About smart111

smart111 · ‎12-23-2021

Thank you @VatsalJagani That's really big help to me. I could see a slution for the problem. I appreciate.

smart111 · ‎12-23-2021

Does anyone know how to register log event to another index by SPL. I'm assuming the answers like registering recodes from lookup file to an index executing a SPL regularly. If there any way like that, please give your answer.

smart111 · ‎10-21-2021

Thank you for answering @ryanoconnor I actually wanted to set a dropdown list of lookup header values on dashboard and make it possible to choose a primary key to lookup reference field dynamically. Thank you for your kindness.

smart111 · ‎10-21-2021

Thank you so much, @ITWhisperer This way is exactly I wanted.

smart111 · ‎10-21-2021

Is there any way to get those header names as field values from lookup files? Please give me any idea with SPL

smart111 · ‎10-01-2021

Is there any way to hide system messages on dashboard panels? I already set "depends" at html tags but the messages show up for a second. If somebody know that there is an option to make such messages invisible before searches run, please teach me. My source XML is below. <row> <panel depends="$panel_show2$"> <html> <div style="float:left"><span style="font-size: 1.5em;">$HOST2$</span></div> <div style="float:right">$latest_log_time2$</div> <style> div.left{ text-align: left; } div.right{ text-align: right; } </style> </html> <single> <search depends="$panel_show2$"> <query>`cae-real_time_monitoring_tiles($company$, $host2$)`</query> <earliest>-1y</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="height">139</option> <option name="numberPrecision">0.0</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[0,60,80,100]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">small</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unit">%</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <option name="link.openSearch.visible">false</option> <drilldown> <link target="_blank">app_utilization_realtime_detail?form.company=$company$&form.application=$host2$&form.feature=$trellis.value$&form.department=.+&drilldowned=1</link> </drilldown> </single> </panel> </row>

smart111 · ‎09-29-2021

Thank you for answering, @gcusello I understand the structure. Then I should extract some fields related with file path parsing source information at HF. Thanks a lot!

smart111 · ‎09-29-2021

Thank you for answering, @gcusello! Using the way you suggested me, is it possible to extract fields from file paths on UF/HF machine? Originally, I extracted these fields, "_time", "application" and "c_code" from the path like this "/var/opt/splunk/{$c_code}/{$application}/{$_time}.log at Heavy Forwarder. That's why I wondered there is the way to send log files from UF to HF and the files are stored at somewhere on HF machine. But from your advice, I interpreted forwarding files from UF to HF are no longer effective as long as the logs specify indexed at UF. Is that correct?

smart111 · ‎09-29-2021

Is there any way to transfer log files utilizing Universal Forwarder? I have to use Heavy Forwarder to extract fields form complicated log texts. So It's necessary to send logs as whole file format from the machines which generate logs toward Heavy Forwarder. if it's possible, could you tell me How and Which directory I should check on Heavy Forwarder machine. The Construction is this. (attachment photo)

smart111 · ‎02-11-2021

I'd like to add error bars on scatter graphs like the Image below from Microsoft Excel. Does anyone know how to do that with SPL or useful Apps?

Posts	10
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎01-21-2021

Online Status	Offline
Date Last Visited	‎01-19-2022 10:22 PM

How to register log event by SPL.

How to get lookup header names as field's values

How to hide system messages on dashboard panels.

The way to send files from Universal Forwarder to...

How to add error bars on scatter chart

Re: How to register log event by SPL.