Tempe\\u0301rature*" [C: Y] _raw="*04 - Tempe\\u0301rature*" [D: N] description="04 - Tempe\\u0301rature*" [E: Y] | eval description=description | search description="04 - Température de liquide" [F: Y] | where like(description,"04 - Température de liquide") [G: Y] | rex "\"description\":\s\"(?<description>[^\"]+)\"" | search description="04 - Tempe\\u0301rature*" [H: N] | rex "\"description\":\s\"(?<description>[^\"]+)\"" | search description="04 - Température*"

smichalski · ‎10-28-2015

Oh, I hadn't seen your answer before sending my comment above. Thanks for providing some clarity!

smichalski · ‎10-28-2015

Hi frobinson_splunk, the query above is just an example to make reproduction of the issue easy 🙂 The actual issue we ran into after testing upgrading from Splunk 6.1.1 to 6.3.0 was the following: Imagine an (HTML) dashboard containing multiple postprocessing searches. The base searches deliver multidimensional longterm data (e. g. via | WHERE _time >= relative_time(now(),"-3mon@mon") AND _time < relative_time(now(),"-0mon@mon") | bucket _time span=1d | stats count by _time, country, service, return_code ), from which postprocessing searches draw their charts (e. g. | timechart span=1d sum(count) by service) ). Parallely, there are postprocessing searches which grab the base search's result to only display an overall value of the last month as a single value element (e. g. | WHERE service="foo" | WHERE _time >= relative_time(now(),"-1mon@mon") AND _time < relative_time(now(),"-0mon@mon") | timechart span=1mon sum(count) as count) ). That way, the result table for the single value will lead to a single row containing a _time column and a count column. In 6.1, this approach of limiting the time range worked fine. Since 6.3.0 (or 6.2, I cannot tell), it produces a SplunkJS exception when adding the numberPrecision option and changing its value to "0.00". The issue seems to be related to the _time column: When that column is removed (e. g. by | fields - _time ) or not passed on (e. g. by using | stats sum(count) as count ), the single value elements gets displayed. So yes, removing _time works as a solution 🙂 Though I still need getting used to that implementation. It's strange that you don't have to remove the _time column when leaving the numberPrecision to default ("0"). Another solution would be turning the result into a string ( index=_internal | timechart count | head 1 | eval count=round(count/1000000,2) . " Mio." ). But then the numberPrecision option has no effect of course ...

smichalski · ‎10-16-2015

Hi everybody, While checking our dashboards for migration to Splunk 6.3.0, I faced an issue with the redesigned single-value elements which truly base on a "single" value. Setting the numberPrecision option to another value than default (= 0) seems to cause a SplunkJS error that breaks the dashboard. For tracking down the issue, I ended up on using the "simple_single" dashboard from the dashboard examples v4.0. Within that dashboard, we find an example for a single-value element without decorations: <single> <title>No decorations</title> <search> <query>index=_internal | timechart count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showTrendIndicator">0</option> <option name="showSparkline">0</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <option name="linkView">search</option> <option name="drilldown">none</option> </single> If I just change numberPrecision to "0.00" the dashboard works fine. If I add an | head 1 to the search, the dashboard breaks. When changing to | head 2 and larger, the dashboard works again. Unfortunately, we designed most of our single value searches to return just one value, in order to avoid Splunk displaying the wrong one. Error messages of browsers: Chrome 46.0.2490.71 JS console: "Uncaught TypeError: Cannot read property 'length' of undefined" Firefox 41.0.2 JS console: "TypeError: C.split(...)[1] is undefined mvc.js:6:2048500" Am I configuring anything wrong or am I facing a bug here? Cheers, Sven

smichalski · ‎02-17-2015

Hi everybody, inside our Splunk 6.1 HTML dashboards, we use a custom CSS to increase the charts' font-size and JS to hide and display element-groups on user interaction. Basically, this does work. Unfortunately on charts that had been hidden at the initialization of the dashboard and displayed subsequently, larger legends get partially cut off or unreadably condensed. I assume that is because Splunk renders the Highcharts invisibly with some default values, so that a re-displayed chart gets spoiled when the browser applies the custom CSS belatedly. If you change the height of the chart manually by dragging its resize-bar, the chart gets re-rendered with the correct proportions and everything looks fine again. Is there a way to bin re-rendering/re-drawing/re-freshing of a single chart or all charts to something else, like clicking a link? So that re-rendering is triggered when the show/hide link is clicked. I experimented on something like the following (jQuery) which would work, but it ignores a defined height and sets the chart back to 250px default: $('a#mylink').on("click", function(event) { element1.render(); }); Any better ideas? Cheers, Sven

smichalski · ‎06-12-2014

Thanks again, alacercogitatus 🙂 I tried to use your code, but standing just at the beginning of JS programming, I don't know how to access the role-array outside of myResults. I searched through various tutorials and tried to solve this on my own, but couldn't find any solution. Basically, I'm looking for something like this: var roles = new Array; myResults.on("data", function() { _.each(myResults.data().rows, function(column, rowCount) { [...] roles.push(role); }); alert(roles[0]); }); alert(roles[0]); Currently, the second alert will return an "undefined" result. Any idea?

smichalski · ‎06-02-2014

Thanks alacercogitatus, this brings me one step closer. But how did you manage to pass the user role into an JS array or object? Passing a search-result to an array or object has been one of my unanswered questions for some time now ...

smichalski · ‎05-28-2014

Hi there, does anybody know how to retrieve the user role inside the JS section of an HTML dashboard? The goal behind this is to display different content inside a dashboard, depending on the user who is logged in to Splunk Web. I'm aware that it's possible to grab the current username via Splunk.util.getConfigValue("USERNAME");, but using the username instead of the role is beyond question. When searching the forum for an answer, I stumbled over references to the Splunk SDK, showing how to grab the userdata for an external script. But that's not what I'm looking for and using the SDK is not favored anyway. Any ideas? The solution needs to work on Splunk 6.0 and 6.1. Best regards, Sven

Posts	12
Solutions	0
Karma Given	3
Karma Received	8
Member Since	‎05-28-2014

Online Status	Offline
Date Last Visited	‎07-17-2024 03:22 AM

TimeRangeView properties in SearchBarView break co...

Best practice for dealing with Unicode codepoints ...

Why does a single single-value panel cause SplunkJ...

How to force re-rendering of chart elements in HTM...

Retrieving the user role in an HTML dashboard via ...

Re: Splunk DB Connect - Cannot Delete Data Lab -> ...

Re: paganation - query results from 1 to 100 , fro...