Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pipipipi
pipipipi
Path Finder
Member since:
07-30-2019
10-13-2020
Community Statistics
| Posts | 38 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 0 |
| Member Since | 07-30-2019 |
Activity Feed
- Posted How to change token value? on Splunk Enterprise. 10-12-2020 08:03 PM
- Tagged How to change token value? on Splunk Enterprise. 10-12-2020 08:03 PM
- Posted More Page feed will be appear than the search results on Dashboards & Visualizations. 07-30-2020 12:10 AM
- Posted Re: Heatmap - Custom Visualization on Dashboards & Visualizations. 06-16-2020 07:19 PM
- Posted Heatmap - Custom Visualization on Dashboards & Visualizations. 06-15-2020 05:00 PM
- Karma Re: cutom alert action python script for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Which Deployer Push Mode for 13tsavage. 06-05-2020 12:51 AM
- Karma Re: splunk DB connect Execution Frequency for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: splunk DB connect Execution Frequency for inventsekar. 06-05-2020 12:50 AM
- Karma Re: splunk syndication input do not show for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Extracting words in a string with regular expressions for vnravikumar. 06-05-2020 12:50 AM
- Karma Re: Extracting words in a string with regular expressions for jpolvino. 06-05-2020 12:50 AM
- Karma Method to rename field to value of another field for dstaulcu. 06-05-2020 12:47 AM
- Karma Re: Method to rename field to value of another field for vasanthmss. 06-05-2020 12:47 AM
- Posted Re: how much Splunkd of the universal forwarder uses windows memory and CPU? on Getting Data In. 05-25-2020 03:50 AM
- Posted How to represent fluctuating values? on Splunk Search. 05-25-2020 03:50 AM
- Tagged How to represent fluctuating values? on Splunk Search. 05-25-2020 03:50 AM
- Tagged How to represent fluctuating values? on Splunk Search. 05-25-2020 03:50 AM
- Posted how much Splunkd of the universal forwarder uses windows memory and CPU? on Getting Data In. 05-19-2020 02:39 AM
- Tagged how much Splunkd of the universal forwarder uses windows memory and CPU? on Getting Data In. 05-19-2020 02:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-12-2020
08:03 PM
Hi all, I'm in trouble because the value of the fields tag doesn't change when the dropdown changes. <input type="dropdown" token="tk_report">
<label>month</label>
<fieldForLabel>reporting_month</fieldForLabel>
<fieldForValue>reporting_month</fieldForValue>
<search>
<query>| makeresults
| eval reporting_month=mvrange(relative_time(now(),"- 5mon@mon"),now(),"1mon")
| table reporting_month
| mvexpand reporting_month
| eval reporting_month=strftime(reporting_month,"%Y-%m")
| sort - reporting_month</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<change>
<eval token="reporting_month1">strftime(relative_time(strptime($value$."-01","%Y-%m-%d"),"-1mon"),"%Y-%m")</eval>
<eval token="reporting_month2">strftime(relative_time(strptime($value$."-01","%Y-%m-%d"),"-2mon"),"%Y-%m")</eval>
</change>
<selectFirstChoice>true</selectFirstChoice>
</input> This is table option <option name="count">10</option>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<fields["$reporting_month2$","$reporting_month1$","$tk_report$"]</fields> I think the first token remains. but I have no idea to solve this problem. Is there anyone know how to solve this problem? Thank you for helping.
... View more
- Tags:
- dashboard
Labels
- Labels:
-
troubleshooting
08-08-2020
06:40 AM
@pipipipi for the community to assist you better please provide more details. You can mock/anonymize any sensitive information. What is your current SPL, can you share some data? What is the drilldown code and behavior (does it run search in new window or set required token for drilldown panel search)? Typically, although Single Value shows one value in the panel, its underlying search can be a time series data which is required to show the sparkline trend and only the latest value is displayed as the result. Also when we do drilldown to search without coding the tokens/values ourselves, it runs the underlying search which may give events from the previous pipe, hence return more results.
... View more
06-16-2020
10:23 PM
Hi @pipipipi I used Browser Inspector to identify the CSS Selector. You can refer to one of my older answers with the steps: https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-update-panel-color-in-Splunk-using-CSS/td-p/364590 Also do read the Clara-fication blog by @cmerriman on CSS in Simple XML Dashboards demystification!
... View more
05-25-2020
09:46 AM
@pipipipi check out the accum command in Splunk Documentation. You just need to add | accum c as d to your existing search. However, there can be some performance improvements (refer below):
<yourSearchToFetchData>
| fields a b date
| stats sum(a) as a sum(b) as b by date
| eval c=a-b
| accum c as d
... View more
05-25-2020
03:50 AM
Thank you. I will try it.
... View more
04-23-2020
03:10 AM
Thank you so much. I should add "day"...I understand.
Thank you so much.
... View more
05-07-2020
06:52 AM
You can add in props.conf following entry:
[ms:o365:reporting:messagetrace]
TZ = Zulu
... View more
04-13-2020
06:07 PM
<form>
<label>dropdown</label>
<search id="base">
<query>
|makeresults
|eval command="sendmail"
</query>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="test" searchWhenChanged="true">
<label>test</label>
<choice value="hogehogehoge1">ALL</choice>
<choice value="hogehogehoge2">ALL2</choice>
<choice value="hogehogehoge3">ALL3</choice>
<default>ALL</default>
<prefix>(</prefix>
<suffix>)</suffix>
<change>
<set token="label1">$label$</set>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base">
<query>|eval to="hogehoge", subject="test", message="select is $label1$"</query>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
How about this?
... View more
03-12-2020
07:42 PM
Like this:
#index OR lookup table#
| rex mode=sed field=year "s/^/Year_20/"
| transpose header_field=year column_name=Month
| eval increase = round(((Year_2020 / Year_2019) * 100), 1) . "%"
... View more
03-16-2020
04:02 AM
It auto-ranges the output but keeps the actual value as seconds stored as a number (unitless).
... View more
02-17-2020
11:49 PM
Thank you for hepling me.
I also found another way.( in this time, I use Add-on builder.)
events = helper.get_events()
for event in events:
helper.log_info("event={}".format(event))
... View more
02-12-2020
06:49 PM
1 Karma
Add exception handling in your script and check if any error occurring in the splunkd logs.
import sys
import os
import requests
import json
def test():
data = { 'name':'username', 'password':'password', 'roles':'user'}
response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
response.raise_for_status()
if __name__ == "__main__":
try:
test()
except Exception as e:
print >> sys.stderr, "ERROR Unexpected error: %s" % e
sys.exit(1)
... View more
08-08-2019
07:02 AM
Hi
Try this
| makeresults
| eval id="https://status.aws.amazon.com/rss/#elb-us-west-1.rss,https://status.aws.amazon.com/rss/#ec2-us-west-1.rss,https://status.aws.amazon.com/rss/#apigateway-ap-northeast-2.rss,https://status.aws.amazon.com/rss/#apigateway-eu-central-1"
| makemv delim="," id
| mvexpand id
| rex field=id "(?P<result>#[^\/]+$)"
| eval result =mvindex(split(result,"-"),0)
... View more
08-07-2019
02:17 AM
you are most welcome, please upvote and accept the answer 🙂
And don't forget to save your config in the startup script or the export won't be there after restart.
Cheers.
... View more
07-31-2019
04:05 AM
1 Karma
The execution frequency is something else, i think.
Execution Frequency: The number of seconds or a valid cron expression i.e. 0 18 * * * (every day at 6PM).
for your issue, add a where clause to your select statement that specifies a timestamp field past week only.
Presumable you could use some sql date function to make the calculation on the fly vs. having to hard code an actual date/time value.
where TIMESTAMP >= '2017-01-01 00:00:00'
If you only need to do it once, then set it up, let it run, and then disable it.
Otherwise, it will run every time execution frequency time passes.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-13-2020
06:40 AM
|
Karma given to
