About NanSplk01

NanSplk01 · ‎04-09-2026

Unfortunately adding that gives me: [Error: Input is not present in the global inputs structure or layout structure]: Input "index_filter" is defined but not used in either the Global Inputs Structure or in any Layout Structure "inputs": { "index_filter": { "type": "input.text", "title": "Search Index Name", "options": { "token": "index_filter", "defaultValue": "" } } },

NanSplk01 · ‎04-09-2026

{ "title": "Index Ownership Lookup", "description": "Search index ownership and contact details from CSV lookup data.", "theme": "light", "inputs": { "index_filter": { "type": "input.text", "title": "Search Index Name", "token": "index_filter", "defaultValue": "" } }, "dataSources": { "ds_index_lookup": { "type": "ds.search", "options": { "query": "| inputlookup index_ownership.csv | eval index_lc=lower(index) | where \"$index_filter$\"=\"\" OR like(index_lc, \"%\" . lower(\"$index_filter$\") . \"%\") | fields index Owner Contact | sort index" } } }, "visualizations": { "index_table": { "type": "splunk.table", "dataSources": { "primary": "ds_index_lookup" }, "options": { "rowNumbers": true, "wrap": true, "cellPadding": "compact" } } }, "layout": { "tabs": { "items": [ { "layoutId": "layout_1", "label": "New tab" } ] }, "layoutDefinitions": { "layout_1": { "type": "absolute", "structure": [ { "item": "index_table", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 650 } } ] } } } } I have tried taking out the extra properties, but it just gives me a different error. This dashboard will be reading a csv file which does exist. How can I fix this so that the app will run?

NanSplk01 · ‎02-03-2026

I was finally able to get it to work with help from you guys: index IN ("pisupport", "pisupport-np") sourcetype=PIMessage procbook "Successful Login" | rex field=_raw "Username\s*:\s*(?<username>\S+)" | where NOT match(username, "(?i)(OT00564|CHawki5|DPerez3|AGross2)") | dedup username | table username Now I need to add in the other data so they get date and time. Thanks to all

NanSplk01 · ‎01-29-2026

I even tried just the following, but it brought back the ID: index IN ("pisupport", "pisupport-np") sourcetype=PIMessage ("procbook" AND "Successful Login") | rex field=_raw "Identity\sList:\s(?<identity>[^.]+)" | rex field=_raw "Username\s:\s(?<username>[^.]+)" | dedup username | where username!="NAM\\OT00564" | table username

NanSplk01 · ‎01-29-2026

Giuseppe, unfortunately the search did not work for me. However, you are correct, I want to exclude those ID's from the results of my search and only list ID's that don't match them. I've tried a variety of ways, but I either get nothing, an error, or the ID's still show in the listing.

NanSplk01 · ‎01-29-2026

I have a search started, but it's failing to run. What I want is to eliminate some ID's and only bring back ID's that are not in a listing: index IN ("pisupport", "pisupport-np") sourcetype=PIMessage ("procbook" AND "Successful Login") | rex field=_raw "Identity\sList:\s(?<identity>[^.]+)" | rex field=_raw "Username\s:\s(?<username>[^.]+)" | stats count AS Total_Connections, latest(_time) AS Latest_Timestamp, values(identity) AS Security_Mapping, values(host) AS Connected_Hosts, values(username) as LanID by username | eval where LanID NOT IN("NAM\\OT00564",NAM\\CHawki5) | eval Latest_Timestamp=strftime(Latest_Timestamp, "%Y-%m-%d %H:%M:%S") | sort - Latest_Timestamp | table Latest_Timestamp, Total_Connections, LanID, Connected_Hosts, Security_Mapping

NanSplk01 · ‎12-02-2025

This worked perfectly.

NanSplk01 · ‎11-26-2025

I am new to dashboarding drop downs and I'd like to create a drop down for each slice of the pie. I have created a search as a pie chart and tried to add a drop down that will search for only the slice I have selected. So far it's not going anywhere. This is what I have: "title": "Demo DCP Levels", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } }, "tokens": { "default": { "DCP-ERROR": { "value": "ERROR" }, "ERROR": { "value": "ERROR" } } }, "visualizations": { "global": { "showProgressBar": true } } }, "visualizations": { "viz_4Ur0ZwMO": { "containerOptions": {}, "dataSources": { "primary": "ds_iY2W7D6g" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "row.ERROR.value", "token": "ERROR" } ] }, "type": "drilldown.setToken" }, { "options": { "tokens": [ { "token": "DCP-ERROR", "value": "ERROR" } ] }, "type": "drilldown.setToken" } ], "showLastUpdated": false, "showProgressBar": true, "title": "DCP Levels", "type": "splunk.pie" } }, "dataSources": { "ds_iY2W7D6g": { "name": "Pie chart search", "options": { "query": "index=\"dcp-np\" level!=INFO \n| dedup level\n| stats count by level", "queryParameters": { "earliest": "-15m", "latest": "now", "sampleRatio": "1" } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "gutterSize": 10, "height": 960, "width": 1440 }, "structure": [ { "item": "viz_4Ur0ZwMO", "position": { "h": 250, "w": 1440, "x": 0, "y": 0 }, "type": "block" } ], "type": "grid" } }, "options": {}, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } }, "applicationProperties": { "hideEdit": false, "hideExport": false } } How can I select a piece of the pie to drop down to another search?

NanSplk01 · ‎09-29-2025

Unfortunately neither brought back only those indexes that were just zero, it brought back all indexes and they were all counted as zero.

NanSplk01 · ‎09-24-2025

NanSplk01 · ‎02-19-2025

Was able to get it working this way. index=kafka-np sourcetype="KCON" connName="CCNGBU_*" ERROR!=INFO _raw=* | eval error_msg = case(match(_raw, "Disconnected"), "disconected", match(_raw, "restart failed"), "restart failed", match(_raw, "Failed to start connector"), "failed to start connector") | search error_msg=* | dedup connName | table host connName error_msg ERROR

NanSplk01 · ‎02-18-2025

I think I'm close, but the error_msg does not display: index=kafka-np sourcetype="KCON" connName="CCNGBU_*" ERROR=ERROR OR ERROR=WARN | eval error_msg = case(match(_raw, "Disconnected"), "disconected", match(_raw, "restart failed"), "restart failed", match(_raw, "Failed to start connector"), "failed to start connector") | dedup host | table host connName error_msg

NanSplk01 · ‎02-18-2025

Can you provide a sample?

NanSplk01 · ‎02-13-2025

So I have been trying to use if statements, but I don't seem to be getting the if statement correct: index=kafka-np sourcetype="KCON" connName="CCNGBU_*" ERROR=ERROR OR ERROR=WARN Action="restart failed" OR Action="disconnected" OR Action="Task threw an uncaught an unrecoverable exception" | eval if(Action="restart failed", "restart failed", "OK", Action="disconnected","disconnected","OK", Action="Task threw an uncaught an unrecoverable exception", "ok") | table Action host connName I've tried several different formats for the if, but it keeps telling me the if statements are wrong. What am I not seeing here?

NanSplk01 · ‎02-13-2025

StatusMsg is the field (on the fly field) that I want to be populated by the message so I'm not certain what you mean by <<some expression>> So that was why I thought maybe this would be an if then type of query. If StatusMsg="some value" then put that in the table along with the other data. If not, then go to the next status message. So I would want: Action Host ConnName "Task through an uncaught..." lx....... CCNBU---- So should this be an if then search?

NanSplk01 · ‎02-12-2025

I have the following values that will go in a field titled StatusMsg: "Task threw an uncaught and unrecoverable exception" "Ignoring await stop request for non-present connector" "Graceful stop of task" "Failed to start connector" "Error while starting connector" "Ignoring error closing connection" "failed to publish monitoring message" "Ignoring error closing connection" "restart failed"| "disconnected" "Communications link failure during rollback" "Exception occurred while closing reporter" "Connection to node" "Unexpected exception sending HTTP Request" "Ignoring stop request for unowned task" "failed on invocation of onPartitionsAssigned for partitions" "Ignoring stop request for unowned connector" "Ignoring await stop request for non-present connector" "Connection refused" I am not certain how to do this. This is the base search: index=kafka-np sourcetype="KCON" connName="CCNGBU_*" ERROR=ERROR OR ERROR=WARN I want to create the field on the fly and have it pick up the appropriate CASE value. I would then put it in a table with host connName StatusMsg Any assist would be greatly appreciated.

NanSplk01 · ‎02-05-2025

All I want to get from the subsearch is to bring back the field actions. It can probably be a much smaller search.

NanSplk01 · ‎02-04-2025

index=cim_modactions source=/opt/splunk/var/log/splunk/incident_ticket_creation_modalert.log host=sh* search_name=* source=* sourcetype=modular_alerts:incident_ticket_creation user=* action_mode=* action_status=* search_name=kafka* [| rest /servicesNS/-/-/saved/searches | search title=kafka* | rename dispatch.earliest_time AS "frequency", title AS "title", eai:acl.app AS "app", next_scheduled_time AS "nextRunTime", search AS "query", updated AS "lastUpdated", action.email.to AS "emailTo", action.email.cc AS "emailCC", action.email.subject AS "emailSubject", alert.severity AS "SEV" | eval severity=case(SEV == "5", "Critical-5", SEV == "4", "High-4",SEV == "3", "Warning-3",SEV == "2", "Low-2",SEV == "1", "Info-1") | eval identifierDate=now() | convert ctime(identifierDate) AS identifierDate | table identifierDate title lastUpdated, nextRunTime, emailTo, query, severity, emailTo, actions | fillnull value="" | sort -lastUpdated actions] | table user search_name action_status date_month date_year _time

NanSplk01 · ‎02-04-2025

I want to use the 2nd search as a subsearch only bringing back the actions. How can I do this? SEARCH | rest /servicesNS/-/-/saved/searches | search title=kafka* | rename dispatch.earliest_time AS "frequency", title AS "title", eai:acl.app AS "app", next_scheduled_time AS "nextRunTime", search AS "query", updated AS "lastUpdated", action.email.to AS "emailTo", action.email.cc AS "emailCC", action.email.subject AS "emailSubject", alert.severity AS "SEV" | eval severity=case(SEV == "5", "Critical-5", SEV == "4", "High-4",SEV == "3", "Warning-3",SEV == "2", "Low-2",SEV == "1", "Info-1") | eval identifierDate=now() | convert ctime(identifierDate) AS identifierDate | table identifierDate title lastUpdated, nextRunTime, emailTo, query, severity, emailTo | fillnull value="" | sort -lastUpdated SUBSEARCH | rest "/servicesNS/-/-/saved/searches" timeout=300 splunk_server=* | search disabled=0 | eval length=len(md5(title)), search_title=if(match(title,"[-\\s_]"),("RMD5" . substr(md5(title),(length - 15))),title), user='eai:acl.owner', "eai:acl.owner"=if(match(user,"[-\\s_]"),rtrim('eai:acl.owner',"="),user), app_name='eai:acl.app', "eai:acl.app"=if(match(app_name,"[-\\s_]"),rtrim('eai:acl.app',"="),app_name), commands=split(search,"|"), ol_cmd=mvindex(commands,mvfind(commands,"outputlookup")), si_cmd=mvindex(commands,mvfind(commands,"collect")) | rex field=ol_cmd "outputlookup (?<ol_tgt_filename>.+)" | rex field=si_cmd "index\\s?=\\s?(?<si_tgt_index>[-_\\w]+)" | eval si_tgt_index=coalesce(si_tgt_index,'action.summary_index._name'), ol_tgt_filename=coalesce(ol_tgt_filename,'action.lookup.filename') | rex field=description mode=sed "s/^\\s+//g" | eval description_short=if(isnotnull(trim(description," ")),substr(description,0,127),""), description_short=if((len(description_short) > 126),(description_short . "..."),description_short), is_alert=if((((alert_comparator != "") AND (alert_threshold != "")) AND (alert_type != "always")),1,0), has_report_action=if((actions != ""),1,0) | fields + app_name, description_short, user, splunk_server, title, search_title, "eai:acl.sharing", "eai:acl.owner", is_scheduled, cron_schedule, max_concurrent, dispatchAs, "dispatch.earliest_time", "dispatch.latest_time", actions, search, si_tgt_index, ol_tgt_filename, is_alert, has_report_action | eval object_type=case((has_report_action == 1),"report_action",(is_alert == 1),"alert",true(),"savedsearch") | where is_alert==1 | eval splunk_default_app = if((app_name=="splunk_archiver" OR app_name=="splunk_monitoring_console" OR app_name="splunk_instrumentation"),1,0) | where splunk_default_app=0 | fields - splunk_server, splunk_default_app | search title=*kafka* | table actions title user

NanSplk01 · ‎11-19-2024

Thanks, I used a similar configuration and now it works. I had to use the == rather than the = index=websphere websphere_logEventType=* | stats count(websphere_logEventType) BY websphere_logEventType | eval websphere_logEventType=case(websphere_logEventType=="I", "INFO",websphere_logEventType=="E", "ERROR", websphere_logEventType=="W", "WARNING", websphere_logEventType=="D", DEBUG, true(),"Not Known" ) | dedup websphere_logEventType

NanSplk01 · ‎11-19-2024

This is my search. I brings back Not Known for every field instead of the correct case name: index=websphere websphere_logEventType=* | stats count(websphere_logEventType) BY websphere_logEventType | eval websphere_logEventType=case(websphere_logEventType=I, "INFO",websphere_logEventType=E, "ERROR", websphere_logEventType=W, "WARNING", websphere_logEventType=D, DEBUG, true(),"Not Known" ) What am I missing that will bring the count and the case that the count is for instead of always the Not Known case?

NanSplk01 · ‎11-13-2024

index=replicate category=* action=* Message=* [search index=replicate | eval Msg=substr(Message,1,30)] | stats count by action category Msg | dedup action This is what I'm trying to do. The Message field is very large and I only need the first sentence of the Message. How can I do this? We want it in a sub-search to show the sub-search function for our users. This is Splunk Cloud implementation.

NanSplk01 · ‎07-30-2024

Well, I did find another line which has the date and time, but it's over 15 lines into the log file. We need to start with the first line which is the beginning of the stanza, but get the timestamp which is 15th line showing after the opening line shown below C:\Program Files\Universal\UAGSrv\xxxl_p01.nam>set StartDate=Tue 07/23/2024 This is the actual timestamp which I think would work since it has both date and time (hoping that's what the _80514 is the time?? Files\Universal\UAGSrv\xxx_p01.nam>set timestamp=20240723_80514

NanSplk01 · ‎07-29-2024

It is one of several blocks of lines inside the log file. Each starts with the little snippet I put above and then has any number of lines after it. While the file is a .txt, the look to me would be a xml document that pushes out the log file. I've not seen one like it before. I was thinking I'd need a props or transform or both to set this date/time, but it's my first experience with it.

NanSplk01 · ‎07-29-2024

I am trying to create a sourcetype for a new client: Note StartDate=xxxx is where the log begins. However the StartTime=*** is not with it, but I need both int he logs. How do I create this sourcetype? C:\Program Files\Universal\UAGSrv\xxx>set StartDate=Mon 07/29/2024 C:\Program Files\Universal\UAGSrv\xxx>set sdy=2024 C:\Program Files\Universal\UAGSrv\xxx>set sdm=07 C:\Program Files\Universal\UAGSrv\xxx>set sdd=29 C:\Program Files\Universal\UAGSrv\xxx>set sdy=2024 C:\Program Files\Universal\UAGSrv\xxx>set sdm=07 C:\Program Files\Universal\UAGSrv\xxx>set sdd=29 C:\Program Files\Universal\UAGSrv\xxx>set StartTime=14:45:09.56 any assistance would be very helpful and appreciated.

Posts	63
Solutions	3
Karma Given	1
Karma Received	4
Member Since	‎03-07-2022

Online Status	Offline
Date Last Visited	‎04-09-2026 07:49 AM

Getting [/inputs/index_filter]: must NOT have addi...

How to search for values not in a listing

Drill down from pie chart in dashboard studio

Trying to create a search that will bring back ind...

How to create a field on the fly using CASE

Trying to add a sub_search that brings back the ac...

Search for triggered save searches and their actio...

I have been trying to use the CASE function in spl...

I want to create a subsearch that will abbreviate ...

Need assistance in setting a sourcetype--date/time

Re: Getting [/inputs/index_filter]: must NOT have ...

Getting [/inputs/index_filter]: must NOT have addi...

Re: How to search for values not in a listing

Re: How to search for values not in a listing

Re: How to search for values not in a listing

How to search for values not in a listing

Re: Drill down from pie chart in dashboard studio

Drill down from pie chart in dashboard studio

Re: Trying to create a search that will bring back...

Trying to create a search that will bring back ind...

Re: How to create a field on the fly using CASE

Re: How to create a field on the fly using CASE

Re: How to create a field on the fly using CASE

Re: How to create a field on the fly using CASE

Re: How to create a field on the fly using CASE

How to create a field on the fly using CASE

Re: Trying to add a sub_search that brings back th...

Trying to add a sub_search that brings back the ac...

Search for triggered save searches and their actio...

Re: I have been trying to use the CASE function in...

I have been trying to use the CASE function in spl...

I want to create a subsearch that will abbreviate ...

Re: Need assistance in setting a sourcetype--date/...

Re: Need assistance in setting a sourcetype--date/...

Need assistance in setting a sourcetype--date/time

Join the Conversation