About lessthan80

lessthan80 · ‎02-12-2024

i'm configuring a classic dashboard in the new dashboard studio and exported a classic dashboard with a drill down search, but unable to find how to configure a search in the dashboard studio. the classic dashboard includes source value that is configured to run a search. In dashboard studio I'm not finding the 'link to search' option. I need to click on the source value and open a new window with the new search of the source value. this is the screen I see in drilldown on dashboard studio -- where do I go next to run a search?

lessthan80 · ‎03-07-2023

I started reviewing both answers and they both appear to be correct. With this information i expect to be able the correct the eventtime problem. Thanks to both.

lessthan80 · ‎03-03-2023

the output in splunk console: 3/3/23 2:05:41.000 AM 03/03/2023 02:05:41 p.m. 14664 5046661 Note that the splunk _time is pulling the timestamp from _raw, but not interpreting the "p.m." so splunk is posting the time of the event as 2:05 AM. I have have tried a few different combinations for the TIME_FORMAT in the props.conf file, and nothing is helping. here is the current TIME_FORMAT stanza [###_###_###_#######] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 26 TIME_FORMAT = %d/%m/%Y %I:%M:%S TIME_PREFIX = ^ category = Custom disabled = false pulldown_type = true EXTRACT-total_processing_time = ^[^\t\n]*\t(?P<total_processing_time>\d+\t) EXTRACT-application_id = ^(?:[^\t\n]*\t){2}(?P<application_id>.+) current TIME_FORMAT TIME_FORMAT = %d/%m/%Y %I:%M:%S I've tried this with %p and %P with no success. Any ideas?

lessthan80 · ‎08-30-2022

i had started looking at documentation for the API and found https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-service-communications-api-reference which states the historical is today - 7 thanks for guiding me to the correct location for the configuration. I will follow up with O365 support to see if this can or should be changed. calling this question answered

lessthan80 · ‎08-30-2022

This specifc Add-on https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs# states The retention period for historical data is 7 days. We had an authentication failure that was not corrected for about 3 weeks; and once corrected these logs did not index anything older than 7 days. I searched the .conf files for any configuration that might have limited the lookback time and did not find any. I'm hoping there is a configuration in this add-on that can be adjusted to pick up these older than 7 days logs. thanks for your input.

lessthan80 · ‎08-30-2022

Splunk Add-on for Microsoft Office 365 -- I'm unable to index files over 7 days old. Where can this configuration be changed in the Add-on? Splunk Add-on for Microsoft Office 365 Version: 2.0.2 Build: 1 Splunk Version:8.1.5

lessthan80 · ‎05-10-2018

Since the line chart does provide a good time stamp and somewhat recognizable as an anomolie, I will present a single dashboard with both line and scatter charts of the same data. If something looks out of place, the charts are using the same color for each job, so it's relatively easy to move between them and determine which event needs attention. Thanks for your help

lessthan80 · ‎05-09-2018

I stared at both column and bar charts for several hours, but could not make sense of that type of representation of individual file size values each time a specific job ran. To make either of those useful would require a separate chart for each job, when a single scatter chart provides an understandable view of all the jobs, quickly illustrating the anomolies for each job. Let's go at it at another angle. Each square value in the scatter chart produces a pop-up as you hover over them. This pop-up includes specific variable values -- How do I include a good timestamp variable inside that pop-up?

lessthan80 · ‎05-09-2018

My goal is to present a scatter chart with the size of a file each time a job runs. This requires 3 values: time, size of file, name of job. I have reviewed much of the documentation about time and timecharts and the best representation I have is with time on the y-axis, size of file on the x-axis and the name of job as the legend. the problem is the time value is in epoch and I have been unable to relate a readable time to this chart. Search saved as a scatter chart index=main sourcetype="MFT_byte_size_data" | table MFT_job_name, MFT_fromFileBytes, timestamp, _time Saved as a scatter chart Data csv file MFT_job_name MFT_fromFileBytes timestamp _time xxxxxxxx - CAD xxxxxxxx UL Sat only 130 1525558529 2018-05-05T17:15:29.000-0500 xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 370 1525659756 2018-05-06T21:22:36.000-0500 xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 50940 1525486960 2018-05-04T21:22:40.000-0500 xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 35580 1525400533 2018-05-03T21:22:13.000-0500 xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 45060 1525314133 2018-05-02T21:22:13.000-0500 xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 40860 1525227747 2018-05-01T21:22:27.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 4049 1525719615 2018-05-07T14:00:15.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 353 1525633211 2018-05-06T14:00:11.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 15473 1525546814 2018-05-05T14:00:14.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 20737 1525460420 2018-05-04T14:00:20.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 20121 1525374057 2018-05-03T14:00:57.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 22473 1525287653 2018-05-02T14:00:53.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 26897 1525201201 2018-05-01T14:00:01.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 2PM New 4217 1525114867 2018-04-30T14:01:07.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 72 1525651216 2018-05-06T19:00:16.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 3769 1525478474 2018-05-04T19:01:14.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 3993 1525392038 2018-05-03T19:00:38.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 4441 1525305625 2018-05-02T19:00:25.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 4889 1525219222 2018-05-01T19:00:22.000-0500 xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 5561 1525132818 2018-04-30T19:00:18.000-0500 xxxxxxxx - CAN-xxxxxxxx UL new path on FIS side Sat only 15473 1525558529 2018-05-05T17:15:29.000-0500 xxxxxxxx - US xxxxxxxx UL Sat only 130 1525558529 2018-05-05T17:15:29.000-0500 xxxxxxxx - US xxxxxxxx UL Sun-Fri 10288060 1525659756 2018-05-06T21:22:36.000-0500 xxxxxxxx - US xxxxxxxx UL Sun-Fri 14757070 1525486960 2018-05-04T21:22:40.000-0500 xxxxxxxx - US xxxxxxxx UL Sun-Fri 10684390 1525400533 2018-05-03T21:22:13.000-0500 xxxxxxxx - US xxxxxxxx UL Sun-Fri 10858010 1525314133 2018-05-02T21:22:13.000-0500 xxxxxxxx - US xxxxxxxx UL Sun-Fri 13944050 1525227747 2018-05-01T21:22:27.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 584438 1525719615 2018-05-07T14:00:15.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 72 1525633211 2018-05-06T14:00:11.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 72 1525546814 2018-05-05T14:00:14.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 411325 1525460420 2018-05-04T14:00:20.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 346750 1525374057 2018-05-03T14:00:57.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 348905 1525287653 2018-05-02T14:00:53.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 388810 1525201201 2018-05-01T14:00:01.000-0500 xxxxxxxx - US-xxxxxxxx UL 2PM New 545209 1525114867 2018-04-30T14:01:07.000-0500 xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 72 1525651216 2018-05-06T19:00:16.000-0500 xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 253468 1525478474 2018-05-04T19:01:14.000-0500 xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 234053 1525392038 2018-05-03T19:00:38.000-0500 xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 203982 1525305625 2018-05-02T19:00:25.000-0500 xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 250691 1525219222 2018-05-01T19:00:22.000-0500 xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 188952 1525132818 2018-04-30T19:00:18.000-0500 xxxxxxxx - US-xxxxxxxx UL new path on FIS side Sat only 72 1525558529 2018-05-05T17:15:29.000-0500 Below is a good presentation of how I want the data to look, but the timestamp values mean nothing a human.

lessthan80 · ‎01-31-2017

I've recently installed splunk 6.5.1 on windows 2008 R2. I've also enabled 'Health Check' in Monitoring Console, but any Health Check search that includes something like "| rest $rest_scope$ /services/server/info " fails with -- Error in 'rest' command: Invalid argument: '/services/server/info' -- I am unable to locate any directory called /services. Where can I get this configured?

Posts	10
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎01-31-2017

Online Status	Offline
Date Last Visited	3 weeks ago

dashboard studio drill down searches

timestamp in _raw contains p.m. -How to configure ...

Splunk Add-on for Microsoft Office 365 --Why can't...

How to present a readable time value when epoch va...

How do I correct error "Error in 'rest' command: I...