Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About thinhdinh
thinhdinh
Path Finder
Member since:
06-22-2020
08-18-2020
Community Statistics
| Posts | 29 |
| Solutions | 0 |
| Karma Given | 16 |
| Karma Received | 0 |
| Member Since | 06-22-2020 |
Activity Feed
- Posted Re: How to enable Javascript for Splunk App on All Apps and Add-ons. 08-15-2020 12:29 AM
- Posted Re: Custom alert action ui input on Alerting. 08-15-2020 12:09 AM
- Posted Re: How to enable Javascript for Splunk App on All Apps and Add-ons. 07-29-2020 05:54 AM
- Posted Re: How to enable Javascript for Splunk App on All Apps and Add-ons. 07-29-2020 05:28 AM
- Posted Re: How to enable Javascript for Splunk App on All Apps and Add-ons. 07-29-2020 05:09 AM
- Karma Re: How to enable Javascript for Splunk App for isoutamo. 07-29-2020 04:35 AM
- Posted How to enable Javascript for Splunk App on All Apps and Add-ons. 07-29-2020 04:11 AM
- Karma Re: How to remove values of 0 from my search results? for DalJeanis. 07-17-2020 01:27 PM
- Posted How to fetch data from API and use these data inside html file on Splunk Dev. 07-16-2020 04:56 AM
- Posted Re: How to pass indexes from a macro to another search on Splunk Search. 07-16-2020 04:34 AM
- Tagged Re: How to pass indexes from a macro to another search on Splunk Search. 07-16-2020 04:34 AM
- Karma Re: stats conditional count for martin_mueller. 07-14-2020 11:59 AM
- Karma Re: How to pass indexes from a macro to another search for isoutamo. 07-13-2020 11:56 AM
- Posted Re: How to pass indexes from a macro to another search on Splunk Search. 07-13-2020 05:33 AM
- Karma Re: How to pass indexes from a macro to another search for isoutamo. 07-13-2020 05:10 AM
- Posted How to pass indexes from a macro to another search on Splunk Search. 07-10-2020 01:05 AM
- Tagged How to pass indexes from a macro to another search on Splunk Search. 07-10-2020 01:05 AM
- Tagged How to pass indexes from a macro to another search on Splunk Search. 07-10-2020 01:05 AM
- Tagged How to pass indexes from a macro to another search on Splunk Search. 07-10-2020 01:05 AM
- Posted Re: What I did wrong here with makeresults command on Splunk Search. 07-09-2020 03:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-15-2020
12:29 AM
@isoutamo Sorry, I have to disable your question as a solution. Because I just realised we were missing understanding about my issue. Actually I want to run javascript inside the HTML file from this directory: $SPLUNK_HOME/etc/apps/app_name/default/data/ui/alerts Basically this file is the form, where we get inputs from users, when they are creating alerts. For the dashboards, sure we are able to run js and I am building a custom dashboard using React and it works.
... View more
08-15-2020
12:09 AM
@diwaly2019 you are missing underscore marks. action.fortigate_alert.param.username = <string>
action.fortigate_alert.param.realm = <string> Btw do you guys know how we are able to run javascript in this HTML file?
... View more
07-29-2020
05:54 AM
Hi, I am not using simpleXML. I just coded the GUI using React and then I build the project to html and js files. If you looked at the warning, it comes from the noscript tag inside my HTML file. It seems we need to enable javascript somewhere under splunk app?! Bytheway I only have a basic form like this:
... View more
07-29-2020
05:28 AM
Here's the content of my HTML file: <!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<link rel="icon" href="/favicon.ico" />
<meta name="viewport" content="width=device-width,initial-scale=1" />
<meta name="theme-color" content="#000000" />
<meta name="description" content="Web site created using create-react-app" />
<link rel="apple-touch-icon" href="/logo192.png" />
<link rel="manifest" href="/manifest.json" />
<title>Flowdock App</title>
</head>
<body><noscript>You need to enable JavaScript to run this app.</noscript>
<div id="root"></div>
<script src="/static/js/index.js"></script>
<script src="/static/js/2.a630fc11.chunk.js"></script>
<script src="/static/js/main.5040630f.chunk.js"></script>
</body>
</html>
... View more
07-29-2020
05:09 AM
Hi @isoutamo Thank you for your answer. if inside html file we still have javascript code, do we need to move them as well? Cause I have been moved those files under appserver/static but it is still not working.
... View more
07-29-2020
04:11 AM
Hi Splunkers, I am developing a custom app and I am using React to build an user interface for it. I have tested on my local and it works well. But when I copy all files to /opt/splunk/etc/apps/flowdock/default/data/ui/alerts this directory, I got error like below picture: How can we solve this issue? Thanks in advance.
... View more
Labels
- Labels:
-
configuration
-
Other
07-16-2020
04:56 AM
Hi, I am developing a custom app on Splunk Enterprise and I am looking for a solution to make the <splunk-select> tag more flexible. Like we fetch a list of options from a Rest API and then loop it inside the UI file. How can we solve it? Thank in advance.
... View more
Labels
- Labels:
-
app
-
python
-
rest API
-
scripted input
07-16-2020
04:34 AM
To be honestly I still don't get it works, but I just accepted it as solution. Hope someone can get your idea. Cause I mentioned above, inside the first macro I use makeresults command to returned flexible indexes and I think maybe I did something wrong here. By the way I knew how to use a macro inside another macro, cause I have another one on my local splunk and it works well. Anyway thanks for your helps.
... View more
- Tags:
- st
07-13-2020
05:33 AM
@isoutamo Thank you for replying, but I still don't get it. So in the second macro I write like this: `get_indexes_by_args($index$)`....| And then in the search bar I write the query like below | `the_second_macro(...)` And it is not working. Could you show me where I was wrong?
... View more
07-10-2020
01:05 AM
Hello experts, I am using makeresults command to create a macro like below: | `get_indexes_by_args(1)` And the macro will return the string like below: index IN ("apps", "_apps") Now I want to pass this macro to another macro. How can I solve it? It will be like this: | `get_indexes_by_args("app")` "/api/" | ....
... View more
Labels
- Labels:
-
subsearch
07-09-2020
03:03 AM
Oh I was missing the quote mark. Now it works correctly. Thank you again @renjith_nair .
... View more
07-09-2020
02:38 AM
Thank you for your answer! the error has gone. But the macro always returns the value of true() case, even I pass 1 or 2 as argument. Do you have any idea @renjith_nair ?
... View more
07-09-2020
01:36 AM
Hello experts, I am trying to create a custom macro, from that it will returns a result depends on the argument I pass to it, like this: | makeresults | eval param=1 | eval result=case(param == 1, "one", param == 2, "two", param == 3, "three", true(), "Invalid number") | table result The above searching query works well if I copy whole query and paste to the search bar | makeresults | eval param=$param$ | eval result=case(param == 1, "one", param == 2, "two", param == 3, "three", true(), "invalid input") | table result But when I used as a macro `getNumber(param=1)` I got an error Error in 'makeresults' command: This command must be the first command of a search. How can I solve this issue? Basically this macro will be used in another macro.
... View more
Labels
- Labels:
-
Other
07-09-2020
12:31 AM
Hello experts, I am looking for a solution to respond an incident using alert in Splunk. In stead of alert sending, I want to call to specific APIs when alerts is triggered. Kinds of ticket creating in Jira or message sending using third parties or server restarting when server out of memory, and so on. How can we implement it?
... View more
- Tags:
- alert
- monitoring
Labels
07-03-2020
03:13 AM
Anyone here got the solution worked? I have tried with bucket -> stats -> where but it is not working for me. Here is my query: ....| dedup customerID | bucket span=2h _time | stats count as "Actived customer" by Event where count > 0 | xyseries _time, customerID, count
... View more
07-03-2020
01:49 AM
That's exactly what I am looking for, thank you @isoutamo
... View more
07-03-2020
12:28 AM
Hi Experts, Can someone explain to me what are different between searching with index, sourcetype and host? Which one give us performance better, in case we have only one host and one sourcetype? I am super confused about those concepts in Splunk. Is there any ways to check where data was transfer from by index in Splunk? Thank in advance!
... View more
07-01-2020
10:28 AM
Thank you @gcusello . This solution is new to me and sounds great! Anyway I am still looking for another way like where we create another macro to return value. So basically we have 2 more macro like below: getHost(index) getScope(index) Do you know any commands in Splunk supports us to to like this?
... View more
07-01-2020
05:39 AM
Hello Experts, I am wondering is there any ways to make the search strings flexibly? Like I have multiple queries as below: - index=index_1 host=host_1 (scope=A OR scope=B) | .... - index=index_2 host=host_2 (scope=C OR scope=D) | .... - index=index_3 host=host_3 (scope=A OR scope=B OR scope=E OR scope=F) | .... So instead of writting a macro with 3 arguments: $index$, $host$, $scopes$ - customMacro(3) We just pass only index as argument and based on the number in the index, we modify the host and scope? - host=case(match(index,1), host_1...) Thank in advance!
... View more
06-30-2020
01:44 AM
Hi Experts, I have a search query that give me a result table like below: Employee Salary A 1000 B 2000 C 0 How can we trigger an alert when one of our employee's salary equals to zero or specific number?
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
cron
06-26-2020
12:02 AM
Sure we can write different search queries for each scope, but it is too long. That's why I want to use macro in this case. I don't have one alert, I have bunch of alerts and the result of them depends on their scopes. As I know macro is not required to use if we don't like.
... View more
06-25-2020
03:58 PM
I have bunch of different scope as I said before and for each of those scope I have to write an alert. With a help from macro, my task should more easier. That's why I need a macro with a flexible argument. Yes, I have moved the argument to the search itself, it's not required in the first place.
... View more
06-25-2020
12:44 AM
@bowesmana Hi, sorry to bother you again. So how can I pass those scopes to my macro?! When I tried to do something like this, it's not working for me: myCustomMacro(scope=("A", "B", "C"))
... View more
06-24-2020
07:12 AM
Okie, I was missing field=_raw. Now I got it worked, thank you.
... View more
06-24-2020
07:06 AM
Hi @gcusello , Thank you for your answer. Basically I have a event like this: Mon Mar 19 20:16:27 2018 Info: Bounced: DCID 8413617 MID 19338947 - - "Hello world" From: <MariaDubois@example.com> To: <zecora@buttercupgames.com> RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout']) How can I get the "Hello world" from above event using rex command?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2020
06:41 AM
|
Karma given to
