About dgadjov

dgadjov · ‎04-11-2013

When you say the search key should always have an object do you mean customSearch because this is what I am passing to the search module.

dgadjov · ‎04-11-2013

Could it be possible that it has something to do with this. Sideview.utils.declareCustomBehavior("gen_search", function(module) { module.getModifiedContext = function() { I'm not sure if it has to do with the getModifiedContext. I tried with onContextChange but still doesn't work.

dgadjov · ‎04-11-2013

The reason I am using the CustomBehavior is because I wrote a really long search and it is sort of repetitive. The Javascript is creating the search for me so it is easier to maintain and view. The JS always worked but it was always running before the user entered any input. I added a button to make the view wait before searching. Also if press enter the search will go, it just doesn't work for the button... the first time. What I mean is that after pushing enter for the first search the button starts to work for all other searches. Just doesn't want to work the first time.

dgadjov · ‎04-11-2013

It appears that if you use Javascript to generate a search there are issues in the upstream flow.

dgadjov · ‎04-11-2013

ids Run IDs: fast Search True False gen_search $customSearch$ I have added the relevant code.

dgadjov · ‎04-11-2013

When the user presses enter on a text field or presses a button I want the search to execute. However if I set param name="allowSoftSubmit" or param name="allowAutoSubmit" to either True or False it appears that either the button doesn't work or pressing enter in a text field doesn't work. Only one of them will work at a time.

dgadjov · ‎03-29-2013

Is it possible to have Splunk to index all the data in a file and when the file is changed to remove the currently indexed data in splunk and replacing it with the new data in the file. I do not need the history of the data and am just interested in the current status of the test. The issue is that every time an event is written to a file it is being indexed even though one element has changed. ie. Original file content "test": "A", "status": "Pass" "test": "B", "status": "Pending" New file content. Tests B has change from Pending to Failed "test": "A", "status": "Pass" "test": "B", "status": "Failed"

dgadjov · ‎03-29-2013

I have two folders called 'temp' and 'data'. When the script runs it collects some data and then does a compare with the 'temp' folder. If there is a difference it makes a list of differences and then outputs the differences to folder 'data'. It then writes all of the collected data into 'temp' to represent the latest record. If no differences are found nothing is written to the 'temp' or 'data' folder. 'temp' is just a temp folder but 'data' is the folder that is being continuously indexed.

dgadjov · ‎03-29-2013

The issue is that I don't have STDOUT anywhere yet it is still indexing

dgadjov · ‎03-28-2013

I have a script that is collecting data and then outputs it to a directory. The script is being run by Splunk every hour and the directory is being continuously indexed. After the script gets the data it does a check on a temp file to make sure there is no duplicate events and only writes new events into the indexed directory. The problem is that the data is still indexed even though the file is not being written to. What commands in python will make splunk index the script data directly? I do not have any print lines and the only thing I do is open and read files and output to files.

dgadjov · ‎03-21-2013

I have tried join and appendcols is not what I want at all. I'm not sure how to give more information. All I want to do is append to table one without creating new columns that exist in the second table. ie. Table 1 Table 2 A B C D A B C Z 1 1 1 1 4 2 2 2 2 1 1 1 5 2 2 2 3 1 1 1 6 2 2 2 Results Table A B C D 1 1 1 1 2 1 1 1 3 1 1 1 4 2 2 5 2 2 6 2 2

dgadjov · ‎03-20-2013

I have two sets of data which have some similar columns. Table one has column: A B C D E and table two has column: B C D J K L ... The first table is the main table and the second table contains some additional general information. I want to append to table 1 the records in table two. So in this case records B C D from table two should be added. The resulting table should look like A B+ C+ D+ E. The plus signs just indicates that these columns have been added to. A and E should remain the same.

dgadjov · ‎03-19-2013

Wow that works! What does the double dollar sign do to make this work?

dgadjov · ‎03-19-2013

This is actually the first thing that I tried when I got this error. With or without the CDATA the mismatch will occur.

dgadjov · ‎03-19-2013

Running this through the Splunk search I get no errors. However when I put this search in my Advance XML I get: mismatch '[' source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"

dgadjov · ‎03-19-2013

The replace "failed" with 0 and "Passed" with 100 is what I needed. After that I can just use the average function and revert the numbers back to pass fail.

dgadjov · ‎03-18-2013

This almost works. There is one thing I forgot to mention. Sometimes the cell maybe empty. The scale function is applying scale on all column based off the one scalar value. Since each column has a different count the percent in columns with an empty cell are wrong.

dgadjov · ‎03-15-2013

The goal is just to have the percentage pass rate at the bottom of a dynamically named column that contains "Passed" or "Failed" I have a table that contains 8 column headers that are dynamic and will be constantly be changing. The content in the column will always be the same "Pass" or "Fail". I want to get the percent pass rate for a column and append it to the bottom. What I have so far is: ...| appendpipe [ stats count(*="Passed") as *_pass, count(*) as total_* | eval *=round(*_pass*100/total_*,2)] I know the eval statement won't work because the wildcard will be considered multiplication. Also the count(*="Passed") line will not evaluate without errors.

dgadjov · ‎03-14-2013

I'm trying to make a table that has one of the column headers to have the value as the most occurring value in another column. I want to do something similar to this: ..| rename columnX as [stats mode(columnY)]

Posts	19
Solutions	0
Karma Given	5
Karma Received	1
Member Since	‎03-14-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

button not working

Indexing data

Script Indexed

Joining Data

mismatch '[' in search

Count Occurrences of a string in all columns dynam...

passing table column value as new column header

Re: button not working

Re: button not working

Re: button not working

Re: button not working

Re: button not working

button not working

Indexing data

Re: Script Indexed

Re: Script Indexed

Script Indexed

Re: Joining Data

Joining Data

Re: mismatch '[' in search

Re: mismatch '[' in search

mismatch '[' in search

Re: Count Occurrences of a string in all columns d...

Re: Count Occurrences of a string in all columns d...

Count Occurrences of a string in all columns dynam...

passing table column value as new column header