Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About eyaluodba
eyaluodba
Path Finder
Member since:
05-15-2017
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 05-15-2017 |
Activity Feed
- Karma Re: How to show all sources for each index? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Is there a fast way to search all indexes to list just the index names and the date/time of the last event or update? for richgalloway. 06-05-2020 12:48 AM
- Karma Re: How to create a dashboard that lists recently updated dashboards? for adonio. 06-05-2020 12:48 AM
- Karma Re: How to create a dashboard that lists recently updated dashboards? for adonio. 06-05-2020 12:48 AM
- Karma Re: How to create a dashboard that lists recently updated dashboards? for adonio. 06-05-2020 12:48 AM
- Karma Re: How can I view and search multiple indexes from dashboards for cmerriman. 06-05-2020 12:48 AM
- Karma Re: How do I make a couple of indices in one table? for MuS. 06-05-2020 12:48 AM
- Karma Re: How can I view when the last data imports were? for adonio. 06-05-2020 12:48 AM
- Karma Ever wonder which dashboards are being used and what users are using them? for MattZerfas. 06-05-2020 12:47 AM
- Karma Re: Is it possibl to get a list of available indices ? for MuS. 06-05-2020 12:46 AM
- Posted Re: How can I view when the last data imports were? on Splunk Search. 06-06-2017 12:32 PM
- Posted Re: How can I view when the last data imports were? on Splunk Search. 06-06-2017 07:04 AM
- Posted How can I view when the last data imports were? on Splunk Search. 06-05-2017 01:41 PM
- Tagged How can I view when the last data imports were? on Splunk Search. 06-05-2017 01:41 PM
- Tagged How can I view when the last data imports were? on Splunk Search. 06-05-2017 01:41 PM
- Tagged How can I view when the last data imports were? on Splunk Search. 06-05-2017 01:41 PM
- Tagged How can I view when the last data imports were? on Splunk Search. 06-05-2017 01:41 PM
- Tagged How can I view when the last data imports were? on Splunk Search. 06-05-2017 01:41 PM
- Posted Is there a way to have a Dashboard in Splunk that contains a que of latest update of all indexes inside of Splunk? on Dashboards & Visualizations. 06-01-2017 07:13 AM
- Tagged Is there a way to have a Dashboard in Splunk that contains a que of latest update of all indexes inside of Splunk? on Dashboards & Visualizations. 06-01-2017 07:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-06-2017
12:32 PM
Yea that's exactly what I mean. The last event that's been calculated in the panels.
... View more
06-06-2017
07:04 AM
As of right now my query shows the most recent dashboard being updated, the time of the updates, the app name and the user updating it.
<query>index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user</query>
What I want is to also show the last data imports too. The other dashboards use the same query, yes.
... View more
06-05-2017
01:41 PM
I have a dashboard that lists/groups recently updated dashboards and I just wanted to know if there was a way to also add another column to view and search the last data imports of those dashboards.
For an example one of the dashboards last Data import was 05/08/2017 ( see photo below)
So since my dashboard lists the other dashboards my team has made, is there a way to show when those dashboards had the last import?
My requested format would be:
Dashboard, Timestamp,& Last Data Import Date.
Hopefully this all makes sense. Please let me know if it doesn't. Thank you.
... View more
06-01-2017
07:13 AM
I want to find a way to have a Dashboard in Splunk that contains a que of latest update of all indexes inside of Splunk.
The main objective is to identify Dashboards containing old information in order to remove all of them. Please let me know if this is possible and if so, how to do it too.
... View more
05-23-2017
12:45 PM
Is it possible to have two different indices and have results in a single table? The Indices are...
index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user
and
index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | rex field=search "index=(?P<search_index>[^ ]+)" | stats count by search_index | sort - count| table search_index user
Please let me know! Thank you so much.
... View more
05-23-2017
11:53 AM
Yes this is what I mean. Sorry about the confusion
... View more
05-23-2017
10:57 AM
I have a dashboard that lists/groups recently updated dashboards and I just wanted to know if there was a way to also add another column to view and search the indexes of those same dashboards.
Here is my code below
<table>
<search>
<query>index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user </query>
<earliest>-30d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
By the way- I am referring to the indices that the searches inside the dashboard belong to.
... View more
05-23-2017
08:31 AM
Alright thanks for all your help!
... View more
05-23-2017
08:13 AM
It wants me to put it up first, but when I do it doesn't work.
index=_internal source=web_access.log /app/ action=edit
| rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user,
... View more
05-23-2017
08:08 AM
So if I wanted to use | REST /services/data/indexes | table title
in my code, how would I go about doing that? Everytime I try to add it I get "Error in 'rest' command: This command must be the first command of a search."
... View more
05-23-2017
06:40 AM
Thank you so much!
... View more
05-22-2017
02:17 PM
Yes, like is there a way I can also add a new column to show the indexes that those databases are using?
... View more
05-22-2017
12:56 PM
Anyway I can also see the indexes?
... View more
05-22-2017
12:19 PM
Thank you so much. It worked!
... View more
05-22-2017
11:59 AM
I get a "Error on line 2: Unexpected close tag
<search id="base">
<query> index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name </query>
<earliest>0</earliest>
<latest></latest>
</search>
... View more
05-22-2017
08:37 AM
my team has a lot of dashboards and I want to create a simple code for another one that groups and lists some of the dashboards that have been recently updated.
And if so when I search up these updated databases I would like to know the indexes and dataset that these dashboards have.
Requested Table format Dashboard Name, Index, Timestamp (Shows when the dashboard was last updated)
Here is the code I have so far. Now sure how to do the rest.
<title>Dashboard Search</title>
<search id="base">
<query>index=_internal | table DashboardName Index Timestamp </query>
<earliest>0</earliest>
<latest></latest>
</search>
... View more
05-15-2017
01:35 PM
So I was just wondering if it was possible to create a dashboard that searches for all other recently modified or updated searches of dashboards?
And if so when I search up these updated databases I would like to know the indexes and dataset that these dashboards have.
Hopefully that makes sense..Please let me know if it's possible, or similar ways I can find this! Thanks
... View more
