Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About MatMeredith
MatMeredith
Path Finder
Member since:
02-13-2013
06-05-2020
Community Statistics
| Posts | 47 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 13 |
| Member Since | 02-13-2013 |
Activity Feed
- Got Karma for Simple XML dashboards: open in pivot / open is search. 06-05-2020 12:47 AM
- Got Karma for Simple XML dashboards: open in pivot / open is search. 06-05-2020 12:47 AM
- Got Karma for Protocol Data Inputs: How to process a stream of events over TCP before indexing them in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Protocol Data Inputs: How to process a stream of events over TCP before indexing them in Splunk?. 06-05-2020 12:47 AM
- Got Karma for How to prevent data model search string from being shown after clicking on pivot based pie chart?. 06-05-2020 12:47 AM
- Karma Re: Eval macro with string argument for martin_mueller. 06-05-2020 12:46 AM
- Got Karma for Scripted Authentication and Scheduled Searches. 06-05-2020 12:46 AM
- Got Karma for SavedSearch module doesn't use results from scheduled search. 06-05-2020 12:46 AM
- Got Karma for How to find the most recent event for a user preceding some other event. 06-05-2020 12:46 AM
- Got Karma for Sideview load dynamic (local) URL in iframe. 06-05-2020 12:46 AM
- Got Karma for Problem with subsearch returning $value and sideview utils. 06-05-2020 12:46 AM
- Got Karma for PDF report server and advanced xml dashboards. 06-05-2020 12:46 AM
- Got Karma for Single drilldown from multiple charts. 06-05-2020 12:46 AM
- Got Karma for Sideview utils handling drilldown from chart legend. 06-05-2020 12:46 AM
- Posted Re: Legend of last entry in bar chart is hidden on Splunk Search. 12-10-2019 05:09 AM
- Posted Re: Protocol Data Inputs: How to process a stream of events over TCP before indexing them in Splunk? on All Apps and Add-ons. 01-21-2015 09:54 AM
- Posted Re: Protocol Data Inputs: How to process a stream of events over TCP before indexing them in Splunk? on All Apps and Add-ons. 01-21-2015 06:04 AM
- Posted Protocol Data Inputs: How to process a stream of events over TCP before indexing them in Splunk? on All Apps and Add-ons. 01-21-2015 05:03 AM
- Posted How to calculate and map a country attribute based on GPS coordinates data? on All Apps and Add-ons. 09-18-2014 04:05 AM
- Posted Re: Drilldown from Pivot driven table leads to search string with 17,000 characters and breaks Internet Explorer on Dashboards & Visualizations. 09-12-2014 04:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 |
12-10-2019
05:09 AM
Same thing is happening to me. Did you find a fix?
... View more
01-21-2015
09:54 AM
On the send side, the client opens a TCP connection to a port on Splunk and then writes a near continuous stream of events to Splunk. The events are variable length -- anywhere between 10 and 4000 bytes long and delimited by a specific set of characters. I don't have any control over the send buffer size.
On the receive side, as I understand it the TCP layer has no way of knowing what constitutes an event (?) -- presumably when the receive buffer fills up it will pass it on up the stack and it may contain 1 event, many events, or (likely) a number of whole events + partial events at the ends of the buffer?
Unless I'm missing something basic, it seems to me that I just need to manually handle reassembling events fragmented across consecutive receive buffers... Is that not true?
... View more
01-21-2015
06:04 AM
Thanks Damien. Unfortunately I have tried increasing the receive buffer size and that didn't make any difference. In the general case though is it not always the case that I'll need to deal with fragmented events, or are you saying that it should be possible to avoid this issue for some reason?
... View more
01-21-2015
05:03 AM
2 Karma
I’m wanting to use the "protocol data inputs" add-on to receive a stream of events over TCP and pre-process them before indexing them in Splunk. I assume that’s something that I should be able to do?
My apologies for a rookie question, but I wonder if someone can help me please?
- I’ve written a message handler, and I’m successfully receiving the data as it is streamed over TCP.
- However, often the message buffer I receive contains partial events – e.g the start of an event at the end of the buffer, with the remainder of the event coming the next time that the message handler is invoked.
I assume that’s expected and normal? Is there any easy way to reassemble the partial messages / any sample implementation that I could adapt? Presumably I need to save off the partial message and wait for the remainder to be received… Is there an easy way to persist data between invocations of the handler?
... View more
09-18-2014
04:05 AM
I have events in Splunk that contain GPS data -- longitude and latitude, and I can plot these on a map using either the built in Splunk maps support, or the Google maps app. What I'd really like though is to be able to filter events on e.g. country=US. Does anyone know of a way to calculate a country attribute based on GPS coordinates?
Thanks!
... View more
09-12-2014
04:37 AM
Yes, thank you, I'm aware that I could just disable drilldown (and indeed I've done that as a temporary workaround). But drilldown is such a valuable feature that I really want it to work...
... View more
09-12-2014
03:37 AM
I have a table on my simple XML dashboard which is driven by a fairly simple pivot command. If I click on it the drilldown takes me to the search view, with a 17,000 character search string. This is because the search string that Splunk specifies evals and then renames every attribute in the underlying data model.
This results in a query string which is a) completely unworkable and b) doesn't work at all in IE which truncates the URL at 2083 characters.
Seems like a bug to me! Surely the drilldown need to either make use of the Pivot command, or at least only evaluate the fields in the data model that are necessary for the query...
The only workaround I know of is to define custom drilldown links for every chart / table in my dashboards. But all of my dashboards have a selection of dropdown input fields which specify e.g. FILTER conditions for the Pivot commands, and all of these have to then be manually passed through on the drilldown links -- which is a) tedious, and b) hard to maintain. Does anyone know of a better way?
... View more
09-04-2014
08:25 AM
OK -- so it looks like this should work...
true
false
If I specify these on e.g. a table where Splunk is currently showing "open in pivot" but it doesn't work, then the "open in pivot" option is hidden, but it still doesn't offer the "open in search" that would work...
... View more
09-04-2014
08:10 AM
2 Karma
I'm building some simple XML dashboards with inline searches based on the pivot command.
The dashboard automatically adds an "open in pivot" or an "open in search" option to each table / chart. Sometimes though it adds "open in pivot" to charts / tables that have searches that pipe the results of the pivot command to subsequent stats / eval commands. When you click on open in pivot for such a chart you (unsurprisingly) get an error message.
Is there someway that I can force Splunk to add "open is search" rather than "open in pivot"? (I'm not sure how it's choosing currently). Or failing that to hide these options completely?
Thanks!
... View more
09-03-2014
11:18 AM
Yes, that's exactly it. The search is displaying the right information, but at the moment the search string is about 30 rows long, whereas it only needs to be about 2 lines long. A a result it's too complex for users to easily see what the search is actually showing.
... View more
09-01-2014
06:58 AM
1 Karma
I have a dashboard that contains a number of pivot based charts. E.g.
| pivot analytics my_events count(my_events) AS "Count of events" SPLITROW my_dimension FILTER filter_att is "$filter_val$" SORT 100 my_dimension ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1
When I click on e.g. pie charts driven by such queries I get taken to the search view and the right events are shown. However, the search string shown is horrendously complex as it expands the full data model and evaluates every attribute. Is there some way I can avoid this?
Thanks!
... View more
04-10-2014
05:06 AM
I'm using a Splunk forwarder to forward data from an application running on the same Linux box as my forwarder.
Obviously I could have my process write out all the data to disk, and have Splunk monitor these files for new data. However, the disk is already heavily loaded on this box, and this doesn't seem terribly efficient.
Is there a better solution?
... View more
03-12-2014
04:45 AM
Having downgraded to Splunk Free, I can no longer see options when scheduling a search to configure summary indexing. That's despite http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/MoreaboutSplunkFree which says that when switching to Splunk Free "Any alerts you have defined will no longer fire/function, although you can still schedule searches to run for dashboards and summary indexing purposes."
I've upgraded to Splunk 6 but I still can't see the summary indexing options.
Can anyone help please?
... View more
11-13-2013
01:45 AM
Sorry -- sadly not.
... View more
08-15-2013
05:56 AM
Hi thanks for this. Did you see the additional info I added below? Any help still appreciated.
... View more
08-13-2013
12:46 AM
Thanks for the answer. I'm not using an old version of Sideview (I'm on 2.4.1). However, I think you're right -- the issue is almost certainly what goes before in the dashboard...
See below. I suspect the issue is the fact that I have a URL loader (with updating enabled) and a Time range picker.
If this isn't going to work, can you tell me how I can achieve what I need please?
- I need a timerange picker that allows the user to specify what time range the searches in the page should be run over. This should affect all searches except for those used to populate the dropdowns (which always just run over the last week)
- I need the URL Loader, and furthermore the page must support both the timerange picker, and the dropdowns that are populated using the saved search, picking up default values from the URL.
Is what I'm trying to do possible?
Many thanks for your help.
*
2
False
<module name="URLLoader" layoutPanel="viewHeader">
<param name="keepURLUpdated">True</param>
<module name="TimeRangePicker" layoutPanel="viewHeader">
<param name="searchWhenChanged">True</param>
<param name="default">Last 24 hours</param>
<param name="label">Time period to report on</param>
<module name="SavedSearch" autoRun="True" layoutPanel="viewHeader">
<param name="name">
populate_dropdowns
</param>
... View more
08-12-2013
02:11 AM
1 Karma
I'm trying to use the Sideview SavedSearch module to load results from a previous scheduled search in order to quickly populate dropdowns on my page.
<module name="SavedSearch" autoRun="True">
<param name="name">populate_dropdowns</param>
<module name="Pulldown">
etc.
My saved search "populate_dropdowns" is running every minute (for testing purposes!).
When I load my dashboard though it always executes the search again though, rather than loading the previously saved results. Looking in the jobs window, I see the following..
I can see the previously scheduled populate_dropdowns job. I can see the populate_dropdowns search being run again when I load the dashboard (but this time I see it's full definition rather than just it's name). Clicking on inspect shows that both instances return exactly the same results.
Any ideas?
... View more
07-03-2013
04:18 AM
1 Karma
I have a chart that looks like this
I'm using Sideview to configure custom drilldown options. When someone clicks on a bar in the table all is well: I can get the selected series from $click.name2$ and I can the x-axis value from $click.value$. But when someone clicks on a legend entry (e.g. the blue square on the RHS in the example above) it tries to execute the drilldown with $click.value$ not set and things go wrong. How can I special case the behaviour when $click.value$ is not set?
I've tried using the switcher module, but can't get that to match on the "not set" condition...
... View more
06-28-2013
01:53 AM
1 Karma
I have a dashboard which contains three charts all of which present different views of the same data. I'd like to set up my dashboard so that when the user clicks on a data point in one of the three charts, a fourth drilldown chart is rendered at the bottom of the page. I want to perform the same drilldown action irrespective of which of the three charts is clicked on.
I'm using Sideview Utils. Is this possible?
At the moment, I've configured the same drilldown logic in each of my three charts. This means that the code is repeated, and the drilldown chart opens beneath whichever chart the user clicks on. I'd rather avoid the code repetition, and also always have the drilldown chart open at the bottom of the page.
... View more
06-07-2013
09:24 AM
Thanks I'll try that when I'm back in the office. I think this is what I want to do. Alongside the data in this view from Splunk I also need to render some additional information which does not exist inside Splunk... I already have a web page that loads and renders that data in the form that I need - I just want to embed it within my Splunk app...
... View more
06-07-2013
04:52 AM
1 Karma
I need to support drilling down from a Splunk table to a local (on the Splunk server) HTML file. I want to load the local file inline using an iframe, and when loading the file, I need to pass dynamic parameters in the URL based on the row in the table that the user has clicked.
I thought I could do it like using the Sideview HTML module
<module name="Search">
<param name="search"> [snip: my_search] </param>
<module name="Table">
<module name="HTML">
<param name="html"><![CDATA[<iframe src="chart.html?$row.fields.ssrc$"></iframe>]]></param>
</module>
</module>
</module>
But this doesn't work -- my iframe just shows me a 404 error saying that Splunk cannot find view "chart.html". I've put chart.html in /etc/apps/ /appserver/static. Can anyone tell me what I need to do to make this work please?
... View more
05-17-2013
03:48 AM
I'm trying to define a Splunk eval based macro that takes a string as a parameter (where the string must be able to contain spaces), tests the value of the string, and then returns a value based on the outcome of that test. But I can't get it to work. Taking as a simplified example...
Macro definition:
if ($arg1$=="Test String", "true", "false")
Macro invocation:
`name("Test String")`
The macro always evaluates to false. I've tried every combination of single and double quotes that I can think of in both the macro definition and invocation, but I can't seem to get this to work. Am I missing something?
Thanks!
... View more
05-08-2013
12:55 AM
An update on this -- it turns out the problem is far worse than I thought as it applies to locally configured Splunk users too.
Configure a user on Splunk with a role that has restricted search terms. In our case a filter that restricts them to only seeing their company’s data.
User logs in and views dashboard. Can only see their
data. Great.
User schedules PDF generation for dashboard using Splunk’s built in PDF reporting. At
the appropriate time a PDF is generated and e-mailed to the user.
When the PDF is generated the user’s search restrictions are not applied. The user gets e-mailed a report containing data from all companies.
... View more
