Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About eroffol
eroffol
Path Finder
Member since:
09-01-2016
07-17-2023
Community Statistics
| Posts | 23 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 09-01-2016 |
Activity Feed
- Got Karma for How do I push an app to the Search Head Deployer's shcluster/ directory?. 06-05-2020 12:48 AM
- Posted Re: Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 10-02-2018 07:53 AM
- Posted Re: Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-27-2018 11:08 AM
- Posted Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-18-2018 12:16 PM
- Tagged Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-18-2018 12:16 PM
- Tagged Splunk Bookmarks not working in Firefox and Chrome on Splunk Dev. 09-18-2018 12:16 PM
- Posted Re: How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 10:56 AM
- Posted Re: How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 09:15 AM
- Posted Re: How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:16 AM
- Posted How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Tagged How do you add a custom header to Simple XML dashboards? on Dashboards & Visualizations. 03-02-2018 08:02 AM
- Posted Re: How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-23-2018 06:25 AM
- Posted Re: How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 12:47 PM
- Posted How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 11:45 AM
- Tagged How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 11:45 AM
- Tagged How do you debug JS in Splunk 7? on Dashboards & Visualizations. 02-22-2018 11:45 AM
- Posted Re: Real-time inner join on Splunk Search. 10-31-2017 09:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-02-2018
07:53 AM
Another update:
This error only occurs if I save a bookmark with filters selected.
For example, if I save a bookmark like this, it works fine (JS/CSS applied correctly):
https://local.test/splunk/en-US/app/testApp/testDashboard
If I save a bookmark with filters selected, I get the 307 error where it can't find my JS/CSS because it is using the wrong domain
https://local.test/splunk/en-US/app/testApp/testDashboard?form.filter1="All"&form.filter2=".*";
... View more
03-02-2018
10:56 AM
I came up with a solution using JS.
I replaced my original JS with:
var outerDiv = document.createElement("div");
var innerDiv1 = document.createElement("div");
outerDiv.appendChild(innerDiv1);
var innerDiv1Text = document.createTextNode("Some Text Here");
innerDiv1.appendChild(innerDiv1Text);
var innerDiv2 = document.createElement("div");
outerDiv.appendChild(innerDiv2);
var innerDiv2Text = document.createTextNode("More Text Here");
innerDiv2.appendChild(innerDiv2Text);
var body = document.getElementsByTagName('body')[0];
body.insertBefore(outerDiv, body.firstChild);
The header now shows up in the desired location and all of the dropdowns in the black bar work.
... View more
10-31-2017
09:57 AM
Revised solution since I can't edit my original answer:
...
| eval combinedField = Field1 + "~" + State1
| eventstats values(combinedField) as combinedField by sharedField
| stats values(combinedField) as combinedField, values(State2) as State2 by sharedField, Field2
| mvexpand combinedField
| rex field=inputCombined "(?<Field1>.*)~(?<State1>.*)"
| stats values(Field1) as Field1, values(State1) as State1, values(State2) as State2 by sharedField, Field2
... View more
09-20-2017
06:56 AM
This is exactly what I was looking for and confirmed it works this morning.
I too think our load balancer will be handle the additional traffic from Splunk without issue. I think some of our leads got a little jumpy when they saw the apache logs filling up much quicker than normal. I don't think it is worth sacrificing performance for log readability. Maybe I will suggest they look into the "grep" command =P
Thank you very much!
... View more
08-18-2017
11:55 AM
@eroffol - that's one of the reasons I REALLY don't like to add spaces into a variable name, in any language. Way too much fiddly or squishy stuff happens. Okay, I'm moving your comment to an answer, and you can accept it when you get a chance. This is one of those things that unfortunately gets filed as "Unable to Reproduce".
... View more
06-13-2017
03:09 PM
1 Karma
After having your multiselect returning values in format "Value1,Value2" (you would need to adjust prefix/separator and other things), you can run query like this
.... | where [|gentimes start=-1 | eval field1=split("$multiselectToken",",") | table field1 | mvexpand field1] OR [|gentimes start=-1 | eval field2=split("$multiselectToken",",") | table field2 | mvexpand field2]
... View more
10-11-2017
03:48 AM
I have done the following:
Created basic APP framework through the WEB-GUI on a standalone Search Head. Then found found the APP files which the GUI created here: /apps/splunk/etc/apps/myapp
Tar up that directory:
cd /apps/splunk/etc/apps; tar cvf myapp.tar myapp
Transfer and untar myapp.tar to your search head deployer to this directory /apps/splunk/etc/shcluster/apps.
Once you have /apps/splunk/etc/shcluster/apps/myapps on your deployer, then run "shcluster-apply stage" and "shcluster-apply send" to update your search head cluster.
I found if I tried to create through the Search Head Cluster WEB-GUI, the updates are not replicated properly between the cluster nodes.
I'm guessing this is the manual method as mentioned above. I've haven't yet found a more efficient way to do this.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-17-2023
12:26 PM
|
