Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shandr
shandr
Path Finder
Member since:
09-11-2019
02-22-2023
Community Statistics
| Posts | 27 |
| Solutions | 4 |
| Karma Given | 67 |
| Karma Received | 3 |
| Member Since | 09-11-2019 |
Activity Feed
- Posted Re: Does anyone know how to edit/create ITSI Entity Dashboard? on Dashboards & Visualizations. 02-08-2023 08:26 PM
- Karma Re: How do I create an entity dashboard for my entity type? for manu_giriyappa. 02-08-2023 08:10 PM
- Karma Re: Struggling with ingest-time lookup for PickleRick. 01-17-2023 08:58 PM
- Karma Re: Do we need a license for Heavy forwarder..? for lguinn2. 12-04-2022 02:56 PM
- Karma Re: Splunk 8 python 2.7 for an app for gdaly_splunk. 12-04-2022 02:11 PM
- Posted Re: Set token from search on glass table on Dashboards & Visualizations. 07-12-2022 06:57 PM
- Tagged Re: Set token from search on glass table on Dashboards & Visualizations. 07-12-2022 06:57 PM
- Karma Re: HTTP Event Collector: Getting error "HttpInputDataHandler - Parsing error". for rphillips_splk. 07-06-2022 07:14 PM
- Karma Re: How to split a multi-line _raw to a multivalue with one line of text per element? for somesoni2. 07-04-2022 06:38 PM
- Karma Re: How to sum numbers with commas for dwaddle. 06-29-2022 12:25 AM
- Karma Re: What is the difference between bandwidth.sh and interfaces.sh in Splunk *nix Add-On? for Azeemering. 06-05-2022 06:50 PM
- Karma Re: Export episodes from ITSI to CSV for lperini_splunk. 05-30-2022 09:55 PM
- Posted Re: How do I list ITSI correlation searches in json format? on Splunk IT Service Intelligence. 05-23-2022 09:32 PM
- Posted Re: What is the correct REST endpoint to list ITSI correlation searches? on Splunk IT Service Intelligence. 05-23-2022 09:27 PM
- Got Karma for Re: list of adhoc kpis via REST ?. 04-11-2022 09:58 PM
- Posted Re: list of adhoc kpis via REST ? on Splunk IT Service Intelligence. 04-10-2022 07:56 PM
- Karma Re: LIKE() with wildcard within an IF statement for rey123. 03-30-2022 09:16 PM
- Karma Re: Is there a search or other way to easily list the indexes I am permissioned to search? for alacercogitatus. 03-22-2022 03:58 PM
- Karma Re: How to search for a field name that a value exists for? for woodcock. 03-21-2022 10:56 PM
- Got Karma for Re: I there an option to create dropdown input from "inputlookup" in Dashboard Studio?. 03-08-2022 08:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-08-2023
08:26 PM
This question is answered here. h/t @manu_giriyapp host=forms.host_tok
... View more
07-12-2022
06:57 PM
Depending on your version, https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/DashStudio/searchTokens#Example_of_setting_a_token_from_search_results "ds_m45g5mF6": {
"type": "ds.search",
"options": {
"query": "index=_internal \n| stats count by sourcetype",
"enableSmartSources": true
},
"name": "Activity by Sourcetype"
... View more
- Tags:
- n
05-23-2022
09:32 PM
Thanks for your tip how we can use /count. Try this technique if you want to extract the details of your Correlation Searches: https://community.splunk.com/t5/Splunk-IT-Service-Intelligence/What-is-the-correct-REST-endpoint-to-list-ITSI-correlation/m-p/599005#M2521
... View more
05-23-2022
09:27 PM
Hopefully my reply below is useful for anybody who also finds themselves reading this old post. The technique provided by @atsviatkou_splu is useful--and it has guided me how to get a complete result. However it was only returning a subset of my Correlation Searches. I now get them all with the SPL below. 1. Correlation Search count | rest splunk_server=local "/services/event_management_interface/correlation_search/count" report_as=text
| spath input=value
| fields count 2. Correlation Search details | rest splunk_server=local "/services/event_management_interface/correlation_search" report_as=text
| eval as_json=spath(value,"{}")
| fields as_json
| mvexpand as_json
| eval name=spath(as_json, "name")
| eval search=spath(as_json, "search")
| table name search
... View more
04-10-2022
07:56 PM
1 Karma
Hopefully you figured it out long ago. Below to help others who end up here. Use the Service KPI endpoint to retrieve the ad hoc search query. Field name is kpis.search. Example below. | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/service report_as=text filter="{\"enabled\":1}" fields="_key,title,kpis._key,kpis.title,kpis.base_search_id,kpis.base_search,kpis.alert_period,kpis.unit,kpis.aggregate_statop,kpis.entity_statop,kpis.threshold_field,kpis.entity_breakdown_id_fields,kpis.is_entity_breakdown,kpis.search" API Reference https://docs.splunk.com/Documentation/ITSI/4.12.0/RESTAPI/ITSIRESTAPIschema#Service_KPI
... View more
02-28-2022
03:54 PM
Let's imagine your data looks something like this: | gentimes start="03/01/2020 0:00:00" end="03/02/2020" increment=15m | streamstats count as id | eval value = if(id<10, random() % 16, 0) | rename starttime as _time | table _time value Then add a running total with streamstats like this: | rename value as downtime_in_min | eval uptime_in_min = 15 - downtime_in_min | streamstats sum(downtime_in_min) as RUNNING_TOTAL_downtime_in_min, sum(uptime_in_min) as RUNNING_TOTAL_uptime_in_min | table _time downtime* uptime* RUNNING_TOTAL*
... View more
02-28-2022
02:35 PM
1 Karma
Check out this JSON dashboard code, which is populating a dropdown input from a search called search1: https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/inputs#Adding_and_configuring_inputs
... View more
08-18-2021
07:55 PM
I have used below syntax so a panel will stay hidden until 2 or more conditions have been met. Hopefully helps. <panel depends="$isLinux$$isHealthy$"> That panel only shows when both tokens have a <set> value. If any token is <unset> then that panel is hidden.
... View more
08-10-2021
05:37 PM
You can use match() to scan all of _raw on every event. If you look for "WARN" then it will find "WARNING". If I was doing this I would instead give my sourcetype/search a field called log_level (in case _raw is long). <dashboard> <label>test_conditional_color</label> <row> <panel> <html> <style> #tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableRowColorWithoutJS"> <title>We can color columnA based on whichever Log Level we see in columnB </title> <search> <query> index=_internal log_level!="INFO" | fields index sourcetype host _raw | streamstats count as id | table id a_new_field* * | eval hex_color = case(match(_raw,"ERROR"),"red", match(_raw,"INFO"),"green", true(),"amber") | foreach * hex_color [| eval "<<FIELD>>"='<<FIELD>>'."|".hex_color] | foreach * [| eval "<<FIELD>>"=split('<<FIELD>>',"|")] | fields index sourcetype host _raw </query> <earliest>-1h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="host"> <colorPalette type="expression">case (match(value,"red"),"#DC4E41", match(value,"green"),"#53a051", true(),"#f4a747")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more
08-04-2021
07:11 PM
Try below. Seems simpler. No need for OP's eval technique. Had to use initialValue and not default. <input type="checkbox" token="showhide_choice_tok" searchWhenChanged="true"> <label></label> <choice value="yes">I want panels</choice> <change> <condition value="yes"> <set token="show_panels_tok">show</set> </condition> <condition> <unset token="show_panels_tok"></unset> </condition> </change> <delimiter> </delimiter> <initialValue>yes</initialValue> </input>
... View more
06-29-2021
07:31 PM
Excuse my super late reply. Below may help those who arrive here after me. Be careful to check that your html is referencing your stanza name - not your app name. <splunk-search-dropdown name="action.[stanza_name].param.[param_name]"... Below is how to extend the "logger_app" example in docs to add a dropdown. User's choice is sent to script. logger.html <form class="form-horizontal form-complex"> <p>Write log entries for this action.</p> <splunk-search-dropdown name="action.logger.param.mychoice1" search=" | inputlookup alert_action_dropdown1.csv | stats c by foo1" value-field="foo1" label-field="foo1"/> </form> alert_actions.conf [logger] is_custom = 1 disabled = 0 label = Log alert action description = Custom action for logging fired alerts icon_path = logger_logo.png param.mychoice0=This param is hardcoded. Look, I can use a token: $result.host$ #param.mychoice1=This param comes in from your stanza in savedsearches.conf. #savedsearches.conf: action.logger.param.mychoice1=User picks from the UI. See logger.html Output in test_modalert.log then looks like: ...</search_name> <configuration> <stanza name="test_alert_action_logger_with_added_dropdown1"> <param name="mychoice0">This param is hardcoded. Look, I can use a token: </param> <param name="mychoice1">splunk2</param> </stanza> </configuration> <result>...
... View more
03-31-2021
03:28 PM
Does anybody know what my inputs.conf setting for filter_data must look like for a key-value like below? I cannot find any detailed documentation on filter_data. And see same error when I try to use URL encoding. [snow://pa_job_logs4_javascript] table = pa_job_logs filter_data = run_time>javascript:gs.getDurationDate('0 3:0:0')&sys_created_onONLast 3 months@javascript:gs.beginningOfLast3Months()@javascript:gs.endOfLast3Months() 2021-03-31 18:04:32,776 ERROR pid=22626 tid=MainThread file=snow.py:_check_filter_data:74 | Got unexpected value run_time>javascript:gs.getDurationDate('0 3:0:0')&sys_created_onONLast 3 months@javascript:gs.beginningOfLast3Months()@javascript:gs.endOfLast3Months() of 'filter_data' field for input 'pa_job_logs4_javascript'. Enter filter parameters in key1=value1&key2=value2 format. You can either change it in inputs.conf file or edit 'Filter parameters' on Inputs page. Above table filter seems to work with the REST API Explorer in Service Now, i.e. sysparm_query=run_time.... Is there some trick to simplify it? or a work-around? Splunk Add-on for ServiceNow version 4.0.0
... View more
Labels
- Labels:
-
configuration
03-18-2021
05:09 PM
Seems for Logical AND operation you must use ampersand ("&"). Not a comma (","). Check for your TA version. Refer to https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs
... View more
01-06-2021
05:45 PM
Clever solution. Thank-you. Tiny bug on this line: | foreach * [| eval "<<FIELD>>"='<<FIELD>>'."|".log_level] Should be: | foreach * log_level [| eval "<<FIELD>>"='<<FIELD>>'."|".log_level] Or each field that is being processed after log_level field (alphanumerically) is being given log_level 2 times. And if you notice a field value is being given a comma (',') instead of a pipe ('|') then rename it before foreach. | rename latest_time as latest_time2
... View more
01-05-2021
09:45 PM
Sorry to bump old post. Solution suggested by @niketnlay has solved it. Splunk Enterprise 8.0.5. This is the key concept: <table><format><colorPalette type="expression"> I had no luck with simply putting a token into the code the UI is generating for us: <colorPalette type="list"><scale type="threshold"> Below example works. <table>
...
<format type="color" field="age_in_mins">
<colorPalette type="expression">if(value >=
$threshold_in_mins_tok$,"#DC4E41", "#53A051")</colorPalette>
<!--colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">$threshold_in_mins_tok2$</scale-->
</format>
</table>
... View more
08-31-2020
11:57 PM
New link is https://docs.splunk.com/Documentation/Splunk/8.0.5/Updating/Forwardermanagementcompatibility#List_of_incompatibilities
... View more
07-07-2020
04:56 PM
SAI 2.1.0+ has replaced collectors.conf with entity_classes.conf Refer to https://docs.splunk.com/Documentation/InfraApp/2.1.0/Install/NewEntitySchema For Windows [perfmon] see https://community.splunk.com/t5/forums/replypage/board-id/apps-add-ons-all/message-id/59094
... View more
07-07-2020
04:56 PM
SAI 2.1.0+ has replaced collectors.conf with entity_classes.conf Refer to https://docs.splunk.com/Documentation/InfraApp/2.1.0/Install/NewEntitySchema For Linux [os] see https://community.splunk.com/t5/forums/replypage/board-id/apps-add-ons-all/message-id/59094
... View more
06-22-2020
02:09 AM
In later versions, Splunk Enterprise,->Settings->Forwarding and receiving->Configure receiving. e.g. 7.3.5.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-22-2023
01:48 AM
|
Karma given to
