Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jnichols914
jnichols914
Explorer
Member since:
09-13-2016
08-10-2022
Community Statistics
| Posts | 10 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 09-13-2016 |
Activity Feed
- Karma Re: Splunk API request for inputlookup for PickleRick. 08-10-2022 09:32 AM
- Posted Re: What are we doing wrong in our Splunk API request for inputlookup? on Splunk Search. 08-10-2022 07:04 AM
- Posted Re: What are we doing wrong in our Splunk API request for inputlookup? on Splunk Search. 08-10-2022 06:24 AM
- Posted What are we doing wrong in our Splunk API request for inputlookup? on Splunk Search. 08-08-2022 07:11 AM
- Posted Re: cipherSuite in various .conf files on Security. 07-21-2021 08:55 AM
- Karma Re: cipherSuite in various .conf files for MuS. 07-21-2021 08:54 AM
- Posted Re: How to change the color of a whole panel based on a single value result in Splunk 6.2.1? on Dashboards & Visualizations. 12-29-2016 01:32 PM
- Posted Re: How to edit my search to display "Incomplete" on a single value dashboard if a log is not found? on Splunk Search. 12-21-2016 12:04 PM
- Posted Re: How to edit my search to display "Incomplete" on a single value dashboard if a log is not found? on Splunk Search. 12-21-2016 11:08 AM
- Posted How to edit my search to display "Incomplete" on a single value dashboard if a log is not found? on Splunk Search. 12-21-2016 09:07 AM
- Tagged How to edit my search to display "Incomplete" on a single value dashboard if a log is not found? on Splunk Search. 12-21-2016 09:07 AM
- Tagged How to edit my search to display "Incomplete" on a single value dashboard if a log is not found? on Splunk Search. 12-21-2016 09:07 AM
- Tagged How to edit my search to display "Incomplete" on a single value dashboard if a log is not found? on Splunk Search. 12-21-2016 09:07 AM
- Posted Re: how do I get daily average over a month for all the pages I receive on Splunk Search. 10-19-2016 12:24 PM
- Posted How to write an eval if/then statement to produce a result for a single value visualization? on Splunk Search. 09-13-2016 09:41 AM
- Tagged How to write an eval if/then statement to produce a result for a single value visualization? on Splunk Search. 09-13-2016 09:41 AM
- Tagged How to write an eval if/then statement to produce a result for a single value visualization? on Splunk Search. 09-13-2016 09:41 AM
- Tagged How to write an eval if/then statement to produce a result for a single value visualization? on Splunk Search. 09-13-2016 09:41 AM
- Tagged How to write an eval if/then statement to produce a result for a single value visualization? on Splunk Search. 09-13-2016 09:41 AM
- Tagged How to write an eval if/then statement to produce a result for a single value visualization? on Splunk Search. 09-13-2016 09:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-10-2022
07:04 AM
@PickleRick , thanks for leading us down the path. We actually had to append to get the data. What worked was the code below. Thank you for getting us there. search=search NOT * | inputlookup somefile.csv append=true | table Day User emp_id Data
... View more
08-10-2022
06:24 AM
Thanks Rick. We will give this a shot and let you know the results. Appreciate you helping.
... View more
08-08-2022
07:11 AM
Hi Everyone, we have another internal team that is trying to use the API to return some data we built for them. Unfortunately, they aren't able to get the payload but only the headers. Can someone suggest a solution or what we are doing wrong? the below is the response from the splunk API on their call.
Target: https://SomeHost:Port/servicesNS/user/search/search/jobs/export
Request body:
search=search inputlookup somefile.csv | table Day User emp_id Data
Response:
<results preview='0'>
<meta>
<fieldOrder>
<field>Day</field>
<field>User</field>
<field>emp_id</field>
<field>Data</field>
</fieldOrder>
</meta>
</results>
... View more
Labels
- Labels:
-
table
07-21-2021
08:55 AM
Thank you for this post. We had an issue with the ciphers occur and didn't have this in-depth knowledge of how all the configuration files worked. This will help us in the future with upgrades.
... View more
12-29-2016
01:32 PM
I don't know if you figured this out already, but you want to use the following as an option "Block". When you do this, your background will change based on the colors you specified and your text will stay white.
Hope this helps,
Justin
<option name="colorBy">value</option>
<option name="colorMode">block</option>
... View more
12-21-2016
12:04 PM
OK, So I figured out a solution. Not exactly what I wanted, but this works with what we are trying to do. Please see my XML below. This should help people for the future.
<panel>
<title>Blah</title>
<single>
<search>
<query><query goes here" | stats count as "Reports Generated" |untable _time count value | eval range=if(value==0,"severe","low")</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<option name="underLabel">Green = Completed | Red = Incomplete</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
</single>
</panel>
... View more
12-21-2016
11:08 AM
Sundareshr,
If my log exsists, your query is returning "Not Complete" and in red. So, it did not fix the issue.
... View more
12-21-2016
09:07 AM
Hi Everyone,
I've looked over the answers for my problem, but I can't seem to get this working correctly. Here is what I want: If I do not find a log for my search, I want my single value dashboard widget to state "Incomplete" and show it in red font. I've got the the single value working if my search is found. Any help would be awesome.
Search that Picks up log correctly, but need it to say "Not Complete" if log is not found:
<query goes here> | eval status=if(like(_raw, "%gcmMtmReports%"), "EU Run Completed", "EU Run Not Complete") | eval status="EU Run Completed" | dedup status | eval status=if(isnull(status),"Not Complete!", status) | table status | eval range=if(status="EU Run Completed","low","severe")
... View more
10-19-2016
12:24 PM
This is a bit old, but you can do this:
<your search here> | Stats avg(yourfield) by date_month,date_mday | sort date_mday
... View more
09-13-2016
09:41 AM
Hi Everyone,
Longtime user of Splunk and come here often to find my answers, but I can't exactly solve the issue I have here.
Background of what I'm trying to do:
My Dashboard has options for PROD, DEMO. When I select the dropdown, it will change the searches from my production servers to my demo servers. I'm looking at java logging to look at max threads on our tomcat hosts and would like to look at demo logging, but the hard part is, it's a different number for all hosts.
Here is my XML:
host=$il_env$-ilas* sourcetype=jmx attributevalue="*" attributeID=366 | stats latest(attributevalue) | rangemap field=latest(attributevalue) low=0-2500 elevated=2500-2750 severe=2750-3000 default=none
My goal is to use the $il_env$ wildcard to do an if/then statement. If host=production , the search will use attributeID=366 . If the host=demo , the search will use attributeID=912 .
Any help would be greatly appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-10-2022
01:01 PM
|
