About dmoberg

dmoberg · ‎09-29-2025

Awesome. It works now!

dmoberg · ‎09-29-2025

I have a drop-down in my Classic Dashboard that is populating from an inputlookup. Looks like this: <input type="dropdown" token="_ApiID" searchWhenChanged="false"> <label>API ID</label> <fieldForLabel>APIIDLBL</fieldForLabel> <fieldForValue>APIID</fieldForValue> <search> <query>| inputlookup XXXXXXXXXX | dedup APIID,APIIDLBL | stats count by APIID,APIIDLBL | sort APIID,APIIDLBL | fields APIIDLBL,APIID</query> <earliest>$timerange.earliest$</earliest> <latest>$timerange.latest$</latest> </search> <choice value="*">All API IDs</choice> <choice value="NotMeantToBeFound">Select API</choice> <change> <set token="OperationID">*</set> <set token="form.OperationID">*</set> <set token="ProductID">*</set> <set token="form.ProductID">*</set> <set token="sourceregionselector">*</set> <set token="form.sourceregionselector">*</set> </change> <initialValue>NotMeantToBeFound</initialValue> <default>NotMeantToBeFound</default> </input> For the above I get an error message below the drop-down stating: "Duplicate values causing conflict", however there are no Duplicates in the list. This made me think that Splunk is only looking at the first Y number of chars of the value to determine if there are any duplicates. To test this I extracted the first 20 chars of each value and removed duplicates, as per this: <query>| inputlookup XXXXXXXXXX | dedup APIID,APIIDLBL | stats count by APIID,APIIDLBL | sort APIID,APIIDLBL | fields APIIDLBL,APIID | eval APIIDLBL=substr(APIIDLBL,1,20) | dedup APIIDLBL</query> This did indeed resolve my issue and no longer see an error message, but this is obviously not a fix since I then can't see the full values. Any ideas on how to solve it? I would take this is a bug........

dmoberg · ‎09-26-2025

We have a need to setup Synthetic Browser Tests against many endpoints. The main purpose for the Browser tests is to capture the LightHouse Score which we use for Graphs and Alerts. Our problem is that we have not figured out a way to clear the cache (session, cookie, etc.) between the Steps for a Synthetic Monitor and without clearing the cache between steps the Lighthouse Score is not accurate as the previous Step will have cached some objects such as Javascript, etc. The work-around is to create a separate Monitor for each Step in the Shopping Flow, but this is a tedious task and also not ideal from a Maintenance perspective. We have previously tried to execute JavaScript to achieve this but never succeeded. So the question is, how can I clear the cookies/cache/session between Steps in a Synthetic Browser Test?

dmoberg · ‎09-03-2025

I had missed the stop/end part (first used TimeSeriesWindow which used endMS.....). Thanks! Anyways, I do get data back now, but the format is different from what normally comes back from a Rest API. Part of the returned data: event: control-message data: { data: "event" : "STREAM_START", data: "timestampMs" : 1756827385654, data: "traceId" : "592efa8f2c37d7c3" data: } event: control-message data: { data: "event" : "JOB_START", data: "handle" : "Gz10mHVAEA4", data: "timestampMs" : 1756827385735 data: } event: metadata data: { data: "properties" : { data: "cloud.region" : "westeurope", data: "computationId" : "Gz10mHVAEA4", data: "k8s.namespace.name" : "XXXXXXXXXX-acc", data: "sf_isPreQuantized" : true, data: "sf_key" : [ "sf_originatingMetric", "sf_metric", "computationId" ], data: "sf_metric" : "_SF_COMP_Gz10mHVAEA4_02-PUBLISH_METRIC", data: "sf_organizationID" : "hgfhgfhgfhgfhgf", data: "sf_originatingMetric" : "container_cpu_utilization", data: "sf_resolutionMs" : 60000, data: "sf_singletonFixedDimensions" : [ "k8s.namespace.name", "cloud.region", "sf_metric" ], data: "sf_streamLabel" : "A", data: "sf_type" : "MetricTimeSeries" data: }, data: "tsId" : "AAAAAIB-Sgg" data: } event: data id: data-1756811940000 data: { data: "data" : [ { data: "tsId" : "AAAAAIB-Sgg", data: "value" : 0.48333333333333334 data: } ], data: "logicalTimestampMs" : 1756811940000, data: "maxDelayMs" : 10000 data: } Where can I find the documentation for the Response message format? Is it possible to only return the "event: data" object? As this should be all that I need. Seems like web sockets are used for the communication, which allows for streaming of data/metrics, but is it possible to use non-websockets for the Request?

dmoberg · ‎09-02-2025

I actually do get the API request to execute, but the strange thing is that I get the same response back no matter what I specify as the metric (in below example container_cpu_utilization). But if I specify the metric as something random like "hello" I still get data returned, which seems very odd. It is almost as the commands are not used. Also, it does not seem that the data is limited to the start and end that is passed in as queries as I can see timestamps not matching this range coming back.

dmoberg · ‎09-02-2025

I would like to be able to use an API endpoint to get metrics from SignalFx, but the documentation is very confusing. I have found this API: https://dev.splunk.com/observability/reference/api/signalflow/latest#endpoint-execute-signalflow-computation But I am unable to get the Signalflow query (that works in APM Dashboard just fine) to work in the API, and also I see this in the above documentation: "Text string containing a SignalFlow program that has one or more detect().publish() output streams." , which seems to indicate that this endpoint only is to publish Detectors..... All I want to do is to be able to execute Signalflow queries, should be pretty straight forward.... What am I missing?

dmoberg · ‎08-14-2025

Unfortunately, just realized that this approach does not work for me. I have several Tabs, so if I add the Filters In-Canvas, then I can't have the same filters for all Tabs, or at least it will not be very obvious. Any other ideas?

dmoberg · ‎08-12-2025

I have noticed that chart legends are truncated to 9-10 items where the remaining items simply are not shown. Is it possible to enable/add a scrollbar to the legend list?

dmoberg · ‎08-12-2025

I will try that!

dmoberg · ‎08-12-2025

Maybe someone could tell me how I can add a picture (logo) in the top section of the dashboard, where the main filters reside? It seems that the top section is very restricted in terms of what can be added there.

dmoberg · ‎08-08-2025

Yes, this is really needed. It can be done in the Classic dashboards, but we also need this for Studio.

dmoberg · ‎08-07-2025

Thanks! Ok then I know. Do you happen to know where I could find a simple example of a custom app?

dmoberg · ‎08-07-2025

In Dashboard Studio for ITSI, we have enabled the Infrastructure AddOn and the ServiceMap, but I am wondering what other types of data sources that can be added? For example, I would like to be able to connect to the Kubernetes API to run kubectl commands, etc. This way we would be able to display the current settings for Kubernetes deploys such as Auto Scaling config, etc. This is how the data sources currently is configured. In this list we would like to be able to add more types of data sources. Any ideas on this?

dmoberg · ‎07-09-2025

I am trying to extract multiple metrics at once using a Signalflow query, but I am not sure if this is supported or just not undocumented. One metric works fine: | sim flow query=" data('k8s.hpa.current_replicas', filter............" Wildcard matching metrics works fine too: | sim flow query=" data('k8s.hpa*', filter............" But I have not been able to extract multiple named metrics (not wildcarded). Something like this (not working!!!): | sim flow query=" data('k8s.hpa.current_replicas k8s.hpa.max_replicas', filter............" Any ideas on how to get this to work?

dmoberg · ‎03-02-2025

Your response is a solution for Splunk Core/Search not for Signalflow in Splunk APM.

dmoberg · ‎03-02-2025

I am getting the data extracted and published to a dashboard, but the problem is that the "Count" is published on separate rows, not merged in with the other rows. I want the count (from which the percentage is calculated) to end up as an additional column together with the Percentage, Route and Method. This is the Signalflow I currently use: B = data('http_requests_total', filter=filter('k8s.namespace.name', 'customer-service-pages-prd')).count() A = data('http_requests_total', filter=filter('k8s.namespace.name', 'customer-service-pages-prd')).count(by=['route', 'method']) Percentage=(A/B * 100) Percentage.publish(label='Percentage') A.publish('Count') And this is how it looks: Any ideas on how to merge the data so that also Count is on the same rows as the Percentage?

dmoberg · ‎02-07-2025

I was able to solve it. By populating the dropdowns in the Dashboard from an Inputlookup (with data from a scheduled search), it started working to use the approach I detailed below (setting the FirstLoad Token). Not sure exactly why this made it work but at least it works.

dmoberg · ‎02-04-2025

@gcusello, thanks but we need this to be automatically happening. It has to be some way to fix this?

dmoberg · ‎02-03-2025

In my dashboard, when one of the dropdowns are changed I need to reset the value in the other dropdowns to the default value (*); this can easily be done using the <change> function so no issues there. The problem arises when the user clicks a link to the dashboard with pre-populated parameters for the dropdowns (user is taken to a specific state of the dropdowns). The loading of the dashboard with the incoming HTTP parameters for the dropdowns also trigger the <change> to happen and thus resetting all of the selected dropdowns. My questions is, how can I prevent the <change> to trigger on the Initial Load of the Dashboard? Once the Dashboard has been loaded I want the <change> to trigger when the user changes certain dropdowns. I tried the following approach. In the dropdown for which I want to prevent the <change> to trigger a condition was added to check that the Token $FirstLoad$ is set to "Done". <change> <condition match="tostring($FirstLoad$) == "Done""> <set token="form.PipelineName">*</set> <set token="form.LabelName">*</set> </condition> In the heaviest Search I set a Token when completed (Done): <done> <set token="FirstLoad">Done</set> </done> The thinking for the above was that since on Initial Load the $FirstLoad$ Token will not initially be set which should prevent the <change> to trigger, but as soon as the $FirstLoad$ Token is updated to "Done", the <change> is triggered. Very frustrating. Anyways, maybe I am missing something simple? Any ideas are appreciated.

dmoberg · ‎05-25-2023

that worked! Not sure how I missed this. Thx!

dmoberg · ‎05-25-2023

We have a log file that is split into multiple events. In these events we need to count the number of occurrences where Event XXX > 0 and Event YYY > 0 for each Source file. So finding 1 match of XXX and YYY in one particular Source file would be counted as 1 for this purpose. Splunk search: SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) | eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) | eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) | stats list(NAME),list(isDEP),list(isPERF),count by source In the Search part of the query I find the type of Events of interest, then determine the count of matches for XXX and YYY. This works fine, the problem is that I do not know how to tell Splunk to give me: If XXX > 0 AND YYY > 0 for a particular Source file (aggregate by Source), then count this as 1. This is an example output for the above query: The issue seems to be that Splunk works on an "per Event" basis so each result is tied with the Event and not the Source file. Any ideas on how to do this?

dmoberg · ‎02-01-2023

I am struggling to figure out how to get the Visualization that I want, if even possible.... Timechart works great for this purpose but only when having 1 By clause (aggregated on one value), so if I have understood it properly, I should use the Stats command which supports multiple aggregations. The end goal is to have one graph showing the following: Y-axle: Count of the events X-axle: Time Graph lines: One Graph line shows the Count for a unique combination of responseCode and Location OR possibly using Trellis (probably better) split By Location, so that each Location is a separate graph with one graph line showing the count for the responseCode. The Search as it is now: <<SEARCH>> | bin _time as time span=15m | stats count by _time,body.records.properties.responseCode,body.records.location If using Trellis split by Location, this results in two graphs, one per Location where each has one graph line for Count (no matter the response code) and one more graph line for the response code itself (i.e. response code 200 becomes a line on 200 of the Y-axle). But I want 1 single graph line showing the count per unique responseCode (the legend should display the responseCode (i.e. 200). Any ideas?

dmoberg · ‎09-27-2022

I have a need for approximate statistics/metrics and am currently using Event Sampling, which drastically speeds up the queries. For queries that calculate averages this works great, but I also have a need to do counts. If you set the Event Sampling to for example 1:100, then Splunk seems to look at every 100 Events, which is also reflected in how many Events that are matched when doing 1:100 vs 1:1. Example count with and without sampling: 1:100 = 26311 1:1 = 2623658 1:100 scaled up to 1:1 = 2631100 Diff = 7442, which is 0.3% The Time Period was a previous hour (not the latest hour) as not to have incoming Events affect the Count. 0.3% difference is perfectly ok for my purpose. Am I thinking of this correctly, or is there any risk of much bigger differences in Count (after upscaling the count)?

dmoberg · ‎09-27-2022

Problem solved. I had the Dashboard pane search settings for the Time Picker set to Global, instead of Shared Time Picker. BUT, I earlier checked the Source of the Dashboard and the Earliest was set to "-24h" and still the search took forever, but directly in Splunk search the same search for 24 hrs was really quick. Maybe when Global is selected as the Time Picker, the Earliest setting is ignored and instead All Time is selected (picked up from elsewhere)? Anyways, thanks allot now it works great!!

dmoberg · ‎09-27-2022

Thanks. I tried it but it seems when this setting is used in the Dashboard there is no performance improvement at all. Running the exact same query directly in SPL with the same Event Sampling is much quicker. Maybe this is a bug in the implementation?

Online Status	Offline
Date Last Visited	‎09-28-2025 11:28 PM

Dashboard Classic Dropdown text length limit

APM Synthetic - Clear cache between steps

Signalflow API?

Dashboard Studio - Scrollbar on legend?

Dashboard Studio - add Logo/icon in the top sectio...

Splunk Dashboard Studio - add new types of data so...

Signalflow - retrieve multiple metrics at once?

Splunk APM - Signalflow - merge data

Splunk Classic Dashboard - Prevent trigger of <cha...

How to match at least one field from separate even...

Re: Dashboard Classic Dropdown text length limit

Dashboard Classic Dropdown text length limit

APM Synthetic - Clear cache between steps

Re: Signalflow API?

Re: Signalflow API?

Signalflow API?

Re: Dashboard Studio - add Logo/icon in the top se...

Dashboard Studio - Scrollbar on legend?

Re: Dashboard Studio - add Logo/icon in the top se...

Dashboard Studio - add Logo/icon in the top sectio...

Re: Splunk: Is there a way to remove the Clone das...

Re: Splunk Dashboard Studio - add new types of dat...

Splunk Dashboard Studio - add new types of data so...

Signalflow - retrieve multiple metrics at once?

Re: Splunk APM - Signalflow - merge data

Splunk APM - Signalflow - merge data

Re: Splunk Classic Dashboard - Prevent trigger of ...

Re: Splunk Classic Dashboard - Prevent trigger of ...

Splunk Classic Dashboard - Prevent trigger of <cha...

Re: How to match at least one field from separate ...

How to match at least one field from separate even...

What is an alternative to timechart when needing a...

Event sampling and Count - accuracy?

Re: Specify Event Sampling in a query for use in a...

Re: Specify Event Sampling in a query for use in a...

Join the Conversation