Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About eroffol
eroffol
Path Finder
Member since:
09-01-2016
05-14-2024
Community Statistics
| Posts | 23 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 09-01-2016 |
Activity Feed
- Got Karma for How do I push an app to the Search Head Deployer's shcluster/ directory?. 06-05-2020 12:48 AM
- Posted Re: Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 10-02-2018 07:53 AM
- Posted Re: Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-27-2018 11:08 AM
- Posted Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-18-2018 12:16 PM
- Tagged Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-18-2018 12:16 PM
- Tagged Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-18-2018 12:16 PM
- Posted Re: How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 10:56 AM
- Posted Re: How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 09:15 AM
- Posted Re: How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:16 AM
- Posted How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Posted Re: How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-23-2018 06:25 AM
- Posted Re: How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 12:47 PM
- Posted How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 11:45 AM
- Tagged How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 11:45 AM
- Tagged How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 11:45 AM
- Posted Re: Real-time inner join on Splunk Search. 10-31-2017 09:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-02-2018
07:53 AM
Another update:
This error only occurs if I save a bookmark with filters selected.
For example, if I save a bookmark like this, it works fine (JS/CSS applied correctly):
https://local.test/splunk/en-US/app/testApp/testDashboard
If I save a bookmark with filters selected, I get the 307 error where it can't find my JS/CSS because it is using the wrong domain
https://local.test/splunk/en-US/app/testApp/testDashboard?form.filter1="All"&form.filter2=".*";
... View more
09-27-2018
11:08 AM
I figured out a work around for the .%2A problem.
In my search, I just added an eval statement to convert %2A to .* The below statement checks my multiselect for %2A, , or All and sets matcher to . if they match. If not, just use what is in the multiselect.
| eval matcher = if(match($multiselect1$, "\((\*|\.?%2A|All)\)"), ".*", $multiselect1$)
| where match(field, matcher)
I still have the 307 error problem with my js and css the first time I navigate to my bookmark in a fresh browsing session (like in private or incognito). Any suggestions would help!
... View more
09-18-2018
12:16 PM
Overview
Our users use several dashboards we have in our app. They would like to have the ability to select filters on the dashboard, bookmark them, and navigate back to them later without having to reenter any filter values. Most of the filters on our dashboards are multiselect fields with a default value of: name="All" value=".*"
Currently, we can set filters and bookmark a page. Unfortunately, when navigating to that bookmark in a fresh browser session, we have 2 main problems:
1. Our custom css and js does not get applied to the dashboard
2. Out multiselects are not populated correctly with the default values
Reproducing:
1. Navigate to a dashboard with multiselect fields. Select a value where name="All" and value=".*"
2. Bookmark that page
3. Close firefox
4. Open a new private browsing session
5. Navigate to the saved bookmark
At this point, the multiselect field will be populated with ".%2A" instead of "All". Also, none of the custom js/css will be applied. If I open up the debug console, it looks like the domain is wrong for the URL of the JS/CSS (with a 307 error). It uses "splunk" as the domain instead of what it should use.
Example:
Bookmark loads this: https://splunk/en-US/static/@03bbabcabf43/app/testApp/dashboard.css
Instead of this: https://local.test/en-US/static/@03bbabcabf43/app/testApp/dashboard.css
If I refresh the page, all of the JS/CSS loads properly, but the multiselect fields are still incorrect.
If I click the bookmark again, everything looks just fine. JS/CSS loads correctly and the multiselects populate with "All"
If I use bookmarks in IE, it works fine. JS/CSS loads properly and multiselects populate with "All"
Environment information:
Splunk version: 7.1.2
Browser: Firefox (various versions), Chrome (various versions)
Relevant architecture info: Splunk search head cluster (3 members) behind a load balancer
Is there something I have to do to get bookmarks to work? Our users are not motivated enough to click a bookmark twice to get it to load correctly
... View more
03-02-2018
10:56 AM
I came up with a solution using JS.
I replaced my original JS with:
var outerDiv = document.createElement("div");
var innerDiv1 = document.createElement("div");
outerDiv.appendChild(innerDiv1);
var innerDiv1Text = document.createTextNode("Some Text Here");
innerDiv1.appendChild(innerDiv1Text);
var innerDiv2 = document.createElement("div");
outerDiv.appendChild(innerDiv2);
var innerDiv2Text = document.createTextNode("More Text Here");
innerDiv2.appendChild(innerDiv2Text);
var body = document.getElementsByTagName('body')[0];
body.insertBefore(outerDiv, body.firstChild);
The header now shows up in the desired location and all of the dropdowns in the black bar work.
... View more
03-02-2018
09:15 AM
This isn't quite what I am looking for. For reasons that I can't explain, the requirement is that the header must be the very first thing on the page. It must appear above the black bar with the App dropdown, Administrator dropdown, etc... and above the green bar with Links to other dashboards, Link to the Search view, and the App name.
Unfortunately, using an html panel will not allow me to add my html in the correct location
... View more
03-02-2018
08:16 AM
My JS actually breaks all dropdowns in the black bar (app selector, Administrator, Messages, Setting, etc..)
Also, it looks like my formatting got screwed up. Here is what It should look like:
My JS (test.js):
//# sourceURL=test.js
var headerHtml =
"<div id=\"siteHeader\">" +
" <div class=\"dynamic\">" +
" Some Text Here" +
" </div>" +
" <div class=\"anotherClass\">" +
" More Text Here" +
" </div>" +
"</div>";
var header = document.getElementsByTagName('Header')[0];
header.innerHTML = headerHtml + header.innerHTML;
My Simple XML:
<dashboard script="test.js">
</dashboard>
... View more
03-02-2018
08:02 AM
I have requirement that I must have a header on all of my dashboards. Is there any way I can add a header to my Simple XML dashboards without converting them to HTML?
I tried adding it using JS, but it isn't working quite as desired.
My JS (test.js):
//# sourceURL=test.js
var headerHtml =
"<div id=\"siteHeader\">" +
" <div class=\"dynamic\">" +
" Some Text Here" +
" </div>" +
" <div class=\"anotherClass\">" +
" More Text Here" +
" </div>" +
"</div>";
var header = document.getElementByTagName('Header')[0];
header.innerHTML = headerHtml + header.innerHTML;
My Simple XML:
...
This code will add my header, but it breaks the App selector dropdown in the top-left next to the Splunk logo. This App selector is in the black bar. If I comment out header.innterHTML = headerHtml + header.innerHTML; the App selector works fine, but I have no header.
What is the right way to add a custom header to my dashboards?
... View more
02-22-2018
12:47 PM
It looks like I lost some formatting. Here is the revised end to my question:
In Splunk 6.2.3, the console output looks like:
Hello hello.js:6:1
I can then click on hello.js:6:1 and navigate to the JS source, add breakpoints, etc...
In Splunk 7.0.1, the console output looks like:
Hello common.js%20line%2014%20%3E%20eval:5:1
If if click on common.js%20line%2014%20%3E%20eval:5:1 , it navigates me to view-source:http://:/en-US/static//build/pages/enterprise/common.js line %3E eval and I get a "Page not found".
I can navigate to http://:/static/app/test/hello.js with both 6.2.3 and 7.0.1. How do I make it so I can debug my JS in Splunk 7.0.1?
... View more
02-22-2018
11:45 AM
We just made the switch from Splunk 6.2.3 to Splunk 7.0.1 and a lot of our custom JS broke. I am trying to debug through and make changes where necessary, but I can't seem to use any of my browsers (Chrome, Firefox, IE) to debug. With Splunk 6.2.3, I used to be able to view my JS files in the web console and add breakpoints. It seems like with Splunk 7.0.1, I can add JS and have it work, but I can't add breakpoints to my source because I can't find it in the web console.
For example, here are the steps I took to reproduce this:
1. Create a new app (called test)
2. Create a directory under $SPLUNK_HOME/etc/apps/test/appserver/static/
3. Added a JS file in $SPLUNK_HOME/etc/apps/test/appserver/static/hello.js . Code is just a simple console.log("Hello");
4. Created a dashboard in the test app.
5. Linked new dashboard to hello.js. <dashboard script="hello.js">...
6. Restarted splunk
7. Navigate to the new dashboard
8. Opened web console
In Splunk 6.2.3, the console output looks like:
Hello hello.js:6:1
I can then click on hello.js:6:1 and navigate to the JS source, add breakpoints, etc...
In Splunk 7.0.1, the console output looks like:
Hello common.js%20line%2014%20%3E%20eval:5:1
If if click on common.js%20line%2014%20%3E%20eval:5:1 , it navigates me to view-source:http://<splunk_hostname>:<splunk_port>/en-US/static/<uid>/build/pages/enterprise/common.js line %3E eval and I get a "Page not found".
I can navigate to http://<splunk_hostname>:<splunk_port>/static/app/test/hello.js with both 6.2.3 and 7.0.1. How do I make it so I can debug my JS in Splunk 7.0.1?
... View more
10-31-2017
09:57 AM
Revised solution since I can't edit my original answer:
...
| eval combinedField = Field1 + "~" + State1
| eventstats values(combinedField) as combinedField by sharedField
| stats values(combinedField) as combinedField, values(State2) as State2 by sharedField, Field2
| mvexpand combinedField
| rex field=inputCombined "(?<Field1>.*)~(?<State1>.*)"
| stats values(Field1) as Field1, values(State1) as State1, values(State2) as State2 by sharedField, Field2
... View more
10-31-2017
09:52 AM
This line: | stats values(combinedField) as combinedField by sharedField, Field2 should be | stats values(combinedField) as combinedField, values(State2) as State2 by sharedField, Field2
... View more
10-31-2017
09:50 AM
I came up with a shady solution for this:
...
| eval combinedField = Field1 + "~" + State1
| eventstats values(combinedField) as combinedField by sharedField
| stats values(combinedField) as combinedField by sharedField, Field2
| mvexpand combinedField
| rex field=inputCombined "(? .)~(? . )"
| stats values(Field1) as Field1, values(State1) as State1, values(State2) as State2 by sharedField, Field2
... View more
10-31-2017
07:46 AM
I have data that looks like this:
I would like to join it in such a way to make it look like this:
This must work in real-time, so joins or subsearches are out the window. I have been messing around with stats, and eventstats, but can't seem to find a way to keep the values in the state field correctly.
... View more
09-20-2017
06:56 AM
This is exactly what I was looking for and confirmed it works this morning.
I too think our load balancer will be handle the additional traffic from Splunk without issue. I think some of our leads got a little jumpy when they saw the apache logs filling up much quicker than normal. I don't think it is worth sacrificing performance for log readability. Maybe I will suggest they look into the "grep" command =P
Thank you very much!
... View more
09-19-2017
11:47 AM
I thought that also, but I updated it to 30 (in both the app's limits.conf and .../etc/system/local/limits.conf), restarted Splunk, cleared my browser cache (for good measure), and still see 1 HTTP GET request per second.
Here is an example of what the requests look like:
http://<machine name>:8443/splunk/en-US/splunkd/__raw/servicesNS/-/-/search/jobs?id=rt_admin__admin_c21kX3NwbHVuaw__search1_rt_1505845497.11&count=1&output_mode=json&_=150585475554
and then one second later:
http://<machine name>:8443/splunk/en-US/splunkd/__raw/servicesNS/-/-/search/jobs?id=rt_admin__admin_c21kX3NwbHVuaw__search1_rt_1505845497.11&count=1&output_mode=json&_=150585475555
and so on...
Is that just how Splunk works, and a real-time search's request frequency can't be changed?
So the reason that I brought this question up is because there is concern from our company's software leads about the additional traffic that Splunk is creating on our load balancer. Most users will have 3 different dashboards open that have about 10 real-time searches on each of them; therefore, the average user will generate about 30 HTTP GET requests per second. The searches on these dashboards must update at least once every 10 seconds without any user interaction or panel refreshing. While a small number of users is fine, there is uncertainty about how our load balancer will handle a large number of users.
... View more
09-14-2017
01:05 PM
I have indexed real-time searching set up for my app by setting the indexed_realtime_use_by_default = true in limits.conf.
My dashboard has 1 indexed real-time search and it looks like it is generating 1 HTTP GET request per second. Is there a way to modify the request frequency of an indexed real-time search? For example, I would like to have my indexed real-time search only generate 1 HTTP GET request every 10 seconds instead of 1 per second.
I have tried modifying some variables in the limits.conf file, but could not find the right property to achieve this.
... View more
08-16-2017
11:43 AM
My original post might have been a little misleading, my simple xml searches were all on one line.
... | rename totalRecs as "Total Records Out" | table "Total Records Out" ...
I didn't get a chance to try your idea because I had already made changes to that dashboard that I didn't want to lose. It seemed like when I added more search text before the rename, this behavior stopped
... | more search text | rename totalRecs as "Total Records Out" | table "Total Records Out" ...
... View more
08-15-2017
11:16 AM
I am using Splunk 6.2.3
... View more
08-15-2017
11:15 AM
There is a bug I found when I convert my simple XML dashboard to HTML.
On my simple dashboard, I have a search like this, which displays correctly:
...
| rename totalRecs as "Total Records Out"
| table "Total Records Out"
...
But, when I convert my dashboard to HTML, my rename loses a character space. The search ends up causing me to have missing data for the "Total Records Out" column because it got renamed to "Total RecordsOut"
...
| rename totalRecs as "Total RecordsOut" ...
| table "Total Records Out"
...
I guess I didn't really have a question here, just a minor bug/inconvenience.
... View more
06-13-2017
02:48 PM
Is it possible to check multiple fields against a multiselect value?
For example:
My multiselect input has 2 values selected, NORMAL and SEVERE
I want my search to look like:
...
| where field1 == "NORMAL" OR field2 == "NORMAL" OR field1 == "SEVERE" OR field2 == "SEVERE"
I know I can achieve this by having 2 separate multiselects (one for each field), but I was wondering if it is possible to just use 1.
... View more
09-01-2016
01:07 PM
Well that answers my question then, thank you!
I was hoping that I would be able to log into the SHC member and run some sort of "push" command to have it replicate on the Search Head Deployer. Manual FTP is always fun though =/
... View more
09-01-2016
08:03 AM
1 Karma
I know I would run splunk apply shcluster-bundle on the Search Head Deployer to push apps to Search Head Cluster Members. The apps that get pushed are located under the shcluster/ directory on the Search Head Deployer.
I also know that when I create a new app (using the SPLUNK web UI), the app is put in the etc/apps/ directory on a Search Head Cluster Member. How does that app then get to the Search Head Deployer's shcluster/ directory?
Do I manually have to put it there? Should it automatically go there? Or is there a command-line command I have to run to get it there?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-14-2024
09:01 AM
|
