About chris1337

chris1337 · ‎11-20-2019

On the first dashboad I have: <drilldown> <link target="_blank">/app/appname/logon_fail?drill_account=$click.value$</link> </drilldown> On the second dashboard I have a search like: <search> <query>index=index EventCode=4625 Account_Name=$drill_account$ </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> Now, I try, to get this search running, even when there is no drilldown and the token "drill_account" is not set. Right now, it says "Waiting for input..." Any suggestions? I tried to set this token to "*", but nothing worked for me. Thx in advanced. Chris

chris1337 · ‎08-06-2019

Ok, then I don´t know. My local test here worked fine. I´m sorry, I could not help you. Greetings Chris

chris1337 · ‎08-06-2019

Hi, in the alert settings, try to check the Trigger "Once" box below the trigger condition and then the Throttle (set to a time you like) Greetings Chris

chris1337 · ‎08-06-2019

Hi, you could try: index=source_index | timechart span=1minute avg(your_integer_field) AS your_integer_field | collect index=destination_index Check out the collect command: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Collect Greetings Chris

chris1337 · ‎08-06-2019

Could you plz try the following: | inputlookup lookupfile.csv Is there any output? Is there a field with values? If yes, try: | inputlookup lookupfile.csv | chart sparkline count by field_you_are_looking_for Greetings, Chris

chris1337 · ‎08-06-2019

Hi, are you sure, that your inputlookup is delivering some fields+values? Do you use the right fieldname to count? Is this fieldname available in your lookup output? I tested it, there are no problems right now. Greetings Chris

chris1337 · ‎06-21-2019

Have you tried this? https://stackoverflow.com/questions/45839352/how-do-i-know-splunk-rest-api-base-url

chris1337 · ‎06-21-2019

Hi, I think, this will solve your question: https://docs.splunk.com/Documentation/Splunk/7.3.0/RESTTUT/RESTsearches Greetings Chris

chris1337 · ‎06-21-2019

Hi, I'm trying to shorten an output value, displayed in a table, located in a dashboard. For example: C:\asdsads\Sdasdd\sdasd\sadsad.exe should be C:\asdsads\...\sadsad.exe But on mouseover, the full context should be available as a "tooltip" or so. Any suggestions? Thanks in advance, Chris

chris1337 · ‎06-21-2019

Hi, try to do the following: Go to Settings -> Access controls -> Roles -> "Your Role" -> Indexes and set the nextcloud index as default Then open the app again. Greetings

Posts	10
Solutions	1
Karma Given	16
Karma Received	3
Member Since	‎06-21-2019

Online Status	Offline
Date Last Visited	‎07-13-2020 06:28 AM

Dashboards - set token to specific value, when dri...

Are there any suggestions for shortening a table o...

Dashboards - set token to specific value, when dri...

Re: How to use sparkline in search with inputlooku...

Re: schedule alert every 5 minutes and send mail o...

Re: How to aggregate data in an index

Re: How to use sparkline in search with inputlooku...

Re: How to use sparkline in search with inputlooku...

Re: Splunk Rest API: How to find the base URL?

Re: Splunk Rest API: How to find the base URL?

Are there any suggestions for shortening a table o...

Re: Splunk App for Nextcloud: How to change index ...

Are you a member of the Splunk Community?