Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ChrisChalmers01
ChrisChalmers01
Explorer
Member since:
07-18-2016
08-24-2021
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 9 |
| Karma Received | 0 |
| Member Since | 07-18-2016 |
Activity Feed
- Posted Re: Javascript Submit button not executing SPL search on Splunk Dev. 08-24-2021 02:13 AM
- Karma Re: Javascript Submit button not executing SPL search for alucarddjin. 08-24-2021 02:11 AM
- Posted Javascript Submit button not executing SPL search on Splunk Dev. 08-17-2021 08:22 AM
- Karma Re: What is the difference between metrics.log and license_usage.log ? for xpac. 06-05-2020 12:49 AM
- Karma Re: How to expand macros in a Splunk search? for hrottenberg_spl. 06-05-2020 12:48 AM
- Karma Why am I receiving "SOFTWARE PROGRAM ERROR" in Splunk universal forwarder that are AIX servers? for MousumiChowdhur. 06-05-2020 12:48 AM
- Karma Re: Tried to add a search peer: Error while sending public key to search peer: Connection closed by peer for Jarohnimo. 06-05-2020 12:48 AM
- Karma Re: Configuring "additional fields" for a notable event in Enterprise Security (ES) for jbrodsky_splunk. 06-05-2020 12:47 AM
- Karma Re: Configuring "additional fields" for a notable event in Enterprise Security (ES) for sheamus69. 06-05-2020 12:47 AM
- Karma Re: "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1 for sideview. 06-05-2020 12:46 AM
- Posted Re: Dashboard visibility issue on Dashboards & Visualizations. 01-12-2018 07:46 AM
- Posted Re: Replicating search head on Reporting. 12-30-2016 03:48 AM
- Posted DB Connect compatibility with Splunk Enterprise 6.5.1 on All Apps and Add-ons. 12-30-2016 03:35 AM
- Tagged DB Connect compatibility with Splunk Enterprise 6.5.1 on All Apps and Add-ons. 12-30-2016 03:35 AM
- Tagged DB Connect compatibility with Splunk Enterprise 6.5.1 on All Apps and Add-ons. 12-30-2016 03:35 AM
- Tagged DB Connect compatibility with Splunk Enterprise 6.5.1 on All Apps and Add-ons. 12-30-2016 03:35 AM
- Tagged DB Connect compatibility with Splunk Enterprise 6.5.1 on All Apps and Add-ons. 12-30-2016 03:35 AM
- Posted Re: Enterprise Security, Staging Servers and Splunk v6.4 on Splunk Enterprise Security. 07-21-2016 12:40 AM
- Posted Re: Enterprise Security, Staging Servers and Splunk v6.4 on Splunk Enterprise Security. 07-18-2016 05:21 AM
- Posted Enterprise Security, Staging Servers and Splunk v6.4 on Splunk Enterprise Security. 07-18-2016 05:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-24-2021
02:13 AM
I managed to solve the issue - it was actually an SPL problem as appose to JS. The Query had a mistake in it! Once I fixed this the issue disappeared. Thank you for the input @alucarddjin !
... View more
08-17-2021
08:22 AM
I am trying to create a dashboard that contains a textbox. When a ticket reference is given to the textbox and a user clicks submit, a search is run in the background that appends the ticket information to a kvstore. This is my dashboard - <form script="run_action.js">
<label>QA Manual Submission</label>
<description>A dashboard that allows for the manual submission of QA Samples.</description>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="text" token="tokRef" searchWhenChanged="true">
<label>Ticket Reference</label>
<default>[Letter][number]_SOC</default>
<initialValue>[Letter][number]_SOC</initialValue>
</input>
<html>
<p>Click "Add to QA" to manually add the ticket number to the QA App</p>
<button class="btn btn-primary button1">Add to QA</button>
</html>
</panel>
</row>
</form> This is javascript I am using - require([
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/textinputview",
"splunkjs/mvc/simplexml/ready!"
],function(
mvc,
$,
SearchManager,
TableView,
TextInputView
) {
//debug testing
console.log("I get this far!");
//Add after some research on Splunk Anwsers. Since removed.
//var SearchManager = require("splunkjs/mvc");
//var SearchManager = require("splunkjs/mvc/searchmanager");
//var TextInputView = require("splunkjs/mvc/textinputview");
//var TableView = require("splunkjs/mvc/tableview");
//var $ = require("jquery");
var mysearch = new SearchManager({
id: "mysearch",
autostart: "false",
search: mvc.tokenSafe("| jira jqlsearch \"project IN projectMatch(\\\".+_SOC.+\\\") AND assignee was in(membersOf(\"GG_JIRA_Filter\")) AND status=Closed AND created >= startOfMonth()\" fields \"project,summary,status,resolution,resolutiondate,updated,created,issuetype,assignee\" \r\n| table Summary, Key, \"Issue Type\", Resolution, Assignee, Resolved, Created, \"QA Commentary\", \"QA By\", \"Perceived Ticket Quality\", \"QA Pass\/Fail\"\r\n| rename Key as Ticket_Ref, \"Issue Type\" As Issue_Type\r\n| rex field=Resolved \"(?<date>\\d{4}\\-\\d{2}\\-\\d{2})T(?<time>\\d{2}:\\d{2}:\\d{2})\" \r\n| eval extracted_time=date+\" \"+time \r\n| eval Resolved=strptime(extracted_time,\"%Y-%m-%d %H:%M:%S\") \r\n| eval Resolved=round(Resolved,0) \r\n| rex field=Created \"(?<created_date>\\d{4}\\-\\d{2}\\-\\d{2})T(?<created_time>\\d{2}:\\d{2}:\\d{2})\" \r\n| eval created_extracted_time=created_date+\" \"+created_time \r\n| eval Created=strptime(created_extracted_time,\"%Y-%m-%d %H:%M:%S\") \r\n| eval Created=round(Created,0)\r\n| table Ticket_Ref, Summary, \"Issue_Type\", Resolution, Assignee, Resolved, Created, \"QA Commentary\", \"QA By\", \"Perceived Ticket Quality\", \"QA Pass\/Fail\", \"Manual QA Add\"\r\n| eval \"Manual QAA dd\"=\"True\"\r\n| search Ticket_Ref=$tokRef$\r\n| outputlookup qa_lookup append=True")
});
$(".button1").on("click", function (){
var ok = confirm("Are you sure?");
if (ok){
mysearch.startSearch();
alert('attempted restart!');
} //else {
// alert('user did not click ok!');
//}
});
}); When I try to run the dashboard I get the following errors on the console - Limited knowledge of JS and I've done my best to follow guidance on splunk anwsers. Would appreciate any insight. Many thanks Christopher
... View more
01-12-2018
07:46 AM
You mention that you changed the permissions for the dashboard but did also change the permissions for the reports / searches that power the dashboard?
... View more
12-30-2016
03:48 AM
You should be able to view this from settings > Searches, reports, and alerts from the GUI. Select the App Context and Owner. If you are unsure of this context or owner just sleect "All" and "any" for owner. If you still can't see your saved searches this could suggest an issue with permissions possibly.
savedsearches.conf can be found within each app. For example, if I had saved searches within the 'search' app context I could find them under $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf.
Hope this helps.
... View more
12-30-2016
03:35 AM
We're looking to upgrade our instances of Splunk to 6.5.1. As part of the upgrade we are checking currnet app compatibillty with 6.5.1. We use DB Connect version 2.3.0 as part of our enviroment. On Splunkbase our version isn't listed anymore. The closest version is 2.3.1 which supports 6.5.1.
Can anyone verify if DB Connect 2.3.0 is capable of running with Splunk 6.5.1?
Thanks
... View more
07-21-2016
12:40 AM
Hi esix, thanks for your reply. Using the Deployer to push the apps to the SHC is fine. I was more hoping from the link attatched we no longer had to use a staging server before pushing the apps from the Deployer.
Using a staging server in such a large environment becomes tedious. Would you be able to confirm the following?
Is Staging Server required for every-time installation/update of Addons? (i.e. if we need to enable a new data collection of TA_Unix, does it have to be published in Staging Server and then pushed to deployer?)
Is there a way to determine which “configuration item” require Staging Server as mandatory? (or every single update needs to follow Staging Server -> deployer model)
... View more
07-18-2016
05:21 AM
Sorry - I don't have enough Karma to post links in my questions. This may work - vhttp://docs.splunk.com/Documentation/ES/4.1.1/Install/InstallTechnologyAdd-ons
... View more
07-18-2016
05:18 AM
Currently looking to upgrade from Splunk 6.3.1 to Splunk 6.4. We run a multi-sited Clustered environment with Enterprise Security 4.0.
Before upgrading I'd like to know if we are still required to stage our apps on a staging server before they are deployed to our Search head Cluster?
Information listed in "Installing a Technology Add-ons" under the heading "Distributing add-ons in a search head cluster with Splunk Enterprise 6.4" suggest we may not have to do this anymore.
Is anyone able to verify or have I misinterpreted this?
Thanks in Advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-24-2021
10:19 AM
|
Karma given to
