About Aroot002

Aroot002 · ‎10-26-2022

I'm actually accepting your first response as a solution... essentially your answer was the correct one. My problem was being caused by an underlying issue with the logs I am querying.

Aroot002 · ‎10-24-2022

Yes, the error is "Ignoring fieldname "value1" for search expansion due to error="search string cannot be empty" "Ignoring fieldname "value2" for search expansion due to error="search string cannot be empty"

Aroot002 · ‎10-24-2022

I actually just did a simple search to test it out. index=index_name source_type=windows fieldname=* and that got the error. Also tried with quotation marks. But if I change the fieldname to a different one I don't get that error. I don't have a lot of experience in this so I immediately assumed it was something I am doing.

Aroot002 · ‎10-24-2022

I'm actually working on my other computer, but I did click the glass, I got the same error when the search opened, could this be more of a log issue? I actually swapped it out for another field and did not get the error.

Aroot002 · ‎10-24-2022

Same issue, says that it's ignoring search expansion due to error "search string cannot be empty"

Aroot002 · ‎10-24-2022

So I've searched and searched but can't seem to find an answer to my issue. I need to add an all option to my dynamic dropdown. I have found answers that seem like they should be simple enough. Either add All, * to static or alter the XML code. I've tried both, (I think when I altered the XML code it pretty much caused the dropdown to be the exact same way as it was had I just added the options to the static section) and each time I am getting a "search string cannot be empty" error. Don't know if it matters but I did watch a couple youtube videos, their search used | table fieldname | dedup fieldname at the end, when I did that I got the same issue, but now all the field values are grouped together, so I'm doing | stats count by fieldname at the end

Aroot002 · ‎06-08-2022

Hi everyone, I'm trying to complete the lab exercises on one of the trainings. I was probably about 2/3 done, and then my lab environment froze. I tried to refresh and it's saying the server is taking too long to respond. Also tried relaunching the lab session with the same result. I emailed "live support" at elearn@splunk.com with my issue but it's been 45 minutes and I haven't even received an acknowledgement of my inquiry. Any suggestions? Anyone know how long I should wait? Will also note I tried asking for a grade for the stuff I completed, it can't grade anything. I think my work is just gone but it says " If you are experiencing access issues DO NOT shutdown your servers. Leave them running and contact elearn@splunk.com for assistance." and my countdown to decommissioning is ticking.

Aroot002 · ‎06-28-2021

So I'm sorry if this is a rather stupid question, but I have been thrown into creating a dashboard and I've only taken a couple virtual courses on Splunk and I don't remember this being covered. I know how to create dashboards from searches, however I need to create a dashboard from something I'm pulling up through the incident review search, or if I group the events into an investigation create a dashboard from those results. Alternatively, is there a way to figure out exactly what the search string of the index review is using, as if there is I would know how to go from there, but I've tried doing searches through the indexes and sources I feel are most commonly used and I can't get the results I get in incident review.

Aroot002 · ‎04-29-2021

Thanks! Canceling the Edit, reducing the size of my window, and then clicking it worked.

Aroot002 · ‎04-29-2021

Hello everyone, I'm new here and to Splunk in general. I have completed Fundamentals 1 and am now on the labs of Module 3 in Fundamentals 2. I am running into an issue with the drilldown editor in the edit dashboard page. The lab instructions say for me to click the 3 dots on the right of the screen (also known as the More actions button) but when I do the "More actions" bubble pops up and nothing appears, the more actions bubble then stays frozen on there until I leave the page or refresh it, see below. The other 3 buttons work fine. I am using Microsoft Edge and I tried Chrome but got the same result. Is there another way to access the Drilldown Editor? I can't progress in the course without actually completing the lab.

Posts	11
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎04-29-2021

Online Status	Offline
Date Last Visited	‎12-21-2022 12:24 PM

How to achieve dynamic dropdown all option?

How to contact support for Lab Exercise Issues?

Making Dashboard from Incident Review Search or Ma...

Accessing Drilldown Editor

Re: Dynamic Dropdown All option issue

Re: Dynamic Dropdown All option issue

Re: Dynamic Dropdown All option issue

Re: Dynamic Dropdown All option issue

Re: Dynamic Dropdown All option issue

How to achieve dynamic dropdown all option?

How to contact support for Lab Exercise Issues?

Making Dashboard from Incident Review Search or Ma...

Re: Accessing Drilldown Editor

Accessing Drilldown Editor