About nagar57

nagar57 · ‎01-06-2023

Also., I see that this job failure is getting captured in _internal logs. Don't know why rest command is not able to capture it.

nagar57 · ‎12-28-2022

I am using Splunk 8.0.8. I have python versions 2.7 and 3.7 installed in $Splunk_Home/bin folder but all my python scripts are getting executed with python 2.7. I even tried changing python.version=python3 in server.conf under ./etc/system/local but still scripts are running using python 2.7. I even tried python.version=forced_python3 in server.conf but no luck. Can someone please let me know where I need to change python version so that all my scripts starts using python3.7. ?

adele9210 · ‎06-30-2022

Hi, I've got same problem. Did you find a solution to this? Thanks in advance

richgalloway · ‎05-06-2022

The user must be a local account. You cannot use a SAML or LDAP account. It must be the account name and password configured when the UF was installed.

gcusello · ‎09-06-2021

Hi @nagar57, in my test dashboard, also without Submit button, my search doesn't start without values: Please try to open another dashboard and run your dashboard: As I said, first time I open the dahboard the search doesn't start, if I insert a value, it starts. If you have the same situation, it's possible to insert an in put to reset tokes: <input type="radio" token="resetTokens" searchWhenChanged="true"> <label></label> <choice value="reset">Reset Inputs</choice> <choice value="retain">Retain</choice> <default>retain</default> <change> <condition value="reset"> <unset token="your_token"></unset> <set token="resetTokens">retain</set> </condition> </change> </input> Ciao. Giuseppe

TheFlash · ‎04-14-2021

If you want dynamic columns then I think you have to write a JS script where you have to define a function which will read your number of column and add box accordingly.

nagar57 · ‎04-06-2021

@niketn I am also looking for the same functionality in simple XML. Did you try this solution in simple XML? Table dataset is not helping here.

ITWhisperer · ‎02-08-2021

Yes, removing _raw and _time as well. The important step is the selecting of recalib_stats field after the rex which removes the bulk of the other fields - the special fields beginning with an underscore have to be remove individually.

rteja9 · ‎01-12-2021

@niketn Thanks for the wonderful code snippet. It works good for me. But the token is updating on change of date. But I want to see token update only on submit button click. Can you please help on this?

nagar57 · ‎11-09-2020

@t183194 Did you get the solution for this problem? I am facing the exact same problem with table row expansion having data scattered over different pages.

nagar57 · ‎11-09-2020

I am rendering a table for each row of a table. But the table is not getting scrolled to other pages. On first reload of the dashboard the "Next" page option is working but when collapsing other rows this option stops working. Here is my java script I am using: require([ 'splunkjs/mvc/tableview', 'splunkjs/mvc/chartview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'underscore', 'splunkjs/mvc/simplexml/ready!'],function( TableView, ChartView, SearchManager, mvc, _ ){ var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({ initialize: function(args) { // initialize will run once, so we will set up a search and a chart to be reused. this._searchManager = new SearchManager({ id: 'details-search-manager', preview: false }); this._TableView = new TableView({ managerid: 'details-search-manager' }); }, canRender: function(rowData) { // Since more than one row expansion renderer can be registered we let each decide if they can handle that // data // Here we will always handle it. return true; }, render: function($container, rowData) { // rowData contains information about the row that is expanded. We can see the cells, fields, and values // We will find the sourcetype cell to use its value var run_date_cell = _(rowData.cells).find(function (cell) { return cell.field === 'runDate'; }); var job_stage_cell = _(rowData.cells).find(function (cell) { return cell.field === 'jobStage'; }); var job_sub_stage_cell = _(rowData.cells).find(function (cell) { return cell.field === 'jobSubStage'; }); var model_desc_cell = _(rowData.cells).find(function (cell) { return cell.field === 'modelDescription'; }); var channel_cell = _(rowData.cells).find(function (cell) { return cell.field === 'channel'; }); var job_status_cell = _(rowData.cells).find(function (cell) { return cell.field === 'jobStatus'; }); //update the search with the sourcetype that we are interested in //this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count'}); this._searchManager.set({ search: 'index = abc sourcetype = xyz source="/test/test.log" NOT "training stats" AND NOT "testing stats" | dedup runDate,jobStage,jobSubStage,channel,modelDescription,logMessage | search runDate="'+run_date_cell.value+'" jobStage="'+job_stage_cell.value+'" modelDescription="'+model_desc_cell.value+'" channel="'+channel_cell.value+'" jobSubStage="'+job_sub_stage_cell.value+'" | dedup _time,logMessage | sort _time | table _time,logMessage'}); // $container is the jquery object where we can put out content. // In this case we will render our chart and add it to the $container $container.append(this._TableView.render().el); } }); var tableElement = mvc.Components.getInstance("job_status"); tableElement.getVisualization(function(tableView) { // Add custom cell renderer, the table will re-render automatically. tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer()); }); });

jbjerke_splunk · ‎10-12-2020

The best option is to use the pre-defined configuration tags for the form or dashboard element. <form hideTitle="true"> You can read about all options which includes hideExport, hideAppBar here: https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#dashboard_or_form

niketn · ‎09-14-2020

@nagar57 This is because Highcharts tries to adjust Dynamically based height (even width) of the chart and amount of data label to show on the axis. In your case you have Legends on top and X-axis label on the bottom Both reduce the height of the chart. On top of this if you reduce panel height using Simple XML height option then also you will see lesser Data Labels on y-axis. Refer to the following two examples through a run anywhere dashboard example and you will realize the issue and fix. Following is the Simple XML code for run anywhere example screenshot above. PS: First chart is also using seriesCompare for legend on right. <dashboard> <label>Series with Percent</label> <row> <panel> <chart> <search> <query>| makeresults count=30 | eval span=300 | accum span | eval _time=_time-span | fields - span | eval series1=substr(tostring(random()),1,2), series2=substr(tostring(random()),1,2), series3=substr(tostring(random()),1,2) | bin _time span=5min | stats last(*) as * by _time</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisLabelsY.majorUnit">25</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">seriesCompare</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> <row> <panel> <chart> <search> <query>| makeresults count=30 | eval span=300 | accum span | eval _time=_time-span | fields - span | eval series1=substr(tostring(random()),1,2), series2=substr(tostring(random()),1,2), series3=substr(tostring(random()),1,2) | bin _time span=5min | stats last(*) as * by _time</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisLabelsY.majorUnit">25</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">top</option> <option name="charting.lineWidth">2</option> <option name="height">194</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </dashboard>

yeahnah · ‎09-11-2020

Hi @nagar57 You can use spath path=Address to extract the Address values. Here's a run anywhere example using your source example data ... | makeresults `comment("# generate dummy data ")` | eval _raw="{ \"Name\": \"Naman\", \"Age\":25, \"Address\": {\"H.No\":\"23\", \"Street_no\":2, \"Area\":\"Model Town\"}, \"Country\":\"IND\" }" | spath input=_raw `comment("# use the following to extract Address; you should not need to specify input=_raw")` | spath input=_raw path=Address | rex mode=sed field=Address "s/[\}\{ ]//g" | fields Name Age Address Country | stats values(*) AS * BY Name | table Name Age Address Country Please mark the post as solved if this helps. Note: you could also swap the rex command with this eval statement, if you prefer... | eval Address=replace(Address, "[\}\{ ]", "")

nagar57 · ‎09-11-2020

I can't paste the raw JSON as it contains company data. I hope you get the idea what I am trying to achieve. JSON is dynamic and I just want to parse at 1st level. All the nested fields should come as it is without getting parsed.

niketn · ‎06-26-2020

Glad you got it working, do upvote the answers if they helped!

niketn · ‎06-21-2020

@nagar57 One of the reasons why we build minimalistic run anywhere example, is to demo the art of the possible and leave it to the Splunker to build upon the examples to complete full fledged code (including coding best practices like modularity, separation of concerns, reusability, extensions, commenting, coding convention, authorization, authentication, optimization, plugin and most importantly security). Hope you understand that building end solutions for each request would be painstaking and infeasible process for handful of active community members who have community assistance as their passion beyond regular working hours. So, expectation is you try, fail and learn continuously. If you hit a dead-end let us know what you tried and where it got stuck! Trust me this approach will give you more delight, confidence and knowledge every time you crack the code yourself rather than going after quick help or clues. Hopefully, you will be able to contribute more to the community through Answers, Blogs, User Groups etc every time you develop something that has not been solved before. So better luck with your "trials and errors" and we would sure be providing support when you get stuck! 👍 And this one time, let me give the approach to Add HTML Date Input to set the tokens directly from Simple XML and one time generic JavaScript. The approach requires you to Provide unique id to each html date input. JS runs a generic date input change event handler and sets the id of date input as token to be used in Simple XML. PS: token is String date in YYYY-MM-dd format as that is the value returned (even set) from the Date input. Simple XML init section to initialize string and epoch time for Date input and corresponding token for the first time. Independent search to convert set string date to epoch date. PS: I have used four Date Input for testing, you would notice that JS has only one iterator for each html input type of "date", which sets the token for all 4 inputs. Following is the updated Simple XML required for above approach: <dashboard script="html_input_date_control.js"> <label>HTML Date Picker</label> <init>    <eval token="threeDaysAgoDateYYYYMMDD">strftime(relative_time(now(),"-3d@d"),"%Y-%m-%d")</eval> <eval token="twoDaysAgoDateYYYYMMDD">strftime(relative_time(now(),"-2d@d"),"%Y-%m-%d")</eval> <eval token="previousDateYYYYMMDD">strftime(relative_time(now(),"-1d@d"),"%Y-%m-%d")</eval> <eval token="currentDateYYYYMMDD">strftime(relative_time(now(),"-0d@d"),"%Y-%m-%d")</eval>  <eval token="htmlDateInputFrom1">strftime(relative_time(now(),"-3d@d"),"%Y-%m-%d")</eval> <eval token="htmlDateInputTo1">strftime(relative_time(now(),"-2d@d"),"%Y-%m-%d")</eval>  <eval token="htmlDateInputFrom2">strftime(relative_time(now(),"-1d@d"),"%Y-%m-%d")</eval> <eval token="htmlDateInputTo2">strftime(relative_time(now(),"-0d@d"),"%Y-%m-%d")</eval> </init>  <search> <query>| makeresults | eval earliestTime1=strptime("$htmlDateInputFrom1$","%Y-%m-%d") | eval latestTime1=strptime("$htmlDateInputTo1$","%Y-%m-%d") | eval earliestTime2=strptime("$htmlDateInputFrom2$","%Y-%m-%d") | eval latestTime2=strptime("$htmlDateInputTo2$","%Y-%m-%d")</query> <earliest>-1s@s</earliest> <latest>now</latest> <done> <set token="tokEarliestTime1">$result.earliestTime1$</set> <set token="tokLatestTime1">$result.latestTime1$</set> <set token="tokEarliestTime2">$result.earliestTime2$</set> <set token="tokLatestTime2">$result.latestTime2$</set> </done> </search> <row> <panel> <html> <style> .dateContainer{ display:flex; } .dateInput{ padding-right:15px; } </style> <div>Selected String Time - $htmlDateInputFrom1$ - $htmlDateInputTo1$ </div> <div class="dateContainer"> <div class="dateInput"> <div>From Date 1:</div> <input id="htmlDateInputFrom1" type="date" value="$threeDaysAgoDateYYYYMMDD$"/> </div> <div class="dateInput"> <div>To Date 2:</div> <input id="htmlDateInputTo1" type="date" value="$twoDaysAgoDateYYYYMMDD$"/> </div> </div> </html> </panel> <panel> <html> <div>Selected String Time - $htmlDateInputFrom2$ - $htmlDateInputTo2$ </div> <div class="dateContainer"> <div class="dateInput"> <div>From Date 2:</div> <input id="htmlDateInputFrom2" type="date" value="$previousDateYYYYMMDD$"/> </div> <div class="dateInput"> <div>To Date 2:</div> <input id="htmlDateInputTo2" type="date" value="$currentDateYYYYMMDD$"/> </div> </div> </html> </panel> </row> <row> <panel> <title>Converted Epoch Time - $tokEarliestTime1$ $tokLatestTime1$</title> <chart> <title>Splunkd errors timechart by top 5 components</title> <search> <query>index=_internal sourcetype="splunkd" log_level!="INFO" component="*" | timechart count by component limit=5 usenull=f useother=f </query> <earliest>$tokEarliestTime1$</earliest> <latest>$tokLatestTime1$</latest> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleY.text">Count</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> <panel> <title>Converted Epoch Time - $tokEarliestTime2$ $tokLatestTime2$</title> <chart> <title>Splunkd errors timechart by top 5 components</title> <search> <query>index=_internal sourcetype="splunkd" log_level!="INFO" component="*" | timechart count by component limit=5 usenull=f useother=f </query> <earliest>$tokEarliestTime2$</earliest> <latest>$tokLatestTime2$</latest> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleY.text">Count</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> </row> </dashboard> Following is the updated required JavaScript (html_input_date_control.js) (notice only one generic jQuery change event handler Date input based on type="date" : require([ "jquery", "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!" ], function ($, mvc) { console.log("Inside HTML Date Input JS"); var defaultTokenModel = mvc.Components.get("default"); var submittedTokenModel = mvc.Components.get("submitted"); // On change of html date input get input value and id and update id as token with value in the default and submitted model $(document).on('change', '[type="date"]', function () { var tokenName=$(this).attr("id"); var dateText = $(this).val(); defaultTokenModel.set(tokenName, dateText); submittedTokenModel.set(tokenName, dateText); }); }); Please try out and confirm!

niketn · ‎05-30-2020

@nagar57 please try the following ... you missed adding table id #all_req_table to .table td #all_req_table .table th, #all_req_table .table td { text-align: left !important; font-weight: bold !important; }

niketn · ‎05-30-2020

charting.seriesColors is available for all charts. When you don't do transpose or eval(count(field)) as field you have only one series (which is shown as legend, in above case count ). So there will be only one color for only one series i.e. count. Think what are you plotting, how would chart know what is your x-axis and y-axis. Usually first column goes as x-axis and Other column names make the series/legend. For example for if you do | timechart count by field , _time becomes x-axis and field values make the series or legends. Hope it clarifies stuff! 🙂

gcusello · ‎05-28-2020

Hi @nagar57, try to put after the Panel and Title tags the following tags: <html> <style type="text/css"> .single { width: 50% !important; } </style> </html> then put, one after one, the four pies in the same panel. Ciao. Giuseppe

nagar57 · ‎05-26-2020

I am still looking for a solution.

gerdo888 · ‎05-01-2020

Cool, didn’t know we can do this.

nagar57 · ‎02-18-2020

It Worked. But autoplay="false" is not working. I don't want the vide getting autoplayed.

nagar57 · ‎02-05-2020

Now that's what I was exactly looking for. Thanks a ton 🙂

nagar57 · ‎01-22-2020

I wonder how is this going to help. There is no CSS added. It is not working at all.

Posts	89
Solutions	2
Karma Given	15
Karma Received	8
Member Since	‎05-27-2019

Online Status	Offline
Date Last Visited	‎01-06-2023 03:05 AM

What history did rest /services/search/jobs brings...

Change python version from 2.7 to 3.7 at script le...

How to configure a different user other than admin...

How to make a search box mandatory to have a value

How to put a filter box for all columns of a table...

Get only parsed JSON fields using spath

Rendered table not getting scrolled to next page

Parse JSON only at 1st level

Parse JSON only at 1st level

Splunk Line charts are not displaying interval val...

Re: What history did rest /services/search/jobs br...

Change python version from 2.7 to 3.7 at script le...

Re: Smart pdf export issue

Re: How to configure a different user other than a...

Re: How to make a search box mandatory to have a v...

Re: How to put a filter box for all columns of a t...

Re: Multiple filter option in dashboard tables

Re: Get only parsed JSON fields using spath

Re: Jquery datepicker in splunk

Re: Splunk Dashboard Examples: How can I implement...

Rendered table not getting scrolled to next page

Re: Hide Dashboard title but not edit and export b...

Re: Splunk Line charts are not displaying interval...

Re: Parse JSON only at 1st level

Re: Parse JSON only at 1st level

Re: CSS to align customized inputs with Splunk def...

Re: Create a generalized JavaScript to use multipl...

Re: Change the font type to Bold for one particula...

Re: How to change colors on bars of a chart accord...

Re: Align multiple charts in one panel horizontall...

Re: Dashboard to fit in the screen without adjusti...

Re: Is it possible to increase the size of pie cha...

Re: Embed a video present in my local to Splunk Da...

Re: How to unset tokens for all filters and set to...

Re: How to hide title space of a Table?