Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About tdiestel
tdiestel
Path Finder
Member since:
07-03-2014
06-05-2020
Community Statistics
| Posts | 37 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 26 |
| Member Since | 07-03-2014 |
Activity Feed
- Got Karma for Re: Emulating FULL OUTER JOIN. 03-04-2022 01:58 AM
- Karma Re: Batch DB input With a column ID for ktugwell_splunk. 06-05-2020 12:48 AM
- Got Karma for Re: Batch DB input With a column ID. 06-05-2020 12:48 AM
- Got Karma for Using EventHandler with MultiSelectInput. 06-05-2020 12:48 AM
- Got Karma for Re: Emulating FULL OUTER JOIN. 06-05-2020 12:48 AM
- Karma Re: For a Table, display only fields/columns that are NULL AND have them displayed in an order for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Re: Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting different results for essentially the same search?. 06-05-2020 12:47 AM
- Got Karma for How do we handle HTML and NAV labeling with dashboard permissions?. 06-05-2020 12:47 AM
- Got Karma for How do we handle HTML and NAV labeling with dashboard permissions?. 06-05-2020 12:47 AM
- Got Karma for Re: Duplicate labels causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: How to have dynamic form inputs/prompts reset their values to default upon selecting a new input of the Parent prompt?. 06-05-2020 12:47 AM
- Got Karma for How to have dynamic form inputs/prompts reset their values to default upon selecting a new input of the Parent prompt?. 06-05-2020 12:47 AM
- Got Karma for How to have dynamic form inputs/prompts reset their values to default upon selecting a new input of the Parent prompt?. 06-05-2020 12:47 AM
- Got Karma for How to have dynamic form inputs/prompts reset their values to default upon selecting a new input of the Parent prompt?. 06-05-2020 12:47 AM
- Got Karma for How to specify a specific field to use as time field while indexing json data. 06-05-2020 12:47 AM
- Got Karma for Re: Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?. 06-05-2020 12:47 AM
- Got Karma for Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?. 06-05-2020 12:47 AM
- Got Karma for Re: Adding Color as a 4th Dimension to Bubble Chart. 06-05-2020 12:47 AM
- Got Karma for Re: Adding Color as a 4th Dimension to Bubble Chart. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 3 | |||
| 0 |
08-02-2024
04:50 AM
absolutely great, because it is also expandable to more than two datasets to be compared. here's what i done for a "triff":
index=a | stats count by PSP_Element | rename * as a_* | rename a_PSP_Element as PSP_Element | eval a=1
| append [ | inputlookup koop_aws_spitz_zahlen PSP_Element=* | rename * as b_* | rename b_PSP_Element as PSP_Element | eval b=1 ]
| selfjoin max=0 keepsingle=yes PSP_Element
| append [ | makeresults format=csv data="PSP_Element F-330751 F-330755 F-330758 "
| rename * as c_* | rename c_PSP_Element as PSP_Element | eval c=1 ]
| selfjoin max=0 keepsingle=yes PSP_Element
| where isnull(a) OR isnull(b) OR isnull(c)
| eval x = coalesce(b_PLAN,a_Preis) | sort - x | fields - x
| fields PSP_Element c a b *
... View more
08-27-2017
05:25 AM
@tdiestel, Since the multiselect value just assigns the first selected value as token and ignores the remaining selected multivalues.
Following JavaScript can be used to iterate through the multi values and return selected comma separated values.
PS: The example is from HTML Dashboard, but the same can be modified for SplunkJS as well.
input2.on("valueChange", function(e) {
var loopCounter;
for(loopCounter=0;loopCounter<e.data.length;loopCounter++)
{
var tmpMultiValue;
if (e.value[loopCounter] !== undefined) {
if(tmpMultiValue == undefined){
// First time initialize temporary multivalued data
tmpMultiValue=e.value[loopCounter];
}else{
// Prepare comma separated multivalued data
tmpMultiValue=tmpMultiValue+","+e.value[loopCounter];
// Original code untouched.
// Sets first value. If iterated over data objects (cumulative) this might populate multivalued data.
EventHandler.setToken("multiSelect", "$value$", {}, e.data);
}
}
}
// Custom multi valued token multiValue set using SplunkJS Token Handler.
// May need to change from default to submitted Token handler as required.
var tokens = mvc.Components.get("default");
tokens.set("multiValue", tmpMultiValue);
});
Once multiValue token is populated the same can be passed to a dummy Splunk Search to iterate and split as multi valued using comma and then expanded as single value results.
... View more
12-03-2015
09:45 AM
Then you asked the wrong question. See what @jeffland said.
... View more
11-30-2015
04:45 AM
There is no built-in function in splunk to send text messages as far as I know, so you'll have to rely on a third party for that - my first find was Tropo, for instance, but you'll be sure to find what you need with google.
To use something like this from a splunk dashboard, I could imagine it's as simple as adding an <html> tag to define a button and call some javascript when it's clicked. You could also pass any search results to js either via tokens, from a drilldown action or from the search directly.
... View more
11-25-2015
01:16 PM
I do not see any way that a base search can be limited at all. Please educate us on this limit!
... View more
10-03-2015
10:43 AM
Looking at some of the other JSON answers, I tried setting KV_MODE=auto_escaped but that did not eliminate the issue in my testing.
So you'll need to set up field extractions as somesoni2 suggested.
Example (assuming data above is the exact event format):
^(?:[^=\n]*=){3}(?P<actionparams>.+)
You'll have to adjust the regex if there's more data following the action_params KV pair that has similar KV pairs to extract.
If you have the option to modify the log format of these messages, it seems like the best way would be to remove the quotes before the brackets. That turns the events into legal JSON, so they should be automatically extracted.
... View more
07-02-2015
08:03 AM
This worked like a charm. Thank you Martin! I would have and have been beating my head in on this one.
... View more
06-01-2017
08:17 AM
And apparently, this was asked 2 years ago.. damn you answers for bubbling this to the top.
... View more
02-11-2016
05:39 AM
Is it resolved now? we are using 6.3.2 and still facing the same problem
... View more
06-11-2015
02:43 PM
Your other option would be to create two versions of the dashboard (one with the restricted panel, one without it), and set role-based permissions on the two views. But, who wants to maintain two versions of a dashboard? 😉
... View more
06-12-2015
12:10 AM
1 Karma
Basically you need two things: find the current user's role and make the display of that promt dependent on the result of that. The second part is really easy, there's a depends tag in XML you can use for that; see more here.
For the first, you can get that information as explained here for example.
... View more
06-04-2015
03:42 PM
To be clear Tyler's Dashboard does work to give a correct label. It's now setting that as my default dashboard of the App that's the problem.
Although you're answer has inspired me to just rename the my html name cleaner user '-'. Tyler-s-Dashboard, which works for now so thank you. And i do appreciate you taking the time to answer this question. Although would be better if I could achieve the ultimate goal.
... View more
08-06-2015
05:38 PM
As @rphillips said, you can use a configuration like this:
props.conf
[yourSourcetypeHere]
INDEXED_EXTRACTIONS = JSON
TIMESTAMP_FIELDS = end_date, timezone
Then put this on your forwarders and restart the Splunk instances and it should work.
Yes, I deliberately used end_date instead of start_date . Trust me: this definitely is the correct choice. If you need me to explain why, I will.
... View more
05-19-2015
06:41 AM
Hi,
If there is no need/requirement for local indexing, it can be disabled:
Go to Splunk install directory
cd bin
./splunk disable local-index
./splunk restart
You can explicitly define your data inputs in your inputs and outputs.conf. Assuming it's a Linux env and you are using default ports..Eg:
inputs.conf
[script:///Path to your script]
disabled = false
interval = your_interval (cron or secs)
sourcetype = your_sourcetype
index = your_index_on_cluster
outputs.conf
[indexAndForward]
index = false
[tcpout]
defaultGroup = your-group
[tcpout:your-group]
server=idx1:9997,idx2:9997,idx3:9997
... View more
05-26-2020
07:59 AM
Your query is returning values for the Label and values for the Value. At least two different Label values correspond to the exact same Value value. That's the issue causing this warning. Your code will still work (hence warning, rather than error.) There are many ways to solve it. In my case it's really the logged records that were wrong, not the Splunk query, so I left it alone but asked for a fix to the logging.
... View more
02-27-2015
08:34 PM
2 Karma
Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.
If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"
-Tyler
... View more
02-17-2015
11:01 AM
2 Karma
Works great! thank you for helping me out with this.
here's my code for a reference:
App Usage
This Dashboard gives a full overview of many different App components.
<input type="dropdown" token="date" searchWhenChanged="true">
<label>Select a Date</label>
<search>
<query>index=index_1 source="dbmon-tail://db_1/new_timepicker"| dedup id| fields id title earliest latest|sort - id</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>title</fieldForLabel>
<fieldForValue>earliest</fieldForValue>
<default>@d</default>
<change>
<set token="latest_test">$row.latest$</set>
<set token="earliest_test">$row.earliest$</set>
</change>
</input>
.....
<panel>
<chart>
<title>Overall App Usage Trend Chart</title>
<searchString>index=index_2|stats count
<earliestTime>$earliest_test$</earliestTime>
<latestTime>$latest_test$</latestTime>
ellipsisNone
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">true</option>
<option name="charting.axisY2.scale">linear</option>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.axisTitleY2.text">Actions per User</option>
<option name="charting.chart.overlayFields">"Actions per User"</option>
</chart>
</panel>
... View more
06-23-2019
11:04 PM
Hey, can you share the code?
... View more
10-30-2014
12:39 PM
The permissions to the specific indexes are kept, you just have to ensure that the users permissions enable them to use accelerated searches and data models.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
