About nisha_kapoor

nisha_kapoor · ‎08-15-2017

So for my search I need the following: search brand1=b1 AND brand2=b2 AND brand3=b3 The field names are dynamically filled in from a dropdown. Can you suggest how to go about this?

nisha_kapoor · ‎08-10-2017

index=test TransactionId="xxx-xxx-xxx"| replace "000" with "" in Status| fields Status I want to replace the first occurrence of "000" in status to blank.This is the command I wrote after referring to Splunk Documentation. However, the results don't show me the modified value of Status. Is there something missing in the command? My end result should be the value of Status with "000" replaced. Thanks for your help

nisha_kapoor · ‎08-01-2017

@niketnilay Thank you so much for taking the time out to write these detailed and awesome answers! I executed Option 1, it works perfectly. I am still to try Option 2, but this is my feedback on the rest: Simple XML dashboard with HTML Tooltop: The problem is arising when I placed more than one input element within the panel, in this case the ToolTip doesn't get displayed with the correct input element. I put all the elements in different panels and placed these panels in the same row for now. Option 1: This works perfectly. I have to clear my browsing history and/or restart Splunk everytime I make a change to it. Just out of curiosity if I had to do the same on Splunk cloud, where I don't have access to Splunk folder, how would I go about it?

nisha_kapoor · ‎07-31-2017

I am pretty new to Splunk, so this might seem a little basic, but can someone please share a demo javascript file? This is my simple test javascript code which is doesn't work. function msg(){ alert("Hello Javatpoint"); } Are there any require statements, etc which I am missing? I have pasted this file myScript.js in C:\Program Files\Splunk\etc\apps\search\appserver\static. This is how I reference it in Splunk: <dashboard script="myScript.js"> <label>Hello</label> <row> <panel> <html> <input type="button" value="click" onclick="msg()"/> </html> </panel> </row> </dashboard> Also I restarted Splunk. But still the message is not displayed. Is there something I am missing?

nisha_kapoor · ‎07-31-2017

Is there some way I can position the tool tip when I have multiple input elements in the dashboard? Instead of using style="top: -100px; left: 70px; display: block; can I link it to a particular input text box?

nisha_kapoor · ‎07-27-2017

@niketnilay Thank you for your reply. My purpose is to have a required field validation on this dropdown. If the user doesn't select anything from the dropdown and clicks on the submit button, he should get an alert. I couldn't find any functionality to do this on Simple XML (my javascript code doesn't run in Simple XML), hence I created a HTML dashboard. I am trying to do exactly what you demonstrated with the tool tip example, but is there a way the tool tip can be replaced with a pop up alert box?

nisha_kapoor · ‎07-27-2017

I have a dashboard with a dropdown. I want to validate that the user has selected a value for this dropdown. If not, I want an alert to display. Where exactly do I paste the javascript code for this? I tired converting my dashboard to HTML and used this Javascript code. (I haven't included the entire dashboard code in the interest of readability, please let me know if you want me to paste the entire code) <!DOCTYPE html> <html lang="en"> <head> <script> function validateForm() { var x = document.getElementById("input1").value; alert("Your field is "+x); } </script> </head> <body>  <div class="fieldset"> <div class="input input-dropdown" id="input1"> <label>College</label> <button type="button" onclick="validateForm()">Try it</button> </div> </div> </body> </html> But no matter what value I select in the drop-down, the alert displays "Your field is undefined". To make things clear, I have you two name-value options in my drop-down, USC and UCSD. The initial and default values are set to blank. Thanks in advance.

nisha_kapoor · ‎07-17-2017

Has anyone else faced this issue? How to reconnect to splunk? I installed the app and restarted splunk upon which I was disconnected from the splunk server and now I cannot log in again.

nisha_kapoor · ‎07-10-2017

Try using `< as < as >`

nisha_kapoor · ‎07-08-2017

Thank you for your reply, what I want is a list of fields having at least one non-null value. In other words, I want to eliminate the fields having null values for all records.

nisha_kapoor · ‎07-08-2017

Hi I am on Splunk Enterprise and my Autorun dashboard is on. The search refreshes when a new option is selected from the dropdown, the only problem is that querystring retains the previous dropdown value. So suppose I open my search and the default value of the dropdown is "a". I select value as "b" and click submit(autorun and search on change are also on), the querystring still searches with "a" instead of "b" until I refresh the browser or change my selection again.

nisha_kapoor · ‎07-08-2017

I am trying to display only those fields which contain a non null value. What is wrong with this command to achieve my purpose? index="test" | fields -isnull(*) It simply displays my data as a raw csv record, whereas what I want it to get all those fieldnames which are not "".

nisha_kapoor · ‎07-07-2017

How exactly do you combine the dropdown and the text box so that the user can use whichever one he prefers? I have a simple dropdown, how do I add textbox functionality to a dropdown?

nisha_kapoor · ‎07-07-2017

I tried this command and it still displays the fields which have a null value. stats values (fieldname) by itself works, but when I give the command as stats values (*), the result is all the fields with all distinct values, fields with null values also get displayed which kind of beats my purpose, which is to select and display those fields which have at least one non null value. Can someone help me figure out where I might be going wrong?

nisha_kapoor · ‎07-07-2017

Yeah my searchWhenChanged option is set to true, however the queryString doesn't get updated. It uses the previously stored value when it is passed to the search panel.

nisha_kapoor · ‎07-07-2017

This seems to achieve what I was looking for, but there is one glitch. When I select a new option, the results don't load until I manually refresh my browser. Is there some way around this, since I don't want my users to have to refresh the browser each time they select a different option.

nisha_kapoor · ‎07-07-2017

This seems to work perfectly, thank you!

nisha_kapoor · ‎07-07-2017

This doesn't seem to be working. I want that if I put a value instead of *, the results should be filtered based on that criteria. However, the above command simply seems to be getting me all the results stored in "test_data" and returning the top one. This is another way I tried, index="test_data" extracted_Source="$field4$" Target="$field5$" Status="$field7$" Name="$field8$" ($field1$ != "All" AND $field1$="$field2$") OR ($field1$==All AND TransactionID ="*") | table TransactionID Name extracted_Source Target Status Details CreatedAt The first part of this works fine as in the filter criteria (field1=field2) gets appended to the initial search when $field1$!= All. However, the second condition($field1$==All) is never satisfied. Can someone help me on how to compare the value of a field to a string and return true?

nisha_kapoor · ‎07-06-2017

Oh okay, I did that too and the error has disappeared, but now instead of the data, the search string is repeated over and over again in the result table. This is the query with the modifications: index="test_data"| eval search= if(var1!= "All" , "search index=\"test_data\" extracted_Source=\"*\" Target=\"*\" Status=\"*\" Name=\"*\" col1=\"*\" | table Name extracted_Source Target Status Details CreatedAt | sort -CreatedAt Time" , "search index=\"test_data\" extracted_Source=\"*\" Target=\"*\" Status=\"*\" Name=\"*\" | table Name extracted_Source Target Status Details CreatedAt | sort -CreatedAt Time")| table search

nisha_kapoor · ‎07-06-2017

I tried this and now this is the error I am getting Error in 'eval' command: The expression is malformed. Expected ).

nisha_kapoor · ‎07-06-2017

I have the same issue, however my search returns a table. Based on the if condition one of two searches is executed and the return type in both cases is a table. Any suggestions?

nisha_kapoor · ‎07-06-2017

This is what I tried originally, but it gives me this error Error in 'eval' command: The expression is malformed. An unexpected character is reached at ') , ( ( row1 of search) OR (row2 of search) OR (row 3 of search) ) ) )'.

nisha_kapoor · ‎07-06-2017

var1 is coming from a form input (dropdown). If that value is equal to "All" a run a certain search on my index and display the table else I run a different search and display that table. The issue I am facing is that I think only numbers/strings and not tables can be returned as arguments to an eval statement.

nisha_kapoor · ‎07-05-2017

I am using the eval as follows: eval result= if(var1=="All", [search1], [search2]) where search1 and search2 both return tables. According the whether the if condition is satisfied or not I display either one of the tables. The error which I am getting when I execute the above query is: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ').

nisha_kapoor · ‎06-29-2017

I ran the dashboard with an warning, and now it is not loading, how to get the previous working version of the dashboard? My dashboard has one form in which I placed two fieldset elements. I didn't even save the new version, simply switched to UI mode and now I seem to have lost all the data in my dashboard. There should be some way to get back to the last working state.

Posts	26
Solutions	0
Karma Given	4
Karma Received	2
Member Since	‎06-22-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How can I dynamically fill in these fields from a ...

Why isn't my replace command working in this searc...

Adding javascript to splunk dashboard

Access a drop-down field value in javascript

I cannot connect to splunk after downloading and i...

Selecting all non null fields from

Eval If statement with searches as arguments

Is it possible to retrieve a previous version of a...

I have to connect Splunk cloud to a mongoDB instan...

How can I dynamically fill in these fields from a ...

Why isn't my replace command working in this searc...

Re: Access a drop-down field value in javascript

Adding javascript to splunk dashboard

Re: Access a drop-down field value in javascript

Re: Access a drop-down field value in javascript

Access a drop-down field value in javascript

I cannot connect to splunk after downloading and i...

Re: How to validate text field inputs?

Re: Selecting all non null fields from

Re: Eval If statement with searches as arguments

Selecting all non null fields from

Re: Combining a text box and dropdown search

Re: How to only display fields with values in a ta...

Re: Eval If statement with searches as arguments

Re: Eval If statement with searches as arguments

Re: Eval If statement with searches as arguments

Re: Eval If statement with searches as arguments

Re: Eval If statement with searches as arguments

Re: Eval If statement with searches as arguments

Re: Is it possible to run a search within an eval ...

Re: Eval If statement with searches as arguments

Re: Eval If statement with searches as arguments

Eval If statement with searches as arguments

Is it possible to retrieve a previous version of a...