Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About tomaszwrona
tomaszwrona
Explorer
Member since:
02-27-2015
09-22-2026
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 02-27-2015 |
Activity Feed
- Karma Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass for elizabethl_splu. 05-10-2026 05:39 AM
- Got Karma for Re: When using two lookups in a single search, I'm unable to value from the second lookup. How do I do that?. 09-23-2021 09:37 AM
- Posted Re: SVG Custom visualization - drilldown or setting a token on Dashboards & Visualizations. 02-16-2021 10:11 AM
- Posted SVG Custom visualization - drilldown or setting a token on Dashboards & Visualizations. 02-16-2021 06:59 AM
- Karma Re: How to add a field being a sum of previous rows? for Richfez. 06-05-2020 12:48 AM
- Got Karma for Re: How to calculate only specific fields. 06-05-2020 12:48 AM
- Karma Re: How do I find the time difference between these two events? for somesoni2. 06-05-2020 12:47 AM
- Posted Re: Limit access to parts of indexes on Security. 11-15-2019 12:56 PM
- Posted Data model calculated field with max_match on Reporting. 05-23-2019 05:56 AM
- Tagged Data model calculated field with max_match on Reporting. 05-23-2019 05:56 AM
- Posted Re: I need help parsing my json events on Getting Data In. 05-23-2019 05:38 AM
- Posted Re: I need help parsing my json events on Getting Data In. 05-17-2019 12:31 PM
- Posted Re: Is it possible to use max_match inside a datamodel rex definition? on Splunk Search. 05-17-2019 11:44 AM
- Posted Re: Why is the single value visualization's "underLabel" option not able to be localized? on Dashboards & Visualizations. 06-19-2018 06:19 AM
- Posted Re: App locale/internationalization does not work on Dashboards & Visualizations. 05-17-2018 02:29 AM
- Posted App locale/internationalization does not work on Dashboards & Visualizations. 05-16-2018 11:12 PM
- Tagged App locale/internationalization does not work on Dashboards & Visualizations. 05-16-2018 11:12 PM
- Tagged App locale/internationalization does not work on Dashboards & Visualizations. 05-16-2018 11:12 PM
- Posted Re: When using two lookups in a single search, I'm unable to value from the second lookup. How do I do that? on Splunk Search. 03-14-2018 04:56 AM
- Posted Re: How to show values only for data overlay in a chart? on Dashboards & Visualizations. 02-06-2018 10:35 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-16-2021
10:11 AM
Hi all, i did manage to answer my own question. In order to use tokens in SVG Visualization following steps should be taken: Extend Simple XML Dashboard with Javascript Put an id on Splunk's default element, for example panel: <panel id="svgViz"> Put an id on any SVG element you want to click on, for example g: <g id="myId" filter="url(#Shadow)"> In Javascript get the panel: var my_panel = $("#svgViz"); And then create onClick function to set myNewToken: my_panel.on("click", "#myId", function(e) { var default_tokens = mvc.Components.get("submitted"); default_tokens.set("myNewToken", "value"); }); Best regards Tomasz
... View more
02-16-2021
06:59 AM
Hi all, i have used the SVG Custom Visualisation to create a nice picture. Now i would like to have a drilldown or at least a possibility to set a token, when a part of the picture is clicked on. Is there a way to achieve this? Any hint would be great. Best regards Tomasz
... View more
11-15-2019
12:56 PM
Hi Jens,
with the new Splunk 8 you can define a role which gives you partial access to an index.
I mean you can build a role which is based on a given index and then restict the access based on fields of your choosing (sourcetype, host, ...)
Best regards
Tomasz
... View more
05-23-2019
05:56 AM
Hello,
i would like to create a calculated field within a data model with following expression:
rex field=_raw (?.*) max_match=0
But how to tell the data model to consider the max_match expression, as it cannot be used in a calculated field?
I have already tried to edit the data model file, replacing 'mutlivalue':'false' with 'mutlivalue':'true' but after that it was still single value field.
Best regards
Tomasz
... View more
05-23-2019
05:38 AM
hi,
yes, just rename the _time to something else, as _time is splunk default name for timestamp
... View more
05-17-2019
12:31 PM
Hi,
just replace "_time" field with a different name - i used "time" instead and could import the data with splunk's default _json sourcetype.
Best regards
Tomasz
... View more
05-17-2019
11:44 AM
Hi,
i have tried this approach, changed multivalve to true and restarted Splunk. Sadly it didn't work in 7.2.6.
Is there something different? How else can I put into data model regular expression fields with max_match=0?
Best regards
Tomasz
... View more
06-19-2018
06:19 AM
Hi,
if you are still interested in solving this try something like this:
define a token within dashboard with:
Last hour
replace option value with that token:
$last_hour_tok$
enhance your dashboard with a Javascript:
change token value in tokenInternational.js:
require([
'jquery',
'underscore',
'splunk.i18n',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function ($, , i18n, mvc) {
var defaultTokens = mvc.Components.getInstance("default"); // get token model
var lastHour = defaultTokens.get("last_hour_tok"); // get the value of last_hour_tok
lastHour = lastHour.replace("Last hour", i18n.("Last hour")); // replace text "Last hour" with msgstr for msgid "Last hour"
defaultTokens.set("last_hour_tok", lastHour); // set token value
});
Hope this helps.
Best regards
Tomasz
... View more
05-17-2018
02:29 AM
hey @desspashri_123,
yes, sure i did like Splunk says - this configuration comes from messages.pot insinde my app.
It translates all other string but not the one with $token$ inside.
I'm just sure how to workaorund it.
... View more
05-16-2018
11:12 PM
Hello,
in my XML Dashboard i have following line of code:
<title>text1: $token1$ text2: $token2$</title>
and in my messages.pot i have following line:
#: /opt/splunk/etc/apps/myapp/local/data/ui/views/myviewxml:359
msgid "text1: $token1$ text2: $token2$"
msgstr "translation1: $token1$ translation2: $token2$"
but when i switch the language this title does not get translated.
Where is the problem?
best regards
Tomasz
... View more
03-14-2018
04:56 AM
1 Karma
Hi,
let's say you have two lookups:
- answers.csv
answers_duration
5
10
20
answers2.csv
answers2_duration
2
3
5
then to calculate the value youwould do this:
| inputlookup answers.csv | appendcols [| inputlookup answers2.csv] | eval duration=answers_duration-answers2_duration
Best regards
Tomasz
... View more
02-06-2018
10:35 PM
Hi,
try this option within your XML:
<option name="charting.data.fieldHideList">["Error","Warn"]</option>
Best regards
Tomasz
... View more
05-01-2017
11:52 PM
1 Karma
for my purpose this is the best way - thank you!
... View more
04-28-2017
04:24 AM
Hello,
from my raw data:
TIME A B
2017-04-26 13:00:00 10
2017-04-26 13:10:00 10
2017-04-26 13:20:00 10
2017-04-26 13:30:00 10
2017-04-26 13:40:00 10
2017-04-26 13:50:00 10
2017-04-26 14:00:00 10
2017-04-26 14:10:00 10
2017-04-26 14:20:00 10
2017-04-26 14:30:00 10
2017-04-26 14:40:00 10
2017-04-26 14:50:00 10
2017-04-26 15:00:00 10
2017-04-26 15:10:00 10
2017-04-26 15:20:00 10
2017-04-26 15:30:00 10
2017-04-26 15:40:00 10
2017-04-26 15:50:00 10
2017-04-26 16:00:00 10
2017-04-26 16:10:00 10
i would like to achieve following output:
TIME A B Asum Bsum
2017-04-26 13:00:00 10 10
2017-04-26 13:10:00 10
2017-04-26 13:20:00 10 20
2017-04-26 13:30:00 10
2017-04-26 13:40:00 10
2017-04-26 13:50:00 10
2017-04-26 14:00:00 10
2017-04-26 14:10:00 10
2017-04-26 14:20:00 10 60
2017-04-26 14:30:00 10
2017-04-26 14:40:00 10 20
2017-04-26 14:50:00 10
2017-04-26 15:00:00 10
2017-04-26 15:10:00 10
2017-04-26 15:20:00 10
2017-04-26 15:30:00 10
2017-04-26 15:40:00 10
2017-04-26 15:50:00 10
2017-04-26 16:00:00 10
2017-04-26 16:10:00 10 90
How can it be done?
Best regards
Tomasz
... View more
02-24-2017
05:09 AM
sure, i just need to get a list of open ticket currently being assigned to one of my groups
... View more
02-24-2017
04:18 AM
Hello,
i have a data from ticketing system where events looks (more or less for the simplicity) like this:
date, ticketNumber, status, group
and for every change in the ticket a new Splunk event is generated, eg:
24.02.2017 09:50,0001,Assigned,G1
24.02.2017 10:00,0001,In progress,G1
24.02.2017 11:00,0001,Closed,G6
24.02.2017 11:30,0002,In Progress,G2
24.02.2017 11:45,0003,Pending,G3
24.02.2017 12:00,0003,Resolved,G3
Now i want to know which tickets are open (status assigned, pending or in progress) for my groups (G1-G5)
What i'm expecting to get is:
0002,In Progress,G2
But my search:
index=tickets group="G1" OR group="G2" OR group="G3" OR group="G4" OR group="G5" | dedup ticketNumber | search status="Assigned" OR status="Pending" OR status="In Progress"
does not see the closures of ticket done by other groups and i am getting:
0001,In progress,G1
0002,In Progress,G2
How should i modify the search to meet my expectations?
I need somehow to filter the tickets before any calculation as there are lot of tickets and many groups. And also the groups which are closing tickets belonging to our groups are not defined, so it could be G6-GXX.
... View more
09-27-2016
01:38 AM
Hello,
given the events i have to import in Splunk, i would like to extract the fields.
My problem occurs with the FUNCTION entry which can be there once, twice or not at all.
event1:
SERVER myserver1
HOST localhost
ERROR_CODE
event2:
SERVER myserver2
FUNCTION f1
FUNCTION f2
FUNCTION f3
HOST localhost
event3:
SERVER myserver3
FUNCTION f1
HOST localhost
event4:
SERVER myserver4
FUNCTION f1
FUNCTION f2
HOST localhost
ERROR_CODE
Expected result after transformation should be
event1:
server="myserver1";function="";host="localhost";error_code=""
event2:
server="myserver2";function="f1,f2,f3";host="localhost";error_code=""
event3:
server="myserver3";function="f1";host="localhost";error_code=""
event4:
server="myserver4";function="f1,f2";host="localhost";error_code=""
My last attempt was this:
(?sm)SERVER\s(?<server>[A-Za-z0-9]+)(.*?)(FUNCTION\s*(?<function>[A-Za-z0-9]*))+(.*?)HOST\s*(?<host>[A-Za-z0-9]+)(.*?)ERROR_CODE\s*(?<error_code>[A-Z0-9]*)
but i always get only first occurrence of FUNCTION and not all of them.
Best regards
Tomasz
... View more
06-13-2016
04:59 AM
hi,
this is exactly what i wanted to achieve - thank you!
... View more
06-13-2016
04:22 AM
Hello,
i am looking to solve following problem.
How to calculate the fields summary_worked and summary_requested?
month hours_worked summary_worked hours_requested summary_requested
april 160 160 (hours worked for april) 160 160 (hours_requested for april)
may 160 320 (hours worked for april+may) 128 288 (hours_requested for april+may)
june 160 480 (hours worked for april+may+june) 188 476 (hours_requested for april+may+june)
Cheers
Tomasz
... View more
- Tags:
- calculation
- rows
06-06-2016
12:46 AM
hi saikatr,
i'm facing the same problem. Did you by any chance found a solution for this?
cheers
tomasz
... View more
06-02-2016
11:37 PM
Hello,
I have installed Splunk DB Connect 2 on a heavy forwarder and the queries with Oracle DB are working fine.
My question is, however, how can I see something in the Health Dashboard?
The health log is written permanently, but the searches in dashboard show no data. I have checked the local indexes and they are empty.
How can I visualize the health data for the Splunk DB Connect app?
Best regards
Tomasz
... View more
01-19-2016
10:27 PM
Perfect, thank you!
... View more
01-19-2016
06:22 AM
Hello,
I have following events:
event 1:
product_category=dvd
product_name="the martian"
event=to_basket
event_time=2016-01-18T19:57:21+0100
...
event2:
product_category=dvd
product_name="the martian"
event=sold
event_time=2016-01-18T20:15:21+0100
...
How can I tell the time difference between 'to_basket' and 'sold' based on product_category and product_name?
... View more
