Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rajeshjlnt
rajeshjlnt
Path Finder
Member since:
11-29-2019
12-30-2021
Community Statistics
| Posts | 25 |
| Solutions | 2 |
| Karma Given | 8 |
| Karma Received | 1 |
| Member Since | 11-29-2019 |
Activity Feed
- Karma Re: How do you reset a dashboard field after hitting the submit button? for niketn. 11-18-2020 12:14 AM
- Posted Re: Splunk SAML authentication issue when combining SAML and scripted inputs together for Splunk Cloudgateway implementa on Splunk Search. 11-11-2020 01:33 AM
- Posted Re: Index events with timestamp of previous day on Getting Data In. 11-03-2020 04:21 AM
- Posted Re: Index events with timestamp of previous day on Getting Data In. 11-03-2020 04:13 AM
- Karma Re: Index events with timestamp of previous day for isoutamo. 11-03-2020 04:12 AM
- Posted Re: Index events with timestamp of previous day on Getting Data In. 11-02-2020 11:35 PM
- Posted Index events with timestamp of previous day on Getting Data In. 11-02-2020 10:23 PM
- Posted Re: Hide Splunk Navigation bar of an app on All Apps and Add-ons. 10-19-2020 03:25 AM
- Posted Re: Hide Splunk Navigation bar of an app on All Apps and Add-ons. 10-07-2020 12:25 AM
- Karma Re: Hide Splunk Navigation bar of an app for richgalloway. 10-07-2020 12:24 AM
- Posted Hide Splunk Navigation bar of an app on All Apps and Add-ons. 10-06-2020 05:30 AM
- Posted Re: horizontal scroll bar in column chart on All Apps and Add-ons. 08-26-2020 01:59 AM
- Got Karma for Re: horizontal scroll bar in column chart. 08-25-2020 04:26 AM
- Posted Re: horizontal scroll bar in column chart on All Apps and Add-ons. 08-25-2020 02:37 AM
- Karma Re: horizontal scroll bar in column chart for niketn. 08-25-2020 02:36 AM
- Karma Re: Get all events/fields from latest data of an Index for gcusello. 06-05-2020 12:51 AM
- Karma Re: How to calculate the number of hours per month subtracting weekends? for nickhills. 06-05-2020 12:50 AM
- Karma Re: How to hide or grey out Clone option under Edit on Splunk dashboard? for nabeel652. 06-05-2020 12:47 AM
- Karma Re: How to display the count in piechart as labels for peter_krammer. 06-05-2020 12:46 AM
- Posted Re: Change the time format in time chart tool tip on Splunk Search. 04-30-2020 02:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-11-2020
01:33 AM
@pv063910 , We are also trying to implement SAML auth for Spunk Cloud Gateway. I am curious to know the flow of how users are logged into the Splunk instance in Mobile Client. Could you tell me what happens when user opens the App on mobile? OR How are users register on mobile app with Scripted SAML authentication?
... View more
11-03-2020
04:21 AM
I added following in props.conf and transforms.conf to get the desired results, transforms.conf [timestamp-currenttime-oneday] INGEST_EVAL = _time=time() - 86400 props.conf [mysourcetype] TRANSFORMS-gettime = timestamp-currenttime-oneday
... View more
11-03-2020
04:13 AM
thanks @isoutamo for showing right direction
... View more
11-02-2020
11:35 PM
Thanks for your response @isoutamo , but my question is to manipulate timestamp during indexing events. During event indexing there are settings in sourcetype like Auto, Current, Advanced and Configuration file. I would like to know if there is a way to set timestamp to be (current time - 1 day)
... View more
11-02-2020
10:23 PM
We have a report from a system that needs to be indexed into splunk on monthly basis. This report is generated on 1st day of every month. Our requirement is to index events in this report on last day of previous month. So i want to index data from this report with timestamp of previous day. Is this possible?
... View more
Labels
- Labels:
-
time
10-19-2020
03:25 AM
After a lot of search and research, I was not able to find any setting to hide navigation at app level. However, this can be achieved with combination of 2 steps, 1. Modifying an apps navigation in default.xml 2. Limiting dashboard access to a particular role Following are the details of steps I followed, Create a barebone app Create a copy of role 'user' Assign new app as default to this app Change navigation, Settings -> User interface -> Navigation menus -> New app's default.xml to; <nav search_view="search"> <collection label="All dashboards"> <view source="all" /> </collection> </nav> This will show only 'Dashboard' tab More info on this here: https://dev.splunk.com/enterprise/docs/developapps/createapps/addnavsplunkapp/ Copy/Move dashboards to this new app In Dashboard permission setting, check only new role and uncheck all other roles. Add hideSplunkBar="true" inside form or dashboard element to hide splunk bar More details: https://docs.splunk.com/Documentation/Splunk/8.0.6/Viz/PanelreferenceforSimplifiedXML
... View more
10-07-2020
12:25 AM
@richgalloway , this is another way. I have tried this as well. Like you said, this is easily defeated by users.
... View more
10-06-2020
05:30 AM
How can I hide Splunk Navigation bar of an entire app? I know about hideSplunkBar="true", this is at dashboard level. I want hide splunk bar of an entire app that i am creating. I have also tried having a css file under '#splunkhome\etc\apps\<appname>\appserver\static\' with following, div[data-view="views/shared/splunkbar/Master"]{ display: none !important; } .class="view---pages-enterprise---8-0-4---2Izs_"{ display: none !important; }. This did not hide the splunk bar Please provide guidance if anybody has achieved this.
... View more
Labels
- Labels:
-
administration
-
configuration
-
development
08-26-2020
01:59 AM
@niketn , i realized that the width:200% that we set is fixed and does not change when number of bars in chart is less. Which means lesser the # of bars, bigger is the width of each bar in chart. Would it be possible to remove scroll if # of bars are less?
... View more
08-25-2020
02:37 AM
1 Karma
@niketn , this worked well for me. Thank you!
... View more
04-30-2020
02:33 AM
I am currently using "timechart span=1mon". This shows 1st day of month in Tool tip.
I am getting following for your search,
MyTime: 2020-03-31 23:30:00.000
MyIndexTime = 2020-04-01 12:45:10.000
To give more info on how i upload data,
- I get a monthly report (xls) on first day of next month. March report is generated on 1st of April.
- Using "TIMESTAMP_FIELDS" in sourcetype, i have configured a column name 'timestamp' from which splunk needs to fetch timestamp during indexing. This is what we see in 'MyTime'
- In the xls i want to index, i add a column 'timestamp' and fill in last day of month and upload this file to splunk. 'MyIndexTime' is showing date on which i have uploaded the data.
... View more
04-28-2020
04:25 AM
We have time-chart visualization on a dashboard. The events are uploaded manually on last day of every month with timestamp of last day of month.
Tool tip, when hovered over the line chart visualization shows date as first day of the month with format MMM D, YYYY
I would like to format the date to show either date that the source has been indexed with or show only Month and Year.
Please provide me your suggestions on how this can be achieved.
... View more
03-11-2020
07:34 AM
This works for me. Great thanks @gcusello
I made a small modification to your suggestion by adding 'search', without which i got an error
index=your_index [ search index=your_index | head 1 | fields source ]
... View more
03-11-2020
06:39 AM
@gcusello , in my case _time and _indextime. I understand how timestamps work in splunk. Let me explain my requirement in more detail.
I upload a CSV file with n entries every day with a fixed timestamp. now i want to search and get events from latest uploaded file.
... View more
03-11-2020
06:31 AM
@manjunathmeti , this is similar to time range picker. May be i am missing something, how can this help in getting the latest indexed set of events?
... View more
03-11-2020
04:44 AM
We have an index 'abc' to which data gets fed in non-uniform intervals. I would like to get all events of this index that were indexed recently. Could i get some guidance on how to achieve this?
Ex: Data indexed on 1st of March, 5th of March and 10th of March. I want to get all events indexed on 10th of March.
... View more
- Tags:
- splunk-enterprise
02-18-2020
01:26 AM
@architkhanna have you been able to find any solution for this?
... View more
02-07-2020
02:13 AM
I agree, i got it working by converting on field to negative number. Thank you for the help @to4kawa
... View more
02-07-2020
01:38 AM
This is how i want the chart to look but bars below x axis show come with positive numbers :).
My data is created tickets vs closed tickets, so both of them will positive numbers.
... View more
02-07-2020
01:22 AM
I would like to create a bi-directional bar chart. I have 2 fields monthly closed and monthly created tickets, I want to plot a bar chart with 1 field above X axis and another below x axis. I tired all options available in Chart overlay in UI. Also searched for xml code, but with no success.
Can anybody provide some pointers?
... View more
- Tags:
- splunk-enterprise
01-29-2020
12:47 AM
@jcioffari did you find a solution for this?
... View more
12-06-2019
12:34 AM
@ashajambagi I took a dump and created a lookup table to solve my problem. I expect new entries to this table. I do not know how to update a lookup table with new entries. So i am took the route of creating an index. Is there a way to append data to a lookup table automatically?
... View more
12-05-2019
04:36 AM
@ashajambagi yes, i have tried and it works. But in my case static data is not really static, new entries will be added atleast montly.
... View more
12-04-2019
11:04 PM
Thank you for your response @to4kawa . I am not able to attach sample data ( no karma points) so typing it here,
Tickets(CreatedDaily):
Number Created On catetory_path
INC0000001 12/1/2019 0:00 application1
INC0000002 12/1/2019 0:00 application2
INC0000003 12/1/2019 0:00 application3
INC0000004 12/1/2019 0:00 application4
INC0000005 12/1/2019 0:00 application5
INC0000006 12/1/2019 0:00 application6
INC0000007 12/1/2019 0:00 application7
INC0000008 12/1/2019 0:00 application8
INC0000009 12/2/2019 0:00 application1
INC0000010 12/2/2019 0:00 application2
INC0000011 12/2/2019 0:00 application3
INC0000012 12/2/2019 0:00 application4
INC0000013 12/2/2019 0:00 application5
INC0000014 12/2/2019 0:00 application6
INC0000015 12/3/2019 0:00 application7
INC0000016 12/3/2019 0:00 application8
INC0000017 12/3/2019 0:00 application1
INC0000018 12/3/2019 0:00 application2
INC0000019 12/3/2019 0:00 application3
INC0000020 12/3/2019 0:00 application4
INC0000021 12/3/2019 0:00 application5
INC0000022 12/3/2019 0:00 application6
INC0000023 12/4/2019 0:00 application7
INC0000024 12/4/2019 0:00 application8
INC0000025 12/4/2019 0:00 application1
INC0000026 12/4/2019 0:00 application2
INC0000027 12/4/2019 0:00 application3
INC0000028 12/4/2019 0:00 application4
INC0000029 12/4/2019 0:00 application5
INC0000030 12/4/2019 0:00 application6
INC0000031 12/4/2019 0:00 application7
MasterData(Static)
catetory_path Appication ID Application Name
application1 BS_0001 Splunk
application2 BS_0002 Google
application3 BS_0003 Facebook
application4 BS_0004 Outlook
application5 BS_0005 Skype
application6 BS_0006 Word
application7 BS_0007 Excel
application8 BS_0008 Powerpoint
ResultExpected
Number Created On catetory_path Appication ID Application Name
INC0000001 12/1/2019 0:00 application1 BS_0001 Splunk
INC0000002 12/1/2019 0:00 application2 BS_0002 Google
INC0000003 12/1/2019 0:00 application3 BS_0003 Facebook
INC0000004 12/1/2019 0:00 application4 BS_0004 Outlook
INC0000005 12/1/2019 0:00 application5 BS_0005 Skype
INC0000006 12/1/2019 0:00 application6 BS_0006 Word
INC0000007 12/1/2019 0:00 application7 BS_0007 Excel
INC0000008 12/1/2019 0:00 application8 BS_0008 Powerpoint
INC0000009 12/2/2019 0:00 application1 BS_0001 Splunk
INC0000010 12/2/2019 0:00 application2 BS_0002 Google
INC0000011 12/2/2019 0:00 application3 BS_0003 Facebook
INC0000012 12/2/2019 0:00 application4 BS_0004 Outlook
INC0000013 12/2/2019 0:00 application5 BS_0005 Skype
INC0000014 12/2/2019 0:00 application6 BS_0006 Word
INC0000015 12/3/2019 0:00 application7 BS_0007 Excel
INC0000016 12/3/2019 0:00 application8 BS_0008 Powerpoint
INC0000017 12/3/2019 0:00 application1 BS_0001 Splunk
INC0000018 12/3/2019 0:00 application2 BS_0002 Google
INC0000019 12/3/2019 0:00 application3 BS_0003 Facebook
INC0000020 12/3/2019 0:00 application4 BS_0004 Outlook
INC0000021 12/3/2019 0:00 application5 BS_0005 Skype
INC0000022 12/3/2019 0:00 application6 BS_0006 Word
INC0000023 12/4/2019 0:00 application7 BS_0007 Excel
INC0000024 12/4/2019 0:00 application8 BS_0008 Powerpoint
INC0000025 12/4/2019 0:00 application1 BS_0001 Splunk
INC0000026 12/4/2019 0:00 application2 BS_0002 Google
INC0000027 12/4/2019 0:00 application3 BS_0003 Facebook
INC0000028 12/4/2019 0:00 application4 BS_0004 Outlook
INC0000029 12/4/2019 0:00 application5 BS_0005 Skype
INC0000030 12/4/2019 0:00 application6 BS_0006 Word
INC0000031 12/4/2019 0:00 application7 BS_0007 Excel
... View more
11-29-2019
03:26 AM
I am building a table query to list down tickets against applications. Where tickets are stored in sourcetype 'a' and application names are stored in sourcetype 'b' with a common ID field
When time filter is all time, query works just fine. When time filter is changed to today or this week, i am not getting results. I think this is because there will be no events/new entries in sourcetype 'b' as it is a master table.
I would like to know if using 'join' for this scenario is correct or should i use some other method.
Note: Sourcetype 'a' will have daily events, sourcetype 'b' is static
... View more
- Tags:
- splunk-enterprise
