Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About timgren
timgren
Path Finder
Member since:
10-19-2020
09-22-2022
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 5 |
| Member Since | 10-19-2020 |
Activity Feed
- Got Karma for Re: How to set a token when the field exists?. 09-22-2022 09:36 AM
- Karma Re: How to set a token when the field exists? for richgalloway. 09-22-2022 08:23 AM
- Posted Re: How to set a token when the field exists? on Splunk Search. 09-22-2022 08:22 AM
- Posted How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Tagged How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Tagged How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Tagged How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Posted Re: How to sort contiguous _time into discreet sets on Splunk Search. 08-27-2022 07:51 AM
- Karma Re: How to sort contiguous _time into discreet sets for ITWhisperer. 08-27-2022 07:51 AM
- Posted How to sort contiguous _time into discreet sets? on Splunk Search. 08-27-2022 06:12 AM
- Tagged How to sort contiguous _time into discreet sets? on Splunk Search. 08-27-2022 06:12 AM
- Tagged How to sort contiguous _time into discreet sets? on Splunk Search. 08-27-2022 06:12 AM
- Posted How can I prevent lookup editor from converting greater-than, and less-than characters to escape chars? on All Apps and Add-ons. 04-27-2022 05:51 AM
- Tagged How can I prevent lookup editor from converting greater-than, and less-than characters to escape chars? on All Apps and Add-ons. 04-27-2022 05:51 AM
- Karma Re: Can search time limit be applied by index? for richgalloway. 03-25-2022 09:32 AM
- Posted Re: Set a dashboard token based on the requestors url? on All Apps and Add-ons. 03-25-2022 09:31 AM
- Karma Re: Set a dashboard token based on the requestors url? for kamlesh_vaghela. 03-25-2022 09:30 AM
- Posted Set a dashboard token based on the requestors url? on All Apps and Add-ons. 03-25-2022 08:49 AM
- Posted Can search time limit be applied by index? on Splunk Search. 01-17-2022 01:03 PM
- Tagged Can search time limit be applied by index? on Splunk Search. 01-17-2022 01:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
09-22-2022
08:22 AM
1 Karma
Not quite, but that led me to one that does. <eval token="MyCol">if(isnotnull($row.MyCol$),"UseValue=".$row.MyCol$,"")</eval> Thanks!
... View more
09-21-2022
10:49 AM
I'm looking for a way to set a token when the column exists (regardless of value). Tried these with no luck.
<eval token=if(isnotnull($row.MyCol$),useValue=$row.MyCol$,null())> <eval token=case($row.MyCol$ != "" , useValue=$row.MyCol$) Thoughts?
... View more
Labels
- Labels:
-
eval
08-27-2022
07:51 AM
Outstanding sir - thank you! I would have never come up with that.
... View more
08-27-2022
06:12 AM
I'm trying to collapse a of data into earliest/lastest by _time, with the time is contiguous. Such as: 2022-08-27 07:36:00 2022-08-27 07:37:00 2022-08-27 07:38:00 2022-08-27 07:39:00 2022-08-27 07:40:00 2022-08-27 07:44:00 2022-08-27 07:45:00 2022-08-27 07:46:00 2022-08-27 08:31:00 2022-08-27 08:32:00 2022-08-27 08:33:00 2022-08-27 08:34:00 2022-08-27 08:35:00 earliest: latest:
2022-08-27 07:36:00 2022-08-27 07:40:00 2022-08-27 07:44:00 2022-08-27 07:46:00 2022-08-27 08:31:00 2022-08-27 08:35:00
THoughts?
... View more
04-27-2022
05:51 AM
Lookup table fields that contain < or > symbols are getting escaped to &gt; and & lt; How can I prevent this from occurring? It only happens when manipulating the field value using lookup editor. For example: servicecode>="200" AND servicecode<400,1,0), failed=if(servicecode>400,1,0) gets rewritten as: &amp;gt;="200" AND servicecode&amp;lt;400,1,0), failed=if(servicecode&amp;gt;400,1,0)
... View more
- Tags:
- lookup
Labels
- Labels:
-
lookup
03-25-2022
09:31 AM
Outstanding! Thank you. I was unaware of window.location.href
... View more
03-25-2022
08:49 AM
In a large environment with search heads in multiple locations, I would like to create a single dashboard that switches search queries values based on the search head URL. This would allow us to have a single agnostic dashboard for multiple locations and/or environments. where the index values differ from one to the other. Such as: https://splunk.NorthAmerica.Mycompany.com https://splunk.EU.Mycompany.com etc. token value = $URL$ Where I can set the locale token as: Locale=case($URL$ LIKE %NorthAmerica%, "NorthAmerica", $URL$ LIKE %EU%,Europe) Is there any build-in splunk value that reads the requesting URL? If not, how to construct a js that leverages the URLSearchParams() method to set the token?
... View more
Labels
- Labels:
-
dashboard
01-17-2022
01:03 PM
Can a search time limit be applied differently by index rather than by role? Currently, we have a search roll limit of 6 weeks. However, this limit defeats the purpose of summary indexing which are often required to examine a much longer spread. Any thoughts or work-arounds?
... View more
Labels
- Labels:
-
search job inspector
07-08-2021
06:29 AM
Is it possible to setup a dashboard query that uses the main event index for "today", and summary index for all other times while still using the the default time_picker?
... View more
Labels
- Labels:
-
other
03-26-2021
06:03 PM
Excellent! Can this solution be applied to an auto-extraction or transformation method?
... View more
03-26-2021
03:13 PM
I'm trying to pull KV pairs from a event field, and having trouble. The issue is I don't know what the field names will be, nor how many. The parent field value also groups the KV pairs within braces, adding and additional layer of brain trauma. In testing, /([^{=,]+)=([^,}]+)/g does the job in regex101, but not splunk. Such as: | makeresults | eval msg.additionalValues="{field1=value1, field2=value2, field3=value3}" | rex field=msg.additionalValues "/([^{=,]+)=([^,}]+)/g" Results in: Error: "Error in 'rex' command: The regex '/([^{=,]+)=([^,}]+)/g' does not extract anything. It should specify at least one named group. Format: (?<name>...)." Since i have multiple named groups, how is this possible?
... View more
Labels
- Labels:
-
field extraction
-
transforms.conf
03-19-2021
03:57 AM
Well, Not really as that is an inline rex of known fields, not a transformation of subfields which can be a variety of names. But thanks. A transformation at time of ingestion is what I'm after.
... View more
03-18-2021
05:30 PM
I have a JSON log entry with key-value pairs within the field component. I'm trying to transform the field into sub-fields using the key-value pairs. Example: "msg":{"additionalValues":"{responseTime=137, synapseTag=None, serviceName=switching-integration, uri=com.bigcompany.switching, responseCode=200}", <more fields>,...} For Splunk, I can pull one field, referenced as "msg.additionalValues". But I can't seem to transform the KVP's within that field into sub-fields. (such as "msg.additionalvalues.responseTime", and msg.additionalvalues.synapseTag, etc ) Any ideas?
... View more
- Tags:
- regex
- transformation
Labels
- Labels:
-
field extraction
11-01-2020
05:25 AM
No. I want is to show search progress in the panel window -- instead of the default "waiting for data..." message that appears before the results are completed. just as it does in event search mode. (see OP pic)
... View more
11-01-2020
05:19 AM
1 Karma
Thanks - but this only works when the top panel and input panel is the first within the row. My challenge is that it's the 2nd or 3rd panel within the same row.
... View more
11-01-2020
05:15 AM
1 Karma
Is it possible to dynamically set a token name to show/hide panels, based on the value of the input? I have a dashboard with panels that are specific to certain applications, but irrelevant to others. I want to hide the irrelevant panels when they don't apply. Such as: <input type="text" searchWhenChanged="true" > <default>$service_name$</default> <change> <set token="view_$value$"></set> </change> </input> Results in: "Invalid token name: "viewxml_$value$"" Im trying to NOT hard-code service names, because there are many, with a <condition> if possible.
... View more
- Tags:
- token
Labels
- Labels:
-
token
10-24-2020
04:08 PM
1 Karma
In search mode, there is a progression object in the top left corner that shows: "#number of 24,040 events matched" until the search is complete. Example: I would like to use the same in a dashboard panel instead of "waiting for data..." OR at least as a token value that can be applied to the <title>.
... View more
- Tags:
- dashboard
Labels
- Labels:
-
other
10-24-2020
09:00 AM
1 Karma
I understand that Splunk CSS defaults any <input> class to reside at the top of any panel. I would like to override this setting, and put an input (such as radio, or checklist) at the bottom of the panel, under a results table. None of the css positioning alterations using panel ID work for <input> class, even with !important. Any ideas?
... View more
Labels
- Labels:
-
CSS
-
simple XML
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-22-2022
11:45 AM
|
