Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kelz
kelz
Explorer
Member since:
10-01-2019
02-08-2025
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 10-01-2019 |
Activity Feed
- Karma Re: Search time or Index time for gcusello. 08-24-2022 01:17 AM
- Posted Re: Search time or Index time on Getting Data In. 08-24-2022 01:16 AM
- Posted Search time or Index time- What would be the best practices in this scenario? on Getting Data In. 08-23-2022 09:29 PM
- Got Karma for Re: tstats dynamic way to set the value on index to prevent wildcard. 06-03-2022 08:24 AM
- Posted Re: tstats dynamic way to set the value on index to prevent wildcard on Splunk Search. 06-03-2022 06:05 AM
- Posted Whaat is the tstats dynamic way to set the value on index to prevent wildcard? on Splunk Search. 06-02-2022 11:30 PM
- Posted How to update the table token results depending on the dynamic token selected on radio and passit to multiple link list? on Splunk Search. 05-25-2022 06:48 PM
- Tagged How to update the table token results depending on the dynamic token selected on radio and passit to multiple link list? on Splunk Search. 05-25-2022 06:48 PM
- Tagged How to update the table token results depending on the dynamic token selected on radio and passit to multiple link list? on Splunk Search. 05-25-2022 06:48 PM
- Tagged How to update the table token results depending on the dynamic token selected on radio and passit to multiple link list? on Splunk Search. 05-25-2022 06:48 PM
- Posted How to apply the field color on the table results with multi-value fields based on the first value on Splunk Dev. 03-03-2022 08:22 AM
- Tagged How to sort this multi-value fields based on the latest timestamp and status? on Splunk Search. 03-03-2022 08:10 AM
- Tagged How to sort this multi-value fields based on the latest timestamp and status? on Splunk Search. 03-03-2022 08:09 AM
- Tagged How to sort this multi-value fields based on the latest timestamp and status? on Splunk Search. 03-03-2022 08:09 AM
- Posted How to sort this multi-value fields based on the latest timestamp and status? on Splunk Search. 03-03-2022 08:08 AM
- Tagged How splunk create a checksum for each deployment app bundle? on Deployment Architecture. 09-22-2021 12:26 AM
- Posted Re: How splunk create a checksum for each deployment app bundle? on Deployment Architecture. 09-21-2021 10:33 PM
- Posted How splunk create a checksum for each deployment app bundle? on Deployment Architecture. 09-21-2021 08:42 PM
- Posted Re: Grouping of value on Splunk Search. 09-19-2021 11:39 PM
- Posted Grouping of value on Splunk Search. 09-09-2021 06:52 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-24-2022
01:16 AM
Hello Giuseppe, With regards to this topic you've listed "how to extract logs from html" i already did it with the sample query I provided via search time. I'm just curious what would be the best approach/practices in extracting some data in the given scenario. Appreciate your response, it gives me more clarity about what approach I need to use for that . I'll be using search time field extraction then, since only a few data is in the CSV file. Thanks again!
... View more
08-23-2022
09:29 PM
Hi Splunkers,
Need help on translating this search query to splunk configuration via props/transform.
To give some context, the letter field was extracted via csv.
"letter" field value is dynamic. It should have less/more value.
And the value is in the html tag format.
syntax: <p>"value"</p>
What would be the best practices in this scenario? Should I go with the method of search time or via index time?
Sample query:
| makeresults
| eval letter = "<p>A</p><p>B</p><p>C</p><p>D</p>"
| eval letter = replace(letter,"<p>","")
| eval letter = replace(letter,"</p>","__")
| makemv delim="__" letter
Expected output:
letter A B C D
... View more
Labels
- Labels:
-
CSV
-
field extraction
-
props.conf
-
transforms.conf
06-03-2022
06:05 AM
1 Karma
Thank you so much @rymundo_splunk it works!
... View more
06-02-2022
11:30 PM
Hi Splunkers, I was wondering if this is possible on tstats command. Get the dynamic value from savedsearch result or lookup? savedsearch or lookup is updating every hour.
| tstats max(_time) as last_updated WHERE index=* BY index, host
To avoid wildcard.. I was thinking it will be efficient if that is possible. Appreciate any response.. Thanks!
... View more
- Tags:
- dynamic
- splunk-search
Labels
- Labels:
-
tstats
05-25-2022
06:48 PM
Hi Splunkers,
Is it possible to make a dynamic token results based on the radio and multiple link with same token value. I want to achieve a result like this. If I click value "1" on the radio button, link 1 input will show up and the default value for this link input will pass on the table input it should be "A". If I change the value "1" to value "2", link 2 input will show up and default value for it will update the table it should be "D" Below is my sample query. Appreciate your help on this. Thanks inadvance! <form> <label>Multi Link Input</label> <fieldset submitButton="false"> <input type="radio" token="select_link" searchWhenChanged="true"> <label>Select Link List</label> <choice value="1">1</choice> <choice value="2">2</choice> <change> <condition value="2"> <set token="show_2">true</set> <unset token="show_1"></unset> </condition> <condition value="1"> <set token="show_1">true</set> <unset token="show_2"></unset> </condition> </change> <default>1</default> </input> <input type="link" token="select" searchWhenChanged="true" depends="$show_1$"> <label>1</label> <choice value="A">A</choice> <choice value="B">B</choice> <choice value="C">C</choice> <default>A</default> </input> <input type="link" token="select" searchWhenChanged="true" depends="$show_2$"> <label>2</label> <choice value="D">D</choice> <choice value="E">E</choice> <choice value="F">F</choice> <default>D</default> </input> </fieldset> <row> <panel> <event> <search> <query>| makeresults | eval $select$ = "$select$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>
... View more
03-03-2022
08:22 AM
Is it possible to apply the color based on the first value on the multi-value fields? Below is the sample data. If the first value of server_status is Online then the field color should turn into green else the color will be red. hostname server_status server101 Online Offline (31 days ago) hostname server_status server101 Offline (31 days ago) Online
... View more
Labels
- Labels:
-
visualization
03-03-2022
08:08 AM
Hi Splunkers,
I need help on how to sort this multi-value fields based on the latest timestamp and status.
Here's my dummy query for this. | makeresults | eval hostname = "server101" | eval id = "123|124" | eval database_timestamp = "Mar 03, 2022 12:59:46 PM|Feb 23, 2022 1:19:24 PM" | eval database_status = "Online|Offline (30 days ago)" | eval server_timestamp = "Feb 22, 2022 1:19:24 PM|Mar 01, 2022 12:59:46 PM" | eval server_status = "Offline (31 days ago)|Online" | fields hostname id database_timestamp database_status server_timestamp server_status | makemv delim="|" database_timestamp | makemv delim="|" database_status | makemv delim="|" server_timestamp | makemv delim="|" server_status | makemv delim="|" id
Below is the sample output and expected output.
Current Output:
hostname
database_timestamp
database_status
server_timestamp
server_timestamp
server101
Mar 03, 2022 12:59:46 PM Feb 23, 2022 1:19:24 PM
Online Offline (30 days ago)
Feb 22, 2022 1:19:24 PM Mar 01, 2022 12:59:46 PM
Offline (31 days ago) Online
Expected Output:
hostname
database_timestamp
database_status
server_timestamp
server_status
server101
Mar 03, 2022 12:59:46 PM Feb 23, 2022 1:19:24 PM
Online Offline (30 days ago)
Mar 01, 2022 12:59:46 PM Feb 22, 2022 1:19:24 PM
Online Offline (31 days ago)
... View more
09-21-2021
10:33 PM
Hi @danielcj, Appreciate your response that configuration is helpful for multiple deployment server setup. But I'm not looking for specific configuration. Something like the md5sum command in Linux to check the file hashes but instead of hashes result I'm looking for a Linux command that would give the result of checksum that Splunk created for each deployment app bundle.
... View more
09-21-2021
08:42 PM
Aside, from how splunk create a checksum for each deployment app bundle. Is there command via linux CLI that you can cross check the same numerical value created for each deployment app bundle? I know we can check it via serverclass.xml on the deployment client side.
... View more
- Tags:
- deployment app
Labels
- Labels:
-
deployment client
-
deployment server
09-09-2021
06:52 PM
Hello guys, I need help building the query for this value to group it like the output I have given below. Current: apple1 apple-orange apple-yellow banna123 banna-red banna-orange Output: apple* banna*
... View more
10-01-2019
07:53 AM
Hi wlandymore,
There are two possible search for you to substituted based on the value you want to see.
First: Make use of case statement then *eval the * field name you want to replaced based on the condition you want set.
| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Number= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
Second: You can just hide the Number field
| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Grade= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
| fields - Number
I hope this help...
Kelz
... View more
10-01-2019
07:12 AM
Hi Balcv,
I used index="_internal" since i haven't index="main" on my Splunk environment and just rename it to "index=main". Basically to answer your question, you can manually assign whatever color you want depending on the field name in your search. To do that you need to add new option name parameters for "charting.fieldColors" on your XML Dashboard.
<option name="charting.fieldColors">{"wineventlog":0xFF0000, "main":0x008000}</option>
Hex color values:
FF0000 = Red
008000= Green
Below is the search string i used.
index="_internal" OR index="wineventlog"
| chart count AS total BY host, index
| rename "VALUE_internal" AS "main"
Try this full XML Code below so you can see and test it..
<dashboard>
<label>Column Chart (Manual change color depending on the field name on XML)</label>
<row>
<panel>
<chart>
<search>
<query>index="_internal" OR index="wineventlog"
| chart count AS total BY host, index
| rename "VALUE_internal" AS "main"</query>
<earliest>-5m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.axisY.scale">log</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"wineventlog":0xFF0000, "main":0x008000}</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
</row>
</dashboard>
Let me know if this answer your question. Thanks
Kelz
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-08-2025
05:54 AM
|
