Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About SplnkUse
SplnkUse
Path Finder
Member since:
10-24-2021
01-01-2022
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-24-2021 |
Activity Feed
- Posted Can I feed data directly into Excel? on Splunk Search. 12-31-2021 03:00 AM
- Posted Search since beginning of yesterday on Splunk Search. 12-30-2021 02:57 PM
- Posted Access API as a user on Splunk Search. 12-14-2021 05:56 AM
- Posted Re: Appending tables in searches on Knowledge Management. 12-13-2021 03:23 AM
- Posted Distinct values on Splunk Search. 12-01-2021 03:30 PM
- Tagged Distinct values on Splunk Search. 12-01-2021 03:30 PM
- Posted Re: Appending tables in searches on Knowledge Management. 11-27-2021 05:14 PM
- Posted Triggering searches on Knowledge Management. 11-25-2021 03:07 AM
- Posted Relative time search to find last updated dashboards on Splunk Search. 11-24-2021 02:49 AM
- Posted Can I get notified when the search code of a dashboard changes? on Dashboards & Visualizations. 11-13-2021 02:41 PM
- Posted Is it possible to get notified when a dashboard search changes? on Knowledge Management. 11-07-2021 03:27 AM
- Posted Can I use XML for searches/alerts? on Knowledge Management. 11-05-2021 04:41 PM
- Posted Appending tables in searches on Knowledge Management. 11-05-2021 04:27 PM
- Tagged Appending tables in searches on Knowledge Management. 11-05-2021 04:27 PM
- Posted Re: Can we do: search $dashboard_id$ = 'my_dashboard'? on Knowledge Management. 11-05-2021 04:14 PM
- Posted Re: Can we do: search $dashboard_id$ = 'my_dashboard'? on Knowledge Management. 11-04-2021 01:59 PM
- Posted Searchid for a dashboard on Knowledge Management. 11-04-2021 01:52 PM
- Posted Re: How do I mirror a dashboard privately? on Dashboards & Visualizations. 11-02-2021 02:12 PM
- Posted Re: Can we do: search $dashboard_id$ = 'my_dashboard'? on Knowledge Management. 10-29-2021 03:22 PM
- Posted Re: Can we do: search $dashboard_id$ = 'my_dashboard'? on Knowledge Management. 10-28-2021 01:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-31-2021
03:00 AM
Hello I want to feed data directly into Excel but I do not have API access nor I can install custom connectors. Is there any other solution? I seem to be able to run a search like the below, would that work directly in Excel with MS authentication? | rest splunk_server=local servicesNS/-/-/data/ui/views/ Thanks!
... View more
Labels
- Labels:
-
other
12-30-2021
02:57 PM
Hello If now, it is 30/12/2021 22:30, how can I search for timestamps from 29/12/2021 00:00:00 (i.e. beginning of 29/12/2021 or dynamically 'beginning of yesterday')? I need this in a search code rather than the GUI presets etc. Thanks!
... View more
Labels
- Labels:
-
other
12-14-2021
05:56 AM
Hello I am a Splunk user, not admin, and I seem to be able to do a search like: | rest splunk_server=local servicesNS/-/-/data/ui/views/ Does that mean I have API access and how can I access this via Excel, PowerBI etc? What would be the URI and do I need a separate key? Thanks!
... View more
Labels
- Labels:
-
other
12-13-2021
03:23 AM
@ITWhisperer thanks, I am trying to combine searches in the following format. I know it may be difficult to picture the below but I cannot post more exact data. I think the problem is that the: eval a="aaa" is contained in two different searches and is set to different values. Any idea? index=a aa!="" | fields aa | stats count by aa | eval a="aa" | eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00") | table a b c | append [ search index=aa or index=bbb | eval | stats | eval a="aaa" | eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00") | table a bb cc ] | append [ search index=aa or index=bbb | eval | stats | eval a="aaaa" | eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00") | table a bbb ccc
... View more
12-01-2021
03:30 PM
Hello I am running a * search in an app and it returns several columns in the csv extract where a column is named 'source'. I want to return the distinct values of 'source' but neither of the below work: | values(source) or | distinct source Any idea? thanks!
... View more
- Tags:
- search
Labels
- Labels:
-
field extraction
-
fields
11-27-2021
05:14 PM
@ITWhisperer thanks but I cannot make it work, it seems it does not keep aliases within the brackets and run the whole thing as one, instead of each separately and then join, is there any solution?
... View more
11-25-2021
03:07 AM
Hello, I am still trying to figure out the framework of how things work (please note I am not admin). There is a dashboard which has some radio buttons which trigger specific searches and the results are displayed in the dashboard. I want to trigger these searches ad hoc in the Search webpage. So I need to: Get a search alias/link/id for each of the searches in the dashboard Use these aliases to trigger the same search manually I would prefer to use a REST API command directly in my PowerBI, is that possible? If not, I would still prefer to use a REST API command in the Search webpage Unfortunately, the following does not work for me: | rest /services/data/ui/views/ But this works: | rest splunk_server=local servicesNS/-/-/data/ui/views/ Can you help me with the right code please? Thanks!
... View more
Labels
- Labels:
-
alias
11-24-2021
02:49 AM
Hello, Can you tell me please why the below does not work? | rest splunk_server=local servicesNS/-/-/data/ui/views/ | where update > relative_time(now(),"-10d@d") I want to search the dashboards that were updated in the last 10 days but it does not seem to return anything. Is it because I need to fix the timestamp format? Thanks!
... View more
Labels
- Labels:
-
other
11-13-2021
02:41 PM
Hello Can I get notified when the search code of a dashboard changes? I am not admin/owner. Thanks!
... View more
Labels
- Labels:
-
other
11-07-2021
03:27 AM
Hello I am a user of some dashboards and not admin/dev. Is it possible that I get an email whenever the search code of a dashboard changes? Thanks!
... View more
Labels
- Labels:
-
other
11-05-2021
04:41 PM
Hello Can I use XML for searches/alerts? Is there any reference? Can you provide an example to perform a search for a particular view? Thanks!
... View more
Labels
- Labels:
-
other
11-05-2021
04:27 PM
Hello Is it possible to append two searches? I have a search that ends in: | table A B C And I want to append to the above some values under A, B, C that I calculate. Can you tell me please the syntax for that? Thanks!
... View more
- Tags:
- other
Labels
- Labels:
-
other
11-05-2021
04:14 PM
@richgalloway thanks, I tried that, visiting the url above leads to an Oops not found page and via curl it says 303 error. Does that mean I do not have API access?
... View more
11-04-2021
01:59 PM
@richgalloway thanks but is there a way to check if I have Rest access? I am only a user not a dev. Also, can you provide please the complete syntax based on my main url? I tried some starting uris but they resulted in 404. My main url is https://mysite.splunkcloud.com/en-US/app/myapp/mydashboard
... View more
11-04-2021
01:52 PM
Hello Can I get the searchid for the search that is triggered by a dashboard? What is the syntax to use this searchid to create an alert? Will this searchid trigger the search of the same dashboard even if the underlying search code of the dashboard changes? Thanks!
... View more
Labels
- Labels:
-
other
11-02-2021
02:12 PM
@bowesmana many thanks for this but I have not been able to find a particular detail: will the cloned dashboard automatically update when the original dashboard is updated? (I mean its query/code)? Thanks!
... View more
10-29-2021
03:22 PM
@richgalloway mm unfortunately it does not work. I am not the author of the dashboard that's why I am struggling. If I click to Edit the dashboard, it only offers to either Clone it or make it a Home Dashboard. I clicked to Clone and then checked the source and it is completely empty. Is there a way to create a search by the $dashboard.label$ of the dashboard and can you provide a sample syntax please? Without knowing its source/XML or being able to edit it? I only want to run it periodically to get alerts.
... View more
10-28-2021
01:39 PM
@richgalloway thanks but can you give me an example please? What are the steps from the below to create a search to always link to a dashboard?
... View more
10-26-2021
11:13 AM
Hello Is it possible to run the search of a dashboard by using its ID? Also, can I add fields to the search above? I.e. if a dashboard conducts this search: (index="mysource" earliest=-264h latest=now()) | eval metric=case(index="mysource", '_time') ... Can I do something like: search $dashboard_id$ = 'my_dashboard' | eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00") | table A1 A2 Timestamp I.e. append additional code? Thanks!
... View more
Labels
- Labels:
-
alias
10-25-2021
12:28 PM
Yes, a saved search would be ideal but what would be its syntax so that it automatically mirrors the search that is triggered when I visit a particular dashboard and reflects any changes in the dashboard underlying code? Would a SID or token or any other way be ideal? I also see there is a 'Dashboard ID' listed under Apps/Dashboards would that be the right alias? Can you provide the steps please to do that? I.e.: 1) Get the SID/token or alias or anything like that by ..... 2) Create a search with the above info by .... 3) Create alert with the above search (I know how to do that) Thanks!
... View more
10-25-2021
12:26 PM
Hello There are several dashboards in the app created by others and there is a Clone button. I want to clone/mirror some dashboards which will be totally private i.e. only visible/editable by me. Will this Clone button offer that? I am reluctant to click it because I do not want to create Dashboard2 and confuse all other users! Thanks!
... View more
Labels
- Labels:
-
other
10-24-2021
07:30 AM
Thanks, could you briefly explain the steps please? What I was doing so far was to visit the dashboard, go to Jobs, check the search code there and create an alert with it. Where do I see the token (or create one) and how do I create a search with it? Thanks!
... View more
- Tags:
- hanks
10-24-2021
02:38 AM
Hello! A dashboard runs a search and I want to create an alert for this. So I replicated the search code to the alert. However, now, if there is a change in the dashboard, my alert will not be updated. Is there a way to create an alert with a search like: "search dashboard1" or something so that whatever changes happen to the dashboard, they will be fed into my alert? Thanks!
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-01-2022
03:07 PM
|
