About logankinman99

logankinman99 · ‎11-21-2019

Hi, I'm trying to find a way to make a button that will refresh my dashboard. I do not want the entire page to refresh, I really just need all the tokens to return to their initial values. So far, I have this completed in a beta sort of way, with multiple "refresh this token" checkboxes at the top - which each change tokens to certain values when checked. The user can click those individual boxes and then press the submit button and everything returns to the initial state. What I'm wondering is if there is a way to do this with the click of a single button, so users only have to click something once and the dashboard resets all the tokens. Let me know if you have any ideas, please! Thanks, Logan

logankinman99 · ‎11-15-2019

Hey, this worked pretty well! Thanks!

logankinman99 · ‎11-15-2019

So I'm trying to write a query that allows for displaying a timechart after I've filtered fields by count using stats. I've been able to filter fields by their counts with this... host=server1 | stats count by errorName | where count > 250 ...which does exactly what I want, returning only the errors that have occurred more than 250 times in the given time period. What I cannot figure out, however, is how to take that and make a visualization out of it. If I change stats to timechart, it does not work. And neither does adding a timechart count after the where clause. Any ideas would be very helpful! Thanks, Logan

logankinman99 · ‎11-11-2019

Hi, I'm looking to change the font of a statistics table within my dashboard. It defaults at white, but when you edit the drilldown to allow clicks, it defaults to blue and is much harder to read at a distance. Is there any way you know of to change this back? (Notes: I tried charting.fontColor, but it is not compatible with stats tables apparently. Also I am using Splunk Cloud and do not have direct access to config/css files)

logankinman99 · ‎11-08-2019

Well, I quickly found a solution to my own question. For anyone else who may have this problem... It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up. < form> -----< label>My dashboard name< /label> -----< init> ----------< set token="errorSourceToken">*< /set> -----< /init> < /form> After setting that in the XML, I was able to edit the drilldown through the UI

logankinman99 · ‎11-08-2019

I'm working on making an interactive dashboard, and I'm not sure how to do something... My dashboard shows a pie chart of the top servers where errors are occurring. Next to it, a statistics table shows from what file source the top errors are coming from. What I'm trying to figure out is how I would be able to click on a file source in the statistics table, and then change the pie chart to show only the servers that have errors matching with that clicked source. Currently, I have it set up as errorSource=* for my pie chart, but that doesn't allow for token change. It would make sense to me to initialize something like $errorSourceToken=*$, but I don't know how I would initialize that without some kind of input like a radio button select or something (which I don't want to appear). Let me know if you know of any solutions. Thanks so much! -Logan

logankinman99 · ‎11-04-2019

Thank you! This worked perfectly

logankinman99 · ‎11-01-2019

I am a regex noob, and I was curious if there is a simple way to capture anything between containers. For example, <*Message>This is what I want to capture.<*/Message> (Note: Please ignore the asterisks around Message...I had to use them as an escape character to make the containers appear.)

logankinman99 · ‎11-01-2019

I have the exact opposite problem (but the same). I have it set to show custom value 0 but it just shows Null.

logankinman99 · ‎10-25-2019

I came across an app yesterday that someone made for download at Splunkbase that allows the field extractor to be more customizable. However, it is not made by Splunk, so I wouldn't download it myself. Let me know if you find a solution

logankinman99 · ‎10-24-2019

So it turns out I was wrong, before, so I deleted my previous response. I don't know what was going on before but now I am also in your same position. I looked it up further and it turns out lots of people are having this issue, as well. For some reason, it is capped at 20, and there doesn't seem to be a way around it without extracting it manually, in the search. I'll let you know if I actually find something.

logankinman99 · ‎10-21-2019

Cool, thank you. I will look into these!

logankinman99 · ‎10-18-2019

See that's what I was thinking too..It changed the results, but still didn't match the accurate searches

logankinman99 · ‎10-18-2019

Cron schedules can be very useful. They look confusing at first, but are really nice to use. Select cron schedule, select the time range you want to search, and then the cron expression is how often you search. For example, */3 * * * * says you want the search to run every 3 minutes, */15 * * * * says you want the search to run every 15 minutes, and so on.

logankinman99 · ‎10-18-2019

These two sections of the documentation do a pretty good job of explaining the basics. https://docs.splunk.com/Documentation/Splunk/7.3.2/Viz/OverviewofSimplifiedXML https://docs.splunk.com/Documentation/Splunk/7.3.2/Viz/PanelreferenceforSimplifiedXML

logankinman99 · ‎10-17-2019

I have Glass Tables that use KPIs refreshing their searches every 15 minutes to show data in real time. The data is accurate at first, and refreshes the searches fine. After a few hours, however, the data starts to slip and show incorrect results. If I do an ad hoc search in a different tab, it shows totally different results than what the glass table is showing. This happens with all of my Glass Tables, as well, not just one. I don't know if I set up something wrong, or if this is an issue other people are having. Please let me know. Thanks! (Calculation: Calculating Average of __________ as aggregate over the last 15 minute(s) every 15 minute(s). Fill gaps in data with Null values and use a unknown threshold level for them.)

logankinman99 · ‎10-08-2019

I'm not sure how it works either, but it's a great technique for ad hoc searches. That does help with future queries, so thanks! However, I can't seem to get it to work with KPIs, which I am currently using for the Glass Table visualizations... Are you able to get these to work with KPIs? Or just the general searches? Thanks, Logan

logankinman99 · ‎10-07-2019

When I include a KPI in a Beta Glass Table that yields 0 results, it shows 'No Result' and gets rid of the styling. The search is accurate to return a 0, but I would much rather see 0 than 'No Result'. Is there a way I can change the KPI to show 0? host=plbu*hqp* (Method=LoadInspectionReport OR Method=UpdateInspection OR Method=CreateLocusInspectionIfNotExists OR Method=UpdateInspectionDashboardDefaultSettings OR Method=UpdateInspections) sc_status!=200 Search of KPI above, counting results by _time.

logankinman99 · ‎10-07-2019

I am trying to add a "time last updated" field in my beta Glass Table, but I do not know how to access the exact time that a KPI updates. I have them set to update every 15 minutes, but that is really all I have to go on right now, it seems. I have read that they also stagger by default, but as long as I can get the time the first one updates, that should be good. Please let me know if there are any solutions you know of! Thanks

Posts	19
Solutions	2
Karma Given	21
Karma Received	1
Member Since	‎10-07-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Refresh Button in Dashboard?

Filter Timechart Fields by Count

How to change font color in dashboard table?

Generate Token without Panel

Write Regex to capture words between containers?

Inaccurate Data over Time - Glass Table

Why do KPIs show 'No Result'?

How to know when KPI updates?

Refresh Button in Dashboard?

Re: Filter Timechart Fields by Count

Filter Timechart Fields by Count

How to change font color in dashboard table?

Re: Generate Token without Panel

Generate Token without Panel

Re: Write Regex to capture words between container...

Write Regex to capture words between containers?

Re: ITSI distinct count KPI: 0 vs. NULL values?

Re: Field Extractor

Re: Field Extractor

Re: Inaccurate Data over Time - Glass Table

Re: Inaccurate Data over Time - Glass Table

Re: How to edit the frequency of scheduled search?

Re: How to learm xml in splunk

Inaccurate Data over Time - Glass Table

Re: Why do KPIs show 'No Result'?

Why do KPIs show 'No Result'?

How to know when KPI updates?