Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About johnmvang
johnmvang
Path Finder
Member since:
12-04-2013
10-20-2022
Community Statistics
| Posts | 31 |
| Solutions | 4 |
| Karma Given | 6 |
| Karma Received | 11 |
| Member Since | 12-04-2013 |
Activity Feed
- Got Karma for Re: Drill down to absolute URL using click.value. 10-07-2022 04:22 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 06-29-2022 06:46 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 02-06-2022 09:19 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 11-02-2021 10:04 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 02-02-2021 03:14 AM
- Posted Re: Looking to finalize dashboard panel searches sooner than later on Splunk Enterprise. 12-17-2020 08:12 AM
- Posted Looking to finalize dashboard panel searches sooner than later on Splunk Enterprise. 12-16-2020 10:25 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 07-02-2020 07:15 AM
- Got Karma for Re: pass quotes inside of tokens for dashboard. 06-05-2020 12:50 AM
- Got Karma for Re: i want to start a new splunk architecture and i need to submit a document with a architucture diagram and summery i need a document on dhat. 06-05-2020 12:50 AM
- Karma Re: EVAL with field extracted from props.conf for micahkemp. 06-05-2020 12:48 AM
- Karma Re: EVAL with field extracted from props.conf for micahkemp. 06-05-2020 12:48 AM
- Karma Re: Why export button is grayed out in some of my panels? for cmerriman. 06-05-2020 12:48 AM
- Got Karma for Re: After applying a shcluster bundle, why am I getting splunkd startup parsing errors for Splunk_App_DB_Connect?. 06-05-2020 12:48 AM
- Got Karma for Re: After applying a shcluster bundle, why am I getting splunkd startup parsing errors for Splunk_App_DB_Connect?. 06-05-2020 12:48 AM
- Karma Re: Using rex to extract multivalue fields from events, why is it only extracting the first record of values? for fdi01. 06-05-2020 12:47 AM
- Karma Re: Drill down to absolute URL using click.value for wschulze. 06-05-2020 12:46 AM
- Karma Re: how to find search name based on error in splunkd.log? for somesoni2. 06-05-2020 12:46 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 06-05-2020 12:46 AM
- Posted Re: i want to start a new splunk architecture and i need to submit a document with a architucture diagram and summery i need a document on dhat on Deployment Architecture. 08-20-2019 02:56 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-17-2020
08:12 AM
i think i may have figured it out. i removed my <condition> tags and it just set it as progress took place. dumb me.
... View more
12-16-2020
10:25 AM
I have dashboard panels which set token values with $result.<field_name>$, however our environment is a little congested and the searches will sit at 99% or 98.9 or 100% but won't actually finalize until maybe 60-90 seconds later. I see the results are there and are what i'm expecting, however the tokens won't set unless the panel searches are finalized. I've tried placing those tokens in the below <progress>
<condition match="'job.resultCount' > 0">
<set token="abc">$result.field1$</set>
<set token="cba">$result.field2$</set>
</condition>
</progress> but it still waits until the search finalizes before my other panels can utilize those tokens. is there anyway to finalize panels after a set amount of time with an 'option' tag in the xml? or something?
... View more
Labels
08-20-2019
02:56 PM
1 Karma
are you looking for splunk base-line architectures? if so then what @somesoni2 posted is what you're looking for. If you don't know what you need you need to work with professional services to go through a review of what you're trying to build and have indexed into the environment, etc.
... View more
08-20-2019
02:43 PM
I'm using the JIRA Splunk Add-on App and got it working in Dev using the base configuration. Everything is working, however the password is written in clear text---is there a better way to encrypt/decrypt this password for the app to use without any manual intervention?
I'm reading a few things and it seems like it should be simpler, but the write-ups have so much going on with the scripted input in the inputs.conf, configured realms, etc.
Any help or insight into what to expect or better ways on approaching a scripted login would be helpful.
Thanks.
... View more
03-05-2019
07:42 AM
7 Karma
this worked for me. no JS required.
<condition field="URL">
<link target="_blank">$click.value2|n$</link>
</condition>
... View more
11-28-2018
06:30 AM
1 Karma
Hi Kamlesh, that did it for me. Thanks works great.
... View more
11-26-2018
02:18 PM
this all works as long as there are no quotes. just fyi.
... View more
11-26-2018
01:26 PM
sure,
i've got a dashboard, where users can fill out 3 forms:
they can input:
'My Title' for input1 - which is a title input.
index="my_index" sourcetype="my_sourcetype" my_search - for the search
then choose a dropdown.
<panel depends="$show_row2_tok$,$show_r2panel2_tok$">
<title>Row 2 - Panel 2</title>
<input type="text" token="r2p2_title">
<label>Panel Title</label>
<default></default>
</input>
<input type="text" token="r2p2_search">
<label>Search String</label>
<default></default>
</input>
<input type="dropdown" token="r2p2_viz">
<label>Visualization Type</label>
<choice value="column">Column Chart</choice>
<choice value="line">Line Graph</choice>
<choice value="stats">Stats Table</choice>
<default></default>
</input>
<html>
</html>
</panel>
These will then populate values in a KVstore where i need to write them with an eval:
| makeresults
| eval custom_r2p2_title = "$write_r2p2_title$"
| eval custom_r2p2_search = "$write_r2p2_search$"
| eval custom_r2p2_vi = "$write_r2p2_viz$"
| outputlookup my_kvstore append=true
since i'm enabling users to add a search string into the second input, sometimes they will have quotes inside of their values which will break the search with this error:
Error in 'eval' command: The expression is malformed.
... View more
11-07-2018
09:49 AM
Hello,
I'm looking to pass a token in a dashboard where the value may have quotes, since the token is going into an eval, anyone know how to get that to work? Right now i'm running into eval malformed errors. with quadruple quotes or more depending on how many quotes the user inputs.
Thanks.
... View more
11-02-2018
09:11 AM
thanks this works, i get it now. if you want to reply with an answer i can mark it as answered.
... View more
11-01-2018
04:45 PM
Hello,
I have the following dashboard code:
<progress>
<condition match="'job.resultCount' > 0">
<set token="set_cp1_tok">$result.cp1$</set>
<set token="set_cp2_tok">$result.cp2$</set>
<set token="set_cp3_tok">$result.cp3$</set>
<set token="set_pa1_tok">$result.pa1$</set>
<set token="set_pa2_tok">$result.pa2$</set>
<set token="set_pa3_tok">$result.pa3$</set>
<set token="set_ws1_tok">$result.ws1$</set>
<set token="set_ws2_tok">$result.ws2$</set>
<set token="set_ws3_tok">$result.ws3$</set>
<set token="set_dct1_tok">$result.dct1$</set>
<set token="set_dct2_tok">$result.dct2$</set>
<set token="set_dct3_tok">$result.dct3$</set>
<set token="set_asm1_tok">$result.asm1$</set>
<set token="set_asm2_tok">$result.asm2$</set>
<set token="set_asm3_tok">$result.asm3$</set>
<set token="set_asm11_tok">$result.asm11$</set>
<set token="set_asm22_tok">$result.asm22$</set>
<set token="set_desc_tok">$result.description$</set>
<set token="edit_id_tok">$result.id$</set>
<set token="show_loading">true</set>
<set token="set_key_tok">$result.key$</set>
</condition>
<condition match="'result.custom_r1p1_vi'=="line"">
<set token="show_row1p1_line">true</set>
</condition>
<condition match="'result.custom_r1p2_vi'=="line"">
<set token="show_row1p2_line">true</set>
</condition>
<condition match="'result.custom_r1p3_vi'=="line"">
<set token="show_row1p3_line">true</set>
</condition>
</progress>
and only the first condition match statement is applying. The other 3 condition matches do not apply when the results are there, and the tokens should all be true.
I saw this answer, but every time i try to do it, i get XML errors stating i'm missing closing tags:
https://answers.splunk.com/answers/575552/set-multiple-tokens-using-condition-match.html
What am i doing wrong?
... View more
10-30-2018
04:39 PM
answer can be found here:
https://answers.splunk.com/answers/696030/is-there-anyway-to-pass-rowfield-name-without-clic.html
... View more
10-30-2018
04:37 PM
got it. thanks
... View more
10-30-2018
04:34 PM
it is a table. and i did try it and it is working. is this documented? i could not find that.
thanks a million.
PS. i can't mark this as resolved for some reason.
... View more
10-30-2018
04:04 PM
I need to get field values after a search finishes and pull fields from the finished search and set those values as tokens. i'm using $row.field_name$ but it's literally passing that text rather than the values.
... View more
