About gerbert

gerbert · ‎06-25-2021

Hello Splunk Community, I cannot figure out how to update a kvstore lookup table with a scheduled alert. I want to append a search result every minute to an already exisitng kvstore lookup table. But when I specify said kvstore lookup table in the alert settings of splunk, it tells me that the file name of my kvstore lookup table has to end with .csv, which it doesn't. But I don't want it to because I am not using a static lookup table, I am using a kvstore lookup table. Can I not use alerts with kvstore lookups? Cheers Fritz

gerbert · ‎06-03-2021

Hello, I need a table that users can add comments to, which then get saved to said table. There have already been discussions about this topic here: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-a-comment-text-box-to-Splunk-Dashboard/m-p/481997#M31609 But there is no code for updating and saving a lookup table. Maybe someone has had a similar problem before and would like to share their solution. Is this only possible with javascript? I don't know javascript well enough to program this on my own. Shouldn't there also be a "splunk-only" solution with a text-input and kv store lookup tables? Cheers, Fritz

gerbert · ‎05-21-2021

I'm sorry I can't help you. We ended up reindexing exactly like you suggested in the end of your post.

gerbert · ‎05-17-2021

Hello, i was wondering if it is possible for aesthetic reasons to stack two text inputs above each other (instead of next to each other). I tried something like this: <form> <label>stacked_inputs</label> <fieldset submitButton="false"></fieldset> <row> <panel depends="$alwaysHideCSSStyle$"> <html> <style> #test_input2 { margin-top: 100px !important; padding-left:-200px !important; } </style> </html> </panel> </row> <row> <panel> <input id="test_input1" type="text" token="field1"> <label>field1</label> </input> <input id="test_input2" type="text" token="field2"> <label>field2</label> </input> </panel> </row> </form> But the second input "test_input2" cannot be shifted horizontally above input "test_input1" apparently. Does anyone know how to do this? Cheers Fritz

gerbert · ‎04-27-2021

Thanks for your help but I figured it out. The search: index = "myIndex" | regex myfield != "^(35).+" gives me what i want

gerbert · ‎04-27-2021

I do not want the value "35" to be excluded, which would be the case with the search myfield!="35*". Saying i don't want the "35" excluded is different from saying I want the "35" value.

gerbert · ‎04-27-2021

I need the "!=" in my search because I want to explicitly exclude some values from my search. So replacing "!=" with "=" doesn't help me.

gerbert · ‎04-27-2021

Hello, I want to make the following search: index = "myIndex" myfield != "35*" Is there a way to excluse all values of myfield that start with "35" except "35" itself. so for example i want to exclude: myfield values: 35457, 35568, 351 but not 35 itself. I know that in regex you can use "+" to indicate the use of "one or more" matches but I don't know how to use it in a splunk search. Cheers Fritz

gerbert · ‎04-13-2021

Thanks for your help. I already tried "group by date_hour" before posting here. It didn't give me the right results I was looking for. I found another post with an answer. What worked for me in the end was: index=myIndex status=12 user="gerbert" | eval hour = strftime(_time, "%H") | stats count by hour | sort hour

gerbert · ‎04-13-2021

Hi splunk community, I feel like this is a very basic question but I couldn't get it to work. I want to search my index for the last 7 days and want to group my results by hour of the day. So the result should be a column chart with 24 columns. So for example my search looks like this: index=myIndex status=12 user="gerbert" | table status user _time I want a chart that tells me how many counts i got over the last 7 days grouped by the hour of the day for a specific user and status number. Cheers gerbert

gerbert · ‎04-07-2021

Hello splunk community, I want to change the height of the line break in a textbox, that looks like this: <row> <panel id="panel1"> <html> <div style="text-align: left;"> <font size="2" color="#333333"> Some Text<br/> Some more Text<br/> </font> </div> </html> </panel> </row> <row> <panel depends="$alwaysHide$"> <title>CSS</title> <html> <style> #panel1 {width:70% !important;background-color:#eeeeee;} #panel1 .dashboard-panel{background-color:#eeeeee;}  #panel1 br {line-height: 50%;} </style> </html> </panel> </row> Presumably I have to change the last line but I cannot get it to work properly. I want to make the line breaks more 'narrow' because right now there is too much space above a new line. Help would be appreciated. Cheers gerbert

gerbert · ‎04-01-2021

Ok, just in case anyone is stumbling onto this thread and is wondering how to solve it, here it is. You have to end the "svg-string" and insert your token inbetween and then add the whole string back together with a plus sign. It looks something like this then: <row> <panel> <viz type="svg.svg"> <search> |makeresults |eval svg_viz = ".... <rect id=01 fill=\" "+vitaminA+" \"$ > <rect id=02 fill=\" "+vitaminB+" \"$ > <rect id=03 fill=\" "+vitaminC+" \"$ > ..." [...] </search> </viz> </panel> </row> Cheers gerbert

gerbert · ‎03-31-2021

Hello, I have a table from a xyseries. Each row consists of different strings of colors. I would like to pick one row from the xyseries, save it in some sort of token and then use it later in an svg-file. The svg file is made up of three rectangles, which colors should depend on the chosen row of the xyseries. For example the search I made looks like this: index=something |stats latest(vitamins) by fruit |eval color = if(fruit=="$fruit_token$", "red", 0) |fillnull value="green" |xyseries fruit vitamins color Which gives something like this, when i choose apple as a fruit: vitaminA vitaminB vitaminC apple green red green banana green green green The idea is that I can search for a fruit I want (with an input-token), set the value in latest(vitamin) of that row to "red" and the rest to "green". Is there a way for me to access the "apple-row" as a whole? I can access a single column of a row by addressing the column name, i.e: |search fruit=$fruit_token$ |eval var="something"+vitaminB+"else" |table var would give something like: "somethingredelse" Which then I can store in a variable. But I somehow want all the rest (all the "greens") also. My end goal would be to use a svg-file, that looks something like this: <row> <panel> <viz type="svg.svg"> <search> |makeresults |eval svg_viz = ".... <rect id=01 fill=\"$vitaminA$\"$ > <rect id=02 fill=\"$vitaminB$\"$ > <rect id=03 fill=\"$vitaminC$\"$ > ..." [...] </search> </viz> </panel> </row> So in our example, if apple is my chosen fruit I would like to have my first rectangle to have the color "green", the 2nd the color "red" and the third one the color "green". In the end I would use hex code instead of "red" and "green". I hope this isn't a too narrow subject. I basically need some sort of access to the xyseries table. Maybe instead of using tokens I could also use my first search inside of the svg-file-query, but I couldn't get that to work either. I could use some help 😃 Cheers gerbert

gerbert · ‎03-27-2021

Just to clarify I don't even need/want the <single>. I just added it because otherwise I couldn't use the drilldown with the different conditions. I want to conduct a search (automatically as soon as the dashboard is loaded), set a token with the search result as a value and then depending on that value I want to set a bunch of other tokens.

gerbert · ‎03-27-2021

Oh, no. I wasn't. Thanks! Now it set's the tokens correctly but is it possible to do this automatically without having to click anything. Like in an <init> </init> environment. If so could you give me an example of how you would do it? On a side note: is there a way to delete your own community posts? Earlier there was a problem with the splunk community servers I think, which lead to me posting five different threads with the same topic.

gerbert · ‎03-27-2021

Hello, I want to conduct a search, set a token according to the search result and then set another bunch of tokens depending on the search result token. However my tokens ($test1$, $test2$ and $test3$) get never set. Any ideas what I'm doing wrong? <dashboard> <label>Titel</label> <row> <panel depends="$alwaysHideCSS$"> <single> <search> <query> index=someSearch| rename searchResult AS XX </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <set token="testtest">$result.XX$</set> </done> </search> <drilldown> <condition match="5==5"> <set token="test1">a</set> <set token="test2">b</set> <set token="test3">c</set> </condition> <condition match="1==9"> <set token="test1">d</set> <set token="test2">e</set> <set token="test3">f</set> </condition> <condition match="2==3"> <set token="test1">g</set> <set token="test2">h</set> <set token="test3">i</set> </condition> </drilldown> </single> </panel> </row> [... ]  The token "testtest" is working. Why do the tokens ($test1$, $test2$ and $test3$) not get set? The condition "5==5" cannot be false.

gerbert · ‎03-27-2021

Hello, I want to conduct a search, set a token according to the search result and then set another bunch of tokens depending on the search result token. However my tokens ($test1$, $test2$ and $test3$) get never set. Any ideas what I'm doing wrong? <dashboard> <label>Titel</label> <row> <panel depends="$alwaysHideCSS$"> <single> <search> <query> index=someSearch| rename searchResult AS XX </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <set token="testtest">$result.XX$</set> </done> </search> <drilldown> <condition match="5==5"> <set token="test1">a</set> <set token="test2">b</set> <set token="test3">c</set> </condition> <condition match="1==9"> <set token="test1">d</set> <set token="test2">e</set> <set token="test3">f</set> </condition> <condition match="2==3"> <set token="test1">g</set> <set token="test2">h</set> <set token="test3">i</set> </condition> </drilldown> </single> </panel> </row> [... ]  </dashboard> The token "testtest" is working. Why do the tokens ($test1$, $test2$ and $test3$) not get set? The condition "5==5" cannot be false.

gerbert · ‎03-27-2021

Hello, I want to conduct a search, set a token according to the search result and then set another bunch of tokens depending on the search result token. However my tokens ($test1$, $test2$ and $test3$) get never set. Any ideas what I'm doing wrong? <dashboard> <label>Titel</label> <row> <panel depends="$alwaysHideCSS$"> <single> <search> <query> index=someSearch| rename searchResult AS XX </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <set token="testtest">$result.XX$</set> </done> </search> <drilldown> <condition match="5==5"> <set token="test1">X5</set> <set token="test2">a</set> <set token="test3">b</set> </condition> <condition match="1==9"> <set token="test1">a</set> <set token="test2">X2</set> <set token="test3">b</set> </condition> <condition match="2==3"> <set token="test1">a</set> <set token="test2">b</set> <set token="test3">X3</set> </condition> </drilldown> </single> </panel> </row> [... ]  </dashboard> The token "testtest" is working. Why do the tokens ($test1$, $test2$ and $test3$) not get set? The condition "5==5" cannot be false.

gerbert · ‎03-27-2021

Thanks! So in case someone in the future has the same problem. You need to enclose the above code in something like this: <row> <panel depends="$alwaysHideCSS$"> <single> <search> [...] </search> <drilldown> [...] </drilldown> </single> </panel> </row>

gerbert · ‎03-27-2021

Hello, I want to conduct a search, set a token according to the search result and then set another bunch of tokens depending on the search result token. However I get the error "<drilldown> not allowed here" in line 13. I use exactly the same syntax as in the example of the splunk documentary (https://docs.splunk.com/Documentation/Splunk/8.1.3/Viz/tokens under the section "Troubleshoot job property access"). Is there some kind of typo I'm not seeing? <dashboard> <label>Title</label> <search> <query> index=somesearch| rename testresult AS XX </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <set token="testtoken">$result.XX$</set> </done> </search> <drilldown> <condition match="1==1"> <set token="test1">X1</set> <unset token="test2"></unset> <unset token="test3"></unset> </condition> <condition match="testtoken==2"> <unset token="test1"></unset> <set token="test2">X2</set> <unset token="test3"></unset> </drilldown> [...] <dashboard> Help would be greatly appreciated.

gerbert · ‎03-10-2021

Hello, I'm still very new to splunk and I could use some help. I hope this question is not too general. I would like to use something like "|eval" before "|mstats", where I have to use |mstats because I use metric names. So just using "|stats" is no option. So I want something like this: |eval = new_field_name=substr(some_field_name, 3, 2) |mstats max(some_metric_field) prestats=f chart=t chart.limit=200 WHERE index=some_index span=1h by new_field_name But I get the error message: Error in 'mstats' command: This command must be the first command of a search. Another problem I have with metric data is that the following search gives me the results I want but is very slow. Any idea why or even better how to fix it? |mpreview index=some_index |search non_metric_field!=0 |stats count by some_field_name

Posts	24
Solutions	2
Karma Given	0
Karma Received	1
Member Since	‎03-10-2021

Online Status	Offline
Date Last Visited	‎08-30-2021 05:45 AM

update KVStore Lookup with scheduled Alert

How to add user comments to lookup table and save ...

Can I stack two text inputs above each other?

Search character *

group search results by hour of day

html CSS override: setting height of line break <b...

access row in xyseries

problem with "condition match" tokens

problem with "condition match" tokens

problem with 'condition match'

update KVStore Lookup with scheduled Alert

How to add user comments to lookup table and save ...

Re: metric stats

Can I stack two text inputs above each other?

Re: Search character *

Re: Search character *

Re: Search character *

Search character *

Re: group search results by hour of day

group search results by hour of day

html CSS override: setting height of line break <b...

Re: access row in xyseries

access row in xyseries

Re: problem with 'condition match'

Re: problem with 'condition match'

problem with "condition match" tokens

problem with "condition match" tokens

problem with 'condition match'

Re: <drilldown> not allowed here

<drilldown> not allowed here

metric stats