Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About denzelchung
denzelchung
Path Finder
Member since:
05-20-2019
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 4 |
| Karma Given | 8 |
| Karma Received | 5 |
| Member Since | 05-20-2019 |
Activity Feed
- Karma Re: Dashboard with same search but different visualization panel for somesoni2. 06-05-2020 12:50 AM
- Karma Re: Using token in query where token is evaluated in the query itself for VatsalJagani. 06-05-2020 12:50 AM
- Karma Re: How to display dashboard when all searches done loading? for harshpatel. 06-05-2020 12:50 AM
- Karma Re: Can you use Splunk universal forwarder to forward data to Splunk Enterprise ran locally? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Which inputs.conf are the inputs stored in when added by web interface for FrankVl. 06-05-2020 12:50 AM
- Got Karma for Re: Daily/Weekly/Monthly Span on CSV dATA. 06-05-2020 12:50 AM
- Got Karma for Re: Daily/Weekly/Monthly Span on CSV dATA. 06-05-2020 12:50 AM
- Got Karma for Re: Using token in query where token is evaluated in the query itself. 06-05-2020 12:50 AM
- Got Karma for Re: Where do we add a stylesheet (.css) or javascript (.js) file to Splunk Cloud?. 06-05-2020 12:50 AM
- Got Karma for Re: How to I monitor a dropdown input for changes using Javascript?. 06-05-2020 12:50 AM
- Karma Re: How to remove a token name when the token has no value? for bgennerm. 06-05-2020 12:49 AM
- Karma Re: Get full join result of two logs for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: If Statment or Nested If for Ayn. 06-05-2020 12:45 AM
- Posted Re: Where do we add a stylesheet (.css) or javascript (.js) file to Splunk Cloud? on Dashboards & Visualizations. 07-18-2019 08:11 PM
- Posted Re: Daily/Weekly/Monthly Span on CSV dATA on Splunk Search. 07-15-2019 08:49 PM
- Posted Re: Daily/Weekly/Monthly Span on CSV dATA on Splunk Search. 07-15-2019 08:20 PM
- Posted Re: Daily/Weekly/Monthly Span on CSV dATA on Splunk Search. 07-15-2019 07:56 PM
- Posted How to use HTML templates for code modification in Django or other tool options? on Splunk Dev. 07-03-2019 02:28 AM
- Tagged How to use HTML templates for code modification in Django or other tool options? on Splunk Dev. 07-03-2019 02:28 AM
- Posted Re: Which inputs.conf are the inputs stored in when added by web interface on Getting Data In. 06-26-2019 07:34 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-18-2019
08:11 PM
1 Karma
Try this
Launcher app -> Settings (gear icon) -> Look for the app you're using the CSS and JS files for, press Edit Properties -> Upload Asset
... View more
07-15-2019
08:49 PM
1 Karma
Currently we're using "span=1w", which is 1 week from today. If we run the same search tomorrow, it would probably start on Friday for you.
To start from the start of the week, use "1w@w". The additional "@w" would snap the time to the beginning of the week. Take a look at https://answers.splunk.com/answers/5350/possible-to-redefine-w-to-start-on-different-day.html for more details.
You can also specify which day you want to start on (e.g. w0 = Sunday, w1 = Monday, etc.)
... View more
07-15-2019
08:20 PM
1 Karma
What is XXX? You can filter formattedDate to the past 1 week, then replace _time since timechart span relies on _time.
| where formattedDate > relative_time(now(), "-1w")
| eval _time=formattedDate
| timechart count span=7d
... View more
07-15-2019
07:56 PM
You will need to convert your CSV data's date into epoch format first in order to filter by 1 week ago.
The following example takes in a date (e.g. today, 16/07/2019), format it using strptime, then filter the date within now and 1 week ago.
source=*
| eval date="16/07/2019"
| eval formattedDate=strptime(date, "%d/%m/%Y")
| where formattedDate > relative_time(now(), "-1w@w")
| table date formattedDate
... View more
07-03-2019
02:28 AM
I have several HTML pages that have some parts in common and I would like to use HTML templates to make it easier for code modification. However, the Django bindings page says that Django is deprecated (http://dev.splunk.com/view/webframework-djangobindings/SP-CAAAEM6). What other options do I have?
... View more
Labels
- Labels:
-
app
06-26-2019
07:34 PM
Found it! I did not have admin rights to the local folder in the apps directory and so it didn't show up when I used the btool command.
... View more
06-26-2019
05:57 PM
I ran the btool command and it printed out inputs from every inputs.conf file but I do not see the one I added.
Under the web interface, I see it listed under Settings > Data Inputs > Files & Directories
... View more
06-26-2019
02:00 AM
I know that we can manually add data inputs through the inputs.conf file.
I added a file monitoring input via the web interface and wanted to see how it is written in the inputs.conf file. However, I opened the inputs.conf files and could not find any lines related to the file that I am monitoring. Which file is this input stored in?
... View more
06-25-2019
06:56 AM
Sorry if it is unclear. The Universal Forwarder is going to be installed on a different server and it is forwarding data to my laptop as a proof of concept.
... View more
06-25-2019
02:33 AM
How are you creating and saving these csv files?
... View more
06-25-2019
02:10 AM
I am trying to get an Universal Forwarder installed on a server to forward some logs data to my Splunk Enterprise that is running on localhost (not hosted on any server).
Is this possible?
If I forward the data from the Universal Forwarder to my host's IP address and enable receiving, will it work?
... View more
06-24-2019
08:01 PM
You might want to try the accepted answer in this post: https://answers.splunk.com/answers/432261/is-there-a-way-to-rename-csv-column-headers-prior.html
... View more
06-24-2019
07:33 PM
You can add the following line at the end of your search:
| appendpipe [stats count | where count=0 | eval Loss=0 | fields - count]
... View more
06-24-2019
02:27 AM
1 Karma
One way is to use @DavidHourani's method, which is to use a token.
If you want to do it using JavaScript, do it this way https://stackoverflow.com/questions/2402707/how-to-get-all-child-inputs-of-a-div-element-jquery
$('#input :input.button').on("change", function(e) {
console.log("Input value has changed!");
});
This will get all input elements in the #input div, which is what you want to retrieve.
... View more
06-18-2019
10:57 PM
Am I right to say that you're suggesting the following method:
<search id="master">
...
<done>
<eval token="lastUpdated">strftime(now(),"%d/%m/%Y, %I:%M %p")</eval>
</done>
</search>
<search base="master" id="firstApp">
<query>
...
| eval done=if($token1$=true and $token2$=true and ..., 1, 0)
</query>
<done>
<set token="app_A">$result.App$</set>
<set token="status_A">$result.Status$</set>
<set token="token1">true</set>
</done>
</search>
...
<search base="master" id="lastApp">
<query>
...
| eval done=if($token1$=true and $token2$=true and ..., 1, 0)
</query>
<done>
<set token="app_Z">$result.App$</set>
<set token="status_Z">$result.Status$</set>
<set token="token26">true</set>
</done>
</search>
... View more
06-18-2019
09:05 PM
I have a base query in my dashboard with multiple other queries that make use of the base query.
In my base query, I have the following evaluation when the search is done.
<search id="master">
...
<done>
<eval token="lastUpdated">strftime(now(),"%d/%m/%Y, %I:%M %p")</eval>
</done>
</search>
<search base="master" id="firstApp">
...
<done>
<set token="app_A">$result.App$</set>
<set token="status_A">$result.Status$</set>
</done>
</search>
...
<search base="master" id="lastApp">
...
<done>
<set token="app_Z">$result.App$</set>
<set token="status_Z">$result.Status$</set>
<set token="done">true</set>
</done>
</search>
In the last search, I set a token called "done" to be true. It currently works, but I am not sure if the searches will be run in order. Even if they run in order, is it guaranteed that the searches will finish evaluating in order and that all my tokens (app_A, ..., app_Z, status_A, ..., status_Z) are properly set?
I want to have a token to indicate that all searches are done. How can I do so?
I want this token so that in my JavaScript, I can do the following:
tokens.on("change:done", function(model, value) {
updateDisplay(tokens);
});
... View more
06-11-2019
11:51 PM
Do the lookup first, then use join to combine your search results with the base lookup values.
For example,
| inputlookup host.csv | join type=left host [metadata type=hosts]
Doing an individual "| metadata type=hosts" search would give me host "A" and "B". In my csv file, I have "A", "B", "C", "D". Doing the above query would give me everything in my lookup file.
... View more
06-04-2019
01:28 AM
1 Karma
Thank you! This is exactly that I'm looking for! I couldn't figure out how to do it.
... View more
06-03-2019
05:56 PM
Hi @niketnilay, I am trying to evaluate sender to be a fixed string. I have over 10 of these strings and I want 10 different individual visualization.
I don't think Trellis Layout fits my case as they cannot be split by sourcetype, host, etc.
... View more
06-02-2019
07:22 PM
I have the following query to be performed, where "STRING" is replaced across different queries. Is there a way to replace the STRING with a token and make it such that only 1 query is performed?
host="$host$" "STRING" | sort -_time | head 1 | eval time = _time
| eval sender = "STRING"
| table sender time
...
host="$host$" "STRING2" | sort -_time | head 1 | eval time = _time
| eval sender = "STRING2"
| table sender time
...
host="$host$" "STRING3" | sort -_time | head 1 | eval time = _time
| eval sender = "STRING3"
| table sender time
...
Simplify to be something like this where $sender$ is set to a dynamic value, but the following doesn't work.
<query id="masterQuery">
host="$host$" "$sender$" | sort -_time | head 1 | eval time = _time
| table sender time
</query>
...
<query base="masterQuery"> | eval sender = "xx" </query>
<query base="masterQuery"> | eval sender = "yy" </query>
... View more
05-30-2019
07:57 PM
I am trying to sync up 2 panels that uses the same search but shows different visualization (e.g. bar chart and pie chart). It will auto refresh every 30 seconds and I want both panels to refresh at the same time.
One possible solution is to do a dashboard refresh instead of a panel refresh. However, I have many panels in this dashboard and it will take up significant time and memory to finish loading every panel if it is all refreshed at once.
Is there any other solution to sync up both panels' refresh time?
... View more
05-28-2019
11:17 PM
I used the cell renderer method and it also faces the same problem.
var CustomCellRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for the time field
return _(['time']).contains(cell.field);
},
render: function($td, cell) {
var value = cell.value;
if (value == "0") {
$td.addClass('range-cell').addClass("range-down");
}
else {
$td.addClass('range-cell').addClass("range-ok");
}
$td.text(value);
}
});
... View more
05-28-2019
02:35 AM
I have a dashboard with 1 table and the following code works. It adds a CSS class to the tag as expected.
However, if I add more tables on the same dashboard, the code works on certain refreshes and not on others. I tried playing around with the timeout value and didn't manage to find a solution. With 1-3 tables in the dashboard, it works on the times I tried, but 4 or more tables will cause an erratic behavior.
mvc.Components.get('table1').getVisualization(function(tableView) {
setTimeout(function() {
tableView.on('rendered', function() {
// Populate dictionary with values from table
var tableRows = tableView.$el.find('tbody').children();
$.each(tableRows, function(index, row) {
var children = $(row).children();
var key = children.eq(0).text();
var value = $.trim(children.eq(1).text());
if (value == "0") {
$(row).addClass("range-down");
}
else {
$(row).addClass("range-ok");
}
});
// Update table display
tableView.render();
})
}, 100);
});
... View more
05-21-2019
06:33 PM
Fixed it.
Instead of using a cell renderer, I did the updating in the tableView.on('rendered') function.
In there, after updating affected table values to "PARTIALLY DOWN", I added a class to the tag.
// update css - classToAdd is a variable defined elsewhere with a value set
valueTd.addClass(classToAdd).addClass("icon-inline");
// update text
valueTd.html(_.template(' <i></i>', {
icon: icon,
text: dict[key]
}));
... View more
05-20-2019
09:02 PM
Ok, I removed the cell renderer and moved the updating into the tableView.on('rendered') function and it works.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
