Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jhanvidattani
jhanvidattani
Path Finder
Member since:
07-24-2021
01-06-2022
Community Statistics
| Posts | 31 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 9 |
| Member Since | 07-24-2021 |
Activity Feed
- Got Karma for Re: Display and hide column based on dropdown value. 10-25-2023 08:46 AM
- Posted Error while connecting to Splunk Connect for kakfka on All Apps and Add-ons. 01-06-2022 02:23 AM
- Tagged Error while connecting to Splunk Connect for kakfka on All Apps and Add-ons. 01-06-2022 02:23 AM
- Posted Re: Pass tokens from multiselect dropdown to charts on Getting Data In. 11-09-2021 11:30 PM
- Posted Re: Pass tokens from multiselect dropdown to charts on Getting Data In. 11-09-2021 11:14 PM
- Posted Re: Creating Pie Chart with three separate fields and their percentage value on Dashboards & Visualizations. 11-02-2021 10:47 PM
- Tagged Re: Creating Pie Chart with three separate fields and their percentage value on Dashboards & Visualizations. 11-02-2021 10:47 PM
- Posted Re: Creating Pie Chart with three separate fields and their percentage value on Dashboards & Visualizations. 11-02-2021 04:30 AM
- Posted Re: how to make Legend NOT clickable? on Dashboards & Visualizations. 11-02-2021 03:34 AM
- Posted Re: Splunk strptime returning NaN on Dashboards & Visualizations. 10-26-2021 06:23 AM
- Posted Re: Dashboard visualization on Dashboards & Visualizations. 10-26-2021 12:38 AM
- Got Karma for Re: How to hide cloumns in the table the basis of multiselect choices?. 10-02-2021 03:40 AM
- Posted Re: How to hide cloumns in the table the basis of multiselect choices? on Dashboards & Visualizations. 10-02-2021 02:57 AM
- Posted Re: Column chart - adding labels directly below each column and coloring the columns on Dashboards & Visualizations. 10-02-2021 02:46 AM
- Posted Re: Dashboard search waiting for input while token is present on Dashboards & Visualizations. 10-02-2021 02:41 AM
- Posted Re: Search Help combine with Dashboard on Dashboards & Visualizations. 10-02-2021 02:25 AM
- Karma Re: Why use data models instead of just having reports ? for richgalloway. 09-26-2021 02:55 AM
- Got Karma for Re: Adding Custom Sidebar to Splunk UI. 09-15-2021 12:07 PM
- Got Karma for Re: Adding Custom Sidebar to Splunk UI. 09-15-2021 12:07 PM
- Posted Re: Adding Custom Sidebar to Splunk UI on Dashboards & Visualizations. 09-13-2021 10:09 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
01-06-2022
02:23 AM
Hello We want to connect one Kafka machine with Splunk connect for Kafka but it's throwing the below error in file: config/connect-distributed.properties. [Worker clientId=connect-1, groupId=MySuperSystemID_group] Uncaught exception in herder work thread, exiting: (org.apache.kafka.connect.runtime.distributed.DistributedHerder:324)
org.apache.kafka.connect.errors.ConnectException: Could not look up partition metadata for offset backing store topic in allotted period. This could indicate a connectivity issue, unavailable topic partitions, or if this is your first use of the topic it may have taken too long to create.
at org.apache.kafka.connect.util.KafkaBasedLog.start(KafkaBasedLog.java:184)
at org.apache.kafka.connect.storage.KafkaOffsetBackingStore.start(KafkaOffsetBackingStore.java:145)
at org.apache.kafka.connect.runtime.Worker.start(Worker.java:197)
at org.apache.kafka.connect.runtime.AbstractHerder.startServices(AbstractHerder.java:128)
at org.apache.kafka.connect.runtime.distributed.DistributedHerder.run(DistributedHerder.java:310)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748) The configuration looks like this: group.id=MySuperSystemID_group bootstrap.servers=https://x.x.x.x:9093 #key.converter=org.apache.kafka.connect.storage.StringConverter #value.converter=org.apache.kafka.connect.storage.StringConverter # SSL Configuration security.protocol=SSL ssl.client.auth=required # enable two way SSL ssl.endpoint.identification.algorithm = ssl.key.password=password ssl.keystore.location=/root/files/keystore.jks ssl.keystore.password=password ssl.keystore.type = JKS ssl.truststore.location=/root/files/truststore.jks ssl.truststore.password=password ssl.enabled.protocols=TLSv1.2,TLSv1.1 ssl.truststore.type=JKS Can someone please guide me over here?
... View more
Labels
- Labels:
-
configuration
-
installation
11-09-2021
11:30 PM
Can you execute the SPL of the panel so it could be more clear what value is being passed in token or share the XML code over here so we can look into it.
... View more
11-09-2021
11:14 PM
@anooshac Can you refer to below code for the solution: <form>
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label>Time range</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="source_token" searchWhenChanged="true">
<label>Sourcetype</label>
<delimiter> OR </delimiter>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<choice value="*">All</choice>
<search>
<query>index="_internal" | stats count by sourcetype </query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
<valuePrefix>sourcetype=</valuePrefix>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Associated Source</title>
<search>
<query>index="_internal" $source_token$ | stats Count by source | rename source as Source</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form> If you find my solution fruitful, an upvote would be appreciated.
... View more
11-02-2021
10:47 PM
You can try it as: index<your_index> | fields ia_*| fieldsummary | table field, distinct_count Pie chart will create sections depending on count of each field and calculate percentage by default (visible by hovering on each segment).
... View more
- Tags:
- Try
11-02-2021
04:30 AM
@P_raju You can use fieldsummary command to do this. Example: index="_internal"| fieldsummary | table field, distinct_count If you find my solution/debugging steps fruitful, an upvote would be appreciated.
... View more
11-02-2021
03:34 AM
@sanjum01 If you want to display the legends but disable the click events on them, then you can add CSS code mentioned in this Link.
... View more
10-26-2021
06:23 AM
@trever I am not sure why it's not working. But can you try below code: <form>
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Sources</title>
<search>
<query>index="_internal" | stats count by source, sourcetype, _time | eval Timestamp = strftime(_time, "%m/%d/%Y %H:%M:%S %Z"), epoch_time = strptime(Timestamp, "%m/%d/%Y %H:%M:%S %Z")</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<fields>source, sourcetype,Timestamp</fields>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<eval token="endTimestamp">strftime(relative_time($row.epoch_time$,"+30m"), "%m/%d/%Y %H:%M:%S %Z")</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>Drilldown Value</title>
<search>
<query>|makeresults sample_field=$endTimestamp$</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form> If you find my solution/debugging steps useful, an upvote would be appreciated.
... View more
10-26-2021
12:38 AM
@Mrig342 Can you try below solution: <form>
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Test</title>
<search>
<query>index="_internal" | stats count by source | eval Result=if("count"="0","Ok","Error")| fields Result, count | rangemap field=count low=0-0 default=severe</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</form> We will be using Splunk's rangemap command, with which we can give colour to required field. Refer Link to know which colour applies to which severity. If you find my solution fruitful, then an upvote would be appreciated.
... View more
10-02-2021
02:57 AM
1 Karma
@snehal We can implement this thing by making use of Splunk tokens. Can you refer to below sample code? <form>
<label>Sample Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label>Time range</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="severity_token">
<label>Select Severity</label>
<choice value="critical">critical</choice>
<choice value="high">high</choice>
<choice value="low">low</choice>
<choice value="medium">medium</choice>
<initialValue>critical</initialValue>
<delimiter>,</delimiter>
</input>
</fieldset>
<row>
<panel>
<table>
<title>My Table</title>
<search>
<query>index="_internal" | rename date_hour as high | rename date_month as low | rename date_year as critical | rename date_zone as medium | dedup $severity_token$ | table $severity_token$</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="count">10</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form> If you find my solution fruitful, then an upvote would be appreciated.
... View more
10-02-2021
02:46 AM
You can refer to spunk solution to see how to assign a specific colors to chart columns based on it's value: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-assign-colors-to-values-in-a-chart/m-p/302990
... View more
10-02-2021
02:41 AM
Can you share dashboard code with inputs and 1/2 panels? So, it would be easy to debug further.
... View more
10-02-2021
02:25 AM
@coric You can try the below thing to handle this. It will give the latest value of Attack_type for given ip_adddress. | stats first(Attack_Type) count as Count by ip_address If you are using tstats command and Data model, then you can also go for the below thing: | tstats summariseonly=<keep_it_configurable> latest(<data_model>.Attack_type) from datamodel=<> by <data_model>.ip_address If you find my solution fruitful, then an upvote would be appreciated.
... View more
09-13-2021
10:09 PM
1 Karma
@davidoff96 I have not worked with dot net, but I can provide steps for SPlunk: Follow the below things to make changes in your Splunk App: Navigate to folder $SPLUNK_HOME/etc/apps/<app_name> In default/data/ui/nav/default.xml add <file_name> so it becomes visible in Splunk Navigation Bar In default/data/ui/views add <file_name.xml> wherein we will be adding actual dashboard code (input and panels) Add your <custom_file.js> file in appserver/static folder Restart Splunk In <file_name> dashboard (which will now be visible from UI) add your HTML code (refer to link mentioed in previos comment) and import your js file as: <form script="custom_file.js"> If you find my solution/debugging steps useful, then an upvote would be appreciated.
... View more
09-10-2021
12:45 PM
@skrishna Let's say your SPL returns 15 results, then the pie chart will show the top 10 values with maximum count and showing the remaining 5 in Other fields. To match with the event, you can separately execute panel query (which will have all results) and can match count with indexed data. If you find my solution/debugging steps fruitful, then an upvote would be appreciated
... View more
09-10-2021
12:34 PM
1 Karma
Hello @davidoff96 I have never such a case before, but regarding js you can try the below thing: Added HTML code in XML dashboard and provide some id to it. Perform changes for this id from js file (which can be included in <dashboard script="file.js">
... View more
08-21-2021
03:12 AM
@bowesmana Yes, the row is not working with a pie-chart. Can you check the below code to implement your use case? <dashboard>
<label>States</label>
<row>
<panel>
<chart>
<title>States Chart</title>
<search>
<query>| inputlookup geo_attr_us_states | stats count by state_name</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="my_token">$click.value$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<table depends="$my_token$">
<title>States Details</title>
<search>
<query>| inputlookup geo_attr_us_states where state_name="$my_token$" </query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="count">5</option>
</table>
</panel>
</row>
</dashboard> If you find my solution useful, an upvote would be appreciated.
... View more
08-21-2021
02:28 AM
@shakSplunk I don't have much idea about these hyperlinks but to avoid scrolling for a long way, you can add below XML tag for tables. It will show 5 rows at a time and provide pagination for more than 5 entries. <option name="count">5</option> If you find my solution fruitful, an upvote would be appreciated.
... View more
08-10-2021
10:10 AM
Can you confirm whether the sdk sets the value of _time from code?
... View more
08-08-2021
06:16 AM
@Vyber90 Can you add the below config in the inputs.conf file for your stanza? followTail = 1 ReF: Splunk Ans Check props and conf of followTail here: Inputsconf If you find my solution/debugging steps fruitful, an upvote would be appreciated.
... View more
08-08-2021
05:57 AM
@awalton Can you add below setting in props.conf for json data ingested: [covid_vacc_data_ingest]
DATETIME_CONFIG = None
TIME_PREFIX = "date":
TIME_FORMAT = %Y-%M-%D
... DATETIME_CONFIG: Splunk will not to take any timestamp by default by this config TIME_FORMAT and TIME_PREFIX: Splunk will take timestamp of format %Y-%M-%D from date field If you find my solution fruitful an upvote will be appreciated.
... View more
08-03-2021
09:51 PM
@agw Happy to hear that the issue is resolved 🙂 But I believe that the syntax error for except statement is due to the different python version. Change in the value of source would solve below error and not error for except statement: JsonLineBreaker - JSON StreamId:17225535322107805233 had parsing error:Unexpected character while expecting '"': '\'' - data_source="C:\Program Files\Splunk\bin\scripts\NEW.py", data_host="splunkindexer1", data_sourcetype="_json" Correct me if am missing anything.
... View more
08-02-2021
10:07 PM
1 Karma
This except HTTPError, e: syntax works only for python2. For code to be python2 and python3 compatible, the syntax would be: except HTTPError as e: You can change the syntax as mentioned above, for code to be both python2 and python3 compatible. Also, by doing this you won't need to hardcode the python version. Can you check the python version for the machine in which it is successfully executing? I feel it would be py2 and not py3.
... View more
08-02-2021
06:40 AM
Yes, there is a way for this. You can set the value of the python version as mentioned here: Link
... View more
08-01-2021
11:10 PM
1 Karma
@agw For this can you execute the below command from the bin directory to check the default version of python used by Splunk? ./splunk cmd python -V
... View more
07-31-2021
03:49 AM
@sushil_sh Using join command between both queries would look like this: sourcetype="abc" <further_query> | join ServerName [search sourcetype="xyz" <further_query>] Basically, mentioned the field/s that is common for both searches. Further information about various options or behaviour of join command is available: join If you find my solution/debugging steps fruitful, an upvote would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-06-2022
05:05 AM
|
Karma from
