About chiliconbeano

chiliconbeano · ‎10-24-2022

Is there an XML equivalent to the Dashboard Studio clearDefaultOnSelection feature? I'm not looking for a Java Script solution, just a straight..pure XML solution. The 'default' token value in my case is '.*' Here is my attempt and it doesn't work..perhaps I have a syntax error? <change> <eval token="form.multi_token">if(match($form.multi_token$, "^\.\*") AND $form.multi_token$ != "^\.\*$", replace($form.multi_token$, "\.\*", ""), $form.multi_token$)</eval> </change>

chiliconbeano · ‎06-02-2022

VatsalJagani, Awesome solution...thanks a million! Bob

chiliconbeano · ‎06-01-2022

Is it possible to allow users the interactive capability of selecting between light and dark mode theme by way of an input field? I tried: <form theme="$background_theme_token$> along with an input field for that token ( light or dark selection ) and was not able to get it to work. Any suggestions or is this not doable in the Classic dashboard (XML) world? Thanks in advance, Bob

chiliconbeano · ‎03-04-2022

The 'answer' to my question involves simply using the 'collect' command to store the alert history in a summary index. Having multiple alert scripts each appending to a csv lookup table does not work: Only one script can write/append to a csv table, but multiple scripts/queries can read. The summary index/collect command is a simple solution to my project. The other benefit of using the collect command in a scheduled alert is that it will automatically set the 'server_name' value to the calling alert name's value...no hard coding! Thanks to all who took the time to help me solve my problem. How do a declare this question answered?

chiliconbeano · ‎01-17-2022

Apologies for not being clear enough. I want to replicate what the $name$ value is when you configure an alert Action, ie, a Slack message. But I want to do that in SPL. I understand one knows the name of the owner and alert name when one creates it. However, I don't want to rely on hard coding these values in the SPL of each alert. Alerts can be cloned into differently named scripts and the hard coding is just an opportunity for getting the information wrong. Instead of hardcoding like this: | eval whats_my_name = "heisenberg_alert" I want this: | eval whats_my_name = $name$ However, $name$ (nor 'name') does not work for me in SPL. So, is there an equivalent way of getting JUST the name of the alert via SPL? I don't want the entire list of all scheduled alerts...I just want the one name of the currently executing alert script. BTW, thank you all for taking the time to help me find an answer. Bob Eubanks

chiliconbeano · ‎01-14-2022

I want to access the title, owner, etc., of the currently running scheduled alert via SPL syntax. I want to append this information to a lookup table so that a variety of alerts or saved searches with a variety of formatted outputs can be centralized into one output location. I understand that variables like $job.title$ and $results.count$ are available went setting up these jobs via the Alert or Scheduler UIs, but how do I access these environment variables via SPL? Should I use the '| rest ....' command? Which REST APIs will have the job title/owner info? Here is what I want to produce: | <query for outlier info by hostname> | <summarize data by hostname> | <rest commands to extract job title/owner/etc info> | table timestamp, hostname, error_count, <multi-value fields with alert specific data>, $job.title$, $job.owner$ | outputlookup append=t ..... <tracking_history_table.csv>

chiliconbeano · ‎11-03-2021

I have a dashboard containing two radio buttons, one for 'Current quarter' and one for 'Previous quarter'. I also have a timepicker input field for customizing the time range for a query. Following is the XML code for the input fields: <input type="radio" token="quarter_token" searchWhenChanged="true"> <label>Select quarter...or...</label> <choice value="earliest=@qtr latest=@d">Current quarter</choice> <choice value="earliest=-1qtr@qtr latest=@qtr">Previous quarter</choice> </input> <input type="time" token="time_token" searchWhenChanged="true"> <label>Select date range</label> <change> <set token="form.quarter_token"></set> </change> <default> <earliest>@qtr</earliest> <latest>@d</latest> </default> </input> My question is: How can I reset the timepicker Label text to match the radio button selected time range? Currently, if a user selects a custom time range, then selects one of the radio buttons, the timepicker label doesn't match the radio button time range selection. For example, can I simply do the following to reset the timepicker label? <set token="form.time_token.earliest">@qtr</set> <set token="form.time_token.latest">@d</set> In the example attachment, the timepicker lable shows 'Last 55 days' as well as the 'Previous quarter' radio button being selected. This situation presents an inconsistent UI. thanks in advance, Bob

chiliconbeano · ‎10-15-2021

Is it possible to place the pagination buttons on the top of a dashboard panel rather than have them appear at the bottom of a panel?

chiliconbeano · ‎08-11-2021

By default, when you chart by '_time', the major ticks displayed over a multiple week time span always uses Mondays in the major tick labels. Since I am allowing people to select individual days of the week for week over week comparisons, it would be nice to show the selected day of the week as the major tick label. Is there a charting control variable that can be used for this? thanks in advance, Bob Eubanks In the attached screen shot, the user has selected 'Fridays' for comparison, yet the chart uses Mondays as the major tick label.

chiliconbeano · ‎02-22-2021

I need to move lots of dashboards, alerts, scheduled reports, lookup tables and data feeds to a new Splunk environment due to security issues. I would like to make that transition an incremental process rather than one big 'switch over'. My questions are: > Which knowledge objects can be accessed via federation? > What are examples of federated syntax for 'inputlookup', 'loadjob', etc. commands? I realize there will be a performance impact, but that will be temporary while transition to the new Splunk environment is ongoing. Where is the current documentation for using federated access? Thanks in advance.

chiliconbeano · ‎12-11-2020

PavelNed, Thanks for taking the time to respond. Here is a screen shot of my pan/zoom: Here is my XML (the actual query is URL encoded): <option name="charting.drilldown">all</option> <selection> <set token="selection.earliest">$start$</set> <set token="selection.latest">$end$</set> </selection> <drilldown><link target="_blank">search?q= | inputlookup my_table.csv | eval update_time = strptime(day, "%Y-%m-%d") | where update_time >= $selection.earliest$ AND update_time <= $selection.latest$ </query></link></drilldown></chart></panel> HOWEVER, when I click on the 'Sept. 24, 2020' data point, the drilldown time value range ends up being the entire range of the chart (Jan. 2020 - Dec. 2020), not the range represented by the zoom frame (Sept. 2020 - Oct. 2020) : | inputlookup my_table.csv | eval update_time = strptime(day, "%Y-%m-%d") | where update_time >= 1579132800 AND update_time <= 1607558400 Is there some other <option> setting I need? According to the documentation, this should be straight forward, yet, I 'must' be doing something wrong. Again, thanks for helping!

chiliconbeano · ‎12-10-2020

This is a related question..not an answer. Using the Pan and Zoom ( <selection></selection> ) feature, how does one get the 'earliest' / 'lastest' time range values represented by the Pan/Zoom window? Currently, I can only get the single 'click.value' epoc time where the mouse is clicked. Is there special value Also, it appears the 'click' names/values are not available in the <selection></selection> group, but they are available in the <drilldown></drilldown> group. To work around this 'problem', I am doing the following which I do not like. The <selection>..</selection> group is just to enable the pan/zoom visualization. I've tried setting the 'selection.latest/earliest' values to both $start$/$end$ AND $selection_earliest$/$selection_latest$...no worky! <selection> <set token="selection_made">1</set> </selection> <drilldown> <eval token="selection.latest">'click.value' + (86400 * 3)</eval> <eval token="selection.earliest">$selection.latest$ - (86400 * 7)</eval> <link...</link> </drilldown/

chiliconbeano · ‎11-24-2020

Worked like a charm!!! Thanks a milllion.

chiliconbeano · ‎11-23-2020

Is there a way to pass a variable value, say a background color value, to a prebuilt panel? I want to have these panels flexible so that when they are used in various dashboards the color schemes can be consistent within each dashboard.

Posts	14
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎11-16-2020

Online Status	Offline
Date Last Visited	‎10-24-2022 06:15 PM

Is there an XML equivalent to the Dashboard Studio...

Is it possible to toggle dashboard theme at runtim...

SPL

Reset timepicker lable to match time token values

prev next pagination button placement

Controlling X Axis major tick labels in area chart...

Can all knowledge objects be accessed via 'federat...

passing values to prebuilt panels

Is there an XML equivalent to the Dashboard Studio...

Re: Is it possible to toggle dashboard theme at ru...

Is it possible to toggle dashboard theme at runtim...

Re: SPL