About SN1

SN1 · ‎05-07-2025

NO for unsolved it will be red if the count is 0 then only the panel color will be green . And for solved all panels should be green nothing should be red.

SN1 · ‎05-07-2025

ok this is the source code <form version="1.1" script="solved3.js ,minor.js, warning.js , critical.js" theme="dark"> <label>SBC Monitoring</label> <fieldset submitButton="false"> <input type="checkbox" token="srStatus"> <label>Status</label> <choice value="1">solved</choice> <choice value="0">unsolved</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>solved=</valuePrefix> <delimiter> OR </delimiter> <default>0</default> <initialValue>1,0</initialValue> </input> </fieldset> <row> <panel> <title>MINOR EVENTS</title> <single> <search> <query>| inputlookup sbc_minor.csv | search $srStatus$ | stats count</query> <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="minor">minor</set> <unset token="major"></unset> <unset token="critical"></unset> <unset token="warning"></unset> </drilldown> </single> </panel> <panel> <title>MAJOR EVENTS</title> <single> <search> <query>| inputlookup sbc_major.csv | search $srStatus$ | stats count</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="major">major</set> <unset token="minor"></unset> <unset token="critical"></unset> <unset token="warning"></unset> </drilldown> </single> </panel> <panel> <title>CRITICAL EVENTS</title> <single> <search> <query>| inputlookup sbc_critical.csv | search $srStatus$ | stats count</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> <drilldown> <set token="critical">critical</set> <unset token="major"></unset> <unset token="minor"></unset> <unset token="warning"></unset> </drilldown> </single> </panel> <panel> <title>WARNING EVENTS</title> <single> <search> <query>| inputlookup sbc_warning.csv | search $srStatus$ | stats count</query> <earliest>0</earliest> <latest></latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="rangeColors">["0x118832","0xd41f1f"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> <drilldown> <set token="warning">warning</set> <unset token="major"></unset> <unset token="minor"></unset> <unset token="critical"></unset> </drilldown> </single> </panel> </row> <row> <panel> <title>MINOR ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?<Severity>\D+);" | rex field=_raw "\[Time:(?<Time>.*)]" | rex field=Time "(?<date>.*)@" | rex field=_raw "RAISE-ALARM:(?<Alarm_Type>\w+)" | rex max_match=0 field=_raw ": \[(?<Region>\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?<message>[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=minor | stats count as Total by date | appendpipe [ stats count | eval Message="No Minor Alerts" | where count==0 | table Message | fields - Alarm_Type Region message IP Severity Time date] | transpose 0 | eval allnulls=1 | foreach row* [ eval allnulls=if(isnull('<<FIELD>>'),allnulls,0) ] | where allnulls=0 | fields - allnulls | transpose 0 header_field=column | fields - column</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>MAJOR ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?<Severity>\D+);" | rex field=_raw "\[Time:(?<Time>.*)]" | rex field=Time "(?<date>.*)@" | rex field=_raw "RAISE-ALARM:(?<Alarm_Type>\w+)" | rex max_match=0 field=_raw ": \[(?<Region>\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?<message>[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=major | stats count as Total by date</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>CRITICAL ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?<Severity>\D+);" | rex field=_raw "\[Time:(?<Time>.*)]" | rex field=Time "(?<date>.*)@" | rex field=_raw "RAISE-ALARM:(?<Alarm_Type>\w+)" | rex max_match=0 field=_raw ": \[(?<Region>\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?<message>[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=critical | stats count as Total by date | appendpipe [ stats count | eval Message="No critical Alerts" | where count==0 | table Message | fields - Alarm_Type Region message IP Severity Time date] | transpose 0 | eval allnulls=1 | foreach row* [ eval allnulls=if(isnull('<<FIELD>>'),allnulls,0) ] | where allnulls=0 | fields - allnulls | transpose 0 header_field=column | fields - column</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>WARNING ALERTS HISTORY</title> <chart> <search> <query>index=sbc-logs RAISE-ALARM | dedup S | rex field=_raw ".*Severity:(?<Severity>\D+);" | rex field=_raw "\[Time:(?<Time>.*)]" | rex field=Time "(?<date>.*)@" | rex field=_raw "RAISE-ALARM:(?<Alarm_Type>\w+)" | rex max_match=0 field=_raw ": \[(?<Region>\w+)\]" | rex max_match=0 field=_raw "\[\w+\d\](?<message>[^;]+)" | table Alarm_Type Region message IP Severity Time date | search Severity=warning | stats count as Total by date | appendpipe [ stats count | eval Message="No Minor Alerts" | where count==0 | table Message | fields - Alarm_Type Region message IP Severity Time date] | transpose 0 | eval allnulls=1 | foreach row* [ eval allnulls=if(isnull('<<FIELD>>'),allnulls,0) ] | where allnulls=0 | fields - allnulls | transpose 0 header_field=column | fields - column</query> <earliest>0</earliest> <latest></latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel depends="$minor$"> <title>Minor Events</title> <table id="sbc_minor_table"> <search> <query>| inputlookup sbc_minor.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$major$"> <title>Major Events</title> <table id="sbc_alarm_table"> <search> <query>| inputlookup sbc_major.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$critical$"> <title>Critical Events</title> <table id="sbc_critical_table"> <search> <query>| inputlookup sbc_critical.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$warning$"> <title>Warning Events</title> <table id="sbc_warning_table"> <search> <query>| inputlookup sbc_warning.csv | search $srStatus$ | eval Server_Name=case(IP == "10.2.96.35","US-SOU",IP == "10.82.10.245","KR-SEL",IP == "10.86.164.25","CN-SGH",IP == "10.86.68.25","CN-SHH",IP == "10.86.128.25","CN-SHA" ,IP == "10.20.41.90 ","DE-SLO",IP == "10.150.222.120","DE-BIE")</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

SN1 · ‎05-06-2025

so i have a dashboard with 4 panels and there is checkbox with 2 options of solved and unsolved , so for unsolved the colour of the panels should remain red when the count is greater than 0. which i am able to do with splunk dashboard feature itself. But for solved option every panels should be green . so how should i approach this.

SN1 · ‎04-24-2025

ok so i have a drilldown so in this table there is a field solved which have default value 0 which means this particular severity is not solved . Now i want a button instead of 0 .like this now whenever a severity is being solved then when we click on this button it should change like this and this specific result its value (solve field ) should be changed to 1. this is JS i am using but it is not working. plus ye script thi jo mai use kar raha hun require([ 'splunkjs/mvc/tableview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'underscore', 'splunkjs/mvc/simplexml/ready!' ], function( TableView, SearchManager, mvc, _ ) { var CustomLinkRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'solved'; }, render: function($td, cell) { var solved = cell.value; var rowKey = cell.data.row.rowKey; var icon = $('<a>') .attr("href", "#") .attr("title", "Mark as Solved") .css({ "cursor": "pointer", "text-align": "center", "display": "inline-block", "width": "100%" }); icon.html('<i class="icon ' + (solved === "1" ? 'icon-check-circle' : 'icon-minus-circle') + '"></i>'); icon.on("click", function(e) { e.preventDefault(); var $icon = $(this).find('i'); // Only run update if not already solved if (solved === "1") { return; // Already marked as solved } $icon.removeClass("icon-minus-circle").addClass("icon-gear"); var updateSearch = ` | inputlookup sbc_major.csv | eval rowKey=tostring(rowKey) | eval match=if(rowKey="${rowKey}", "1", "0") | eval solved=if(match="1", "1", solved) | fields - match | outputlookup sbc_major.csv `; var updateManager = new SearchManager({ id: "update-solved-" + _.uniqueId(), preview: false, cache: false, search: updateSearch }); updateManager.on("search:done", function() { $icon.removeClass("icon-gear").addClass("icon-check-circle"); }); }); $td.empty().append(icon); } }); var tableElement = mvc.Components.getInstance("sbc_alarm_table"); tableElement.getVisualization(function(tableView) { tableView.table.addCellRenderer(new CustomLinkRenderer()); tableView.table.render(); }); });

SN1 · ‎04-24-2025

i want to implement it using JS is it possible?

SN1 · ‎04-23-2025

So i have a dashboard and in drilldown i am showing severity in the servers now i want whenever the severity is solved that severity is removed from the drilldown and store somewhere else for confirmation. from this table if i solve any severity i should be able to remove it from here and store it somewhere else. and if by mistake i have removed it , i can rollback .

SN1 · ‎04-08-2025

this is the search | rest /services/server/status/partitions-space splunk_server=* | eval free = if(isnotnull(available), available, free) | eval usage_TB = round((capacity - free) /1024/1024, 2) | eval free=round(free/1024/1024,2) | eval capacity_TB = round(capacity /1024/1024, 2) | eval pct_usage = round(usage / capacity * 100, 2) | table splunk_server, usage_TB , capacity_TB , free it gives memory usage of splunk servers , can this be implemented using _introspection index as well?

SN1 · ‎03-27-2025

result is coming but the ones with similar names are not coming . where in dns field similar fields are not coming.

SN1 · ‎03-27-2025

After running the search the "Company Code " field is empty

SN1 · ‎03-27-2025

Oh yes , sorry I gave wrong search . This is the seach | inputlookup lkp-all-findings | lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding | lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System" | lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code" | eval is_solved=if(lastchecked>lastfound OR lastchecked == 1,1,0),blacklisted=if(isnull(blfinding),0,1),timeval=strftime(lastchecked,"%Y-%m-%d") | fillnull value="NA" "Company Code", Scan-Location | search is_solved=0 blacklisted=0 Scan-Location="*" "Company Code"="*" severity="high" | fields "Company Code" timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted | sort severity

SN1 · ‎03-27-2025

hello i have this search | inputlookup lkp-all-findings | lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding | lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System" | lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code" | dedup finding, dns_name, ip | stats values("Company Code") as "Company Code" by finding, dns_name, ip, Asset_Gruppe, Scan-Company, Scanner, Scan-Location, Location, Betriebssystem now this is the result. now i have tried mvexpand , stats as well but it gives multiples values. The problem is let say for NessusHost "slo-svenessus01.emea.durr.int" there are let say 20 nessus host with this name now it is duplicating 20 "company code " (HHDE) in every single field for each Nessushost with this name and same for others as well.

SN1 · ‎03-24-2025

i am getting this error on health check Root Cause(s): Events from tracker.log have not been seen for the last 238401 seconds, which is more than the red threshold (210 seconds). This typically occurs when indexing or forwarding are falling behind or are blocked.

SN1 · ‎03-24-2025

Hello I am running search index=_introspection dedup host table host in result i am not able to see one indexer and one search head while other indexers and sh are visible .

SN1 · ‎03-18-2025

SN1 · ‎03-12-2025

is there a possibility to this using index?

SN1 · ‎03-12-2025

when i am running this search it is giving 16GB as total_GB while our total size is 16Tb.

SN1 · ‎03-11-2025

Hello i run df -h on indexer and i got now i want the total , available and used space but using SPL how can i achieve that. like in this case total will be 16Tb , used will be 12T and Available will be 5T if we sum all the spaces . How can i get this result using SPL.

SN1 · ‎03-10-2025

I want to get total memory allocated on 1 indexer and how much memory it is using. so that i could get remaining disk space left.

SN1 · ‎03-03-2025

so after running this query i am not able to see 1 indexer . How can i resolve it.

SN1 · ‎03-02-2025

One of my 5 indexer is getting this error [MSE-SVSPLUNKI01] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0]) I have some question . 1 . how do i check whether my indexer is connected with license master or not. 2. if NOT then how can i connect them again. 3. And if the connection is good from start then what do I do next?

SN1 · ‎02-28-2025

Hello i am seeing this error MSE-SVSPLUNKI01] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0]) how to resolve this.

SN1 · ‎02-25-2025

Hello recently I moved ES app from one sh to another non clustered sh . after that this error is coming Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

SN1 · ‎02-25-2025

Could you please tell me how to restore admin?

SN1 · ‎02-24-2025

Recently I migrated ES from one SH to another non cluther SH . this error was popping in the panel of ES app Error in 'DispatchManager': The user 'admin' does not have sufficient search privileges. So to resolve this i searched about this error and there was a solution to remove owner=admin from default.meta file . It worked for some panels but some panels still show this error.

SN1 · ‎02-24-2025

every command is giving results thats not the problem , problem the macro which is used in this search when i am searching this macro it is giving me no result.

Posts	72
Solutions	0
Karma Given	9
Karma Received	0
Member Since	‎12-12-2024

Online Status	Offline
Date Last Visited	Tuesday

script to rotate log files ?

Need help with a Splunkd log message

Alert

splunk search

script

latest result

splunk alert

saved search

alerts

script

Re: dashboard

Re: dashboard

dashboard

Re: splunk dashboard

Re: splunk dashboard

splunk dashboard

Memory Usage

Re: Multiple results

Re: Multiple results

Re: Multiple results

Multiple results

Re: Introspection

Introspection

Mvexpand

Re: Total Memory

Re: Indexer

Total Memory

Indexer

Re: ERROR

ERROR

Error

migration

Re: migration

migration

Re: Macro

Join the Conversation