Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About johnmvang
johnmvang
Path Finder
Member since:
12-04-2013
10-20-2022
Community Statistics
| Posts | 31 |
| Solutions | 4 |
| Karma Given | 6 |
| Karma Received | 11 |
| Member Since | 12-04-2013 |
Activity Feed
- Got Karma for Re: Drill down to absolute URL using click.value. 10-07-2022 04:22 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 06-29-2022 06:46 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 02-06-2022 09:19 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 11-02-2021 10:04 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 02-02-2021 03:14 AM
- Posted Re: Looking to finalize dashboard panel searches sooner than later on Splunk Enterprise. 12-17-2020 08:12 AM
- Posted Looking to finalize dashboard panel searches sooner than later on Splunk Enterprise. 12-16-2020 10:25 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 07-02-2020 07:15 AM
- Got Karma for Re: pass quotes inside of tokens for dashboard. 06-05-2020 12:50 AM
- Got Karma for Re: i want to start a new splunk architecture and i need to submit a document with a architucture diagram and summery i need a document on dhat. 06-05-2020 12:50 AM
- Karma Re: EVAL with field extracted from props.conf for micahkemp. 06-05-2020 12:48 AM
- Karma Re: EVAL with field extracted from props.conf for micahkemp. 06-05-2020 12:48 AM
- Karma Re: Why export button is grayed out in some of my panels? for cmerriman. 06-05-2020 12:48 AM
- Got Karma for Re: After applying a shcluster bundle, why am I getting splunkd startup parsing errors for Splunk_App_DB_Connect?. 06-05-2020 12:48 AM
- Got Karma for Re: After applying a shcluster bundle, why am I getting splunkd startup parsing errors for Splunk_App_DB_Connect?. 06-05-2020 12:48 AM
- Karma Re: Using rex to extract multivalue fields from events, why is it only extracting the first record of values? for fdi01. 06-05-2020 12:47 AM
- Karma Re: Drill down to absolute URL using click.value for wschulze. 06-05-2020 12:46 AM
- Karma Re: how to find search name based on error in splunkd.log? for somesoni2. 06-05-2020 12:46 AM
- Got Karma for Re: Drill down to absolute URL using click.value. 06-05-2020 12:46 AM
- Posted Re: i want to start a new splunk architecture and i need to submit a document with a architucture diagram and summery i need a document on dhat on Deployment Architecture. 08-20-2019 02:56 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-17-2020
08:12 AM
i think i may have figured it out. i removed my <condition> tags and it just set it as progress took place. dumb me.
... View more
12-16-2020
10:25 AM
I have dashboard panels which set token values with $result.<field_name>$, however our environment is a little congested and the searches will sit at 99% or 98.9 or 100% but won't actually finalize until maybe 60-90 seconds later. I see the results are there and are what i'm expecting, however the tokens won't set unless the panel searches are finalized. I've tried placing those tokens in the below <progress>
<condition match="'job.resultCount' > 0">
<set token="abc">$result.field1$</set>
<set token="cba">$result.field2$</set>
</condition>
</progress> but it still waits until the search finalizes before my other panels can utilize those tokens. is there anyway to finalize panels after a set amount of time with an 'option' tag in the xml? or something?
... View more
Labels
08-20-2019
02:56 PM
1 Karma
are you looking for splunk base-line architectures? if so then what @somesoni2 posted is what you're looking for. If you don't know what you need you need to work with professional services to go through a review of what you're trying to build and have indexed into the environment, etc.
... View more
08-20-2019
02:43 PM
I'm using the JIRA Splunk Add-on App and got it working in Dev using the base configuration. Everything is working, however the password is written in clear text---is there a better way to encrypt/decrypt this password for the app to use without any manual intervention?
I'm reading a few things and it seems like it should be simpler, but the write-ups have so much going on with the scripted input in the inputs.conf, configured realms, etc.
Any help or insight into what to expect or better ways on approaching a scripted login would be helpful.
Thanks.
... View more
03-05-2019
07:42 AM
7 Karma
this worked for me. no JS required.
<condition field="URL">
<link target="_blank">$click.value2|n$</link>
</condition>
... View more
11-28-2018
06:30 AM
1 Karma
Hi Kamlesh, that did it for me. Thanks works great.
... View more
11-26-2018
02:18 PM
this all works as long as there are no quotes. just fyi.
... View more
11-26-2018
01:26 PM
sure,
i've got a dashboard, where users can fill out 3 forms:
they can input:
'My Title' for input1 - which is a title input.
index="my_index" sourcetype="my_sourcetype" my_search - for the search
then choose a dropdown.
<panel depends="$show_row2_tok$,$show_r2panel2_tok$">
<title>Row 2 - Panel 2</title>
<input type="text" token="r2p2_title">
<label>Panel Title</label>
<default></default>
</input>
<input type="text" token="r2p2_search">
<label>Search String</label>
<default></default>
</input>
<input type="dropdown" token="r2p2_viz">
<label>Visualization Type</label>
<choice value="column">Column Chart</choice>
<choice value="line">Line Graph</choice>
<choice value="stats">Stats Table</choice>
<default></default>
</input>
<html>
</html>
</panel>
These will then populate values in a KVstore where i need to write them with an eval:
| makeresults
| eval custom_r2p2_title = "$write_r2p2_title$"
| eval custom_r2p2_search = "$write_r2p2_search$"
| eval custom_r2p2_vi = "$write_r2p2_viz$"
| outputlookup my_kvstore append=true
since i'm enabling users to add a search string into the second input, sometimes they will have quotes inside of their values which will break the search with this error:
Error in 'eval' command: The expression is malformed.
... View more
11-07-2018
09:49 AM
Hello,
I'm looking to pass a token in a dashboard where the value may have quotes, since the token is going into an eval, anyone know how to get that to work? Right now i'm running into eval malformed errors. with quadruple quotes or more depending on how many quotes the user inputs.
Thanks.
... View more
11-02-2018
09:11 AM
thanks this works, i get it now. if you want to reply with an answer i can mark it as answered.
... View more
11-01-2018
04:45 PM
Hello,
I have the following dashboard code:
<progress>
<condition match="'job.resultCount' > 0">
<set token="set_cp1_tok">$result.cp1$</set>
<set token="set_cp2_tok">$result.cp2$</set>
<set token="set_cp3_tok">$result.cp3$</set>
<set token="set_pa1_tok">$result.pa1$</set>
<set token="set_pa2_tok">$result.pa2$</set>
<set token="set_pa3_tok">$result.pa3$</set>
<set token="set_ws1_tok">$result.ws1$</set>
<set token="set_ws2_tok">$result.ws2$</set>
<set token="set_ws3_tok">$result.ws3$</set>
<set token="set_dct1_tok">$result.dct1$</set>
<set token="set_dct2_tok">$result.dct2$</set>
<set token="set_dct3_tok">$result.dct3$</set>
<set token="set_asm1_tok">$result.asm1$</set>
<set token="set_asm2_tok">$result.asm2$</set>
<set token="set_asm3_tok">$result.asm3$</set>
<set token="set_asm11_tok">$result.asm11$</set>
<set token="set_asm22_tok">$result.asm22$</set>
<set token="set_desc_tok">$result.description$</set>
<set token="edit_id_tok">$result.id$</set>
<set token="show_loading">true</set>
<set token="set_key_tok">$result.key$</set>
</condition>
<condition match="'result.custom_r1p1_vi'=="line"">
<set token="show_row1p1_line">true</set>
</condition>
<condition match="'result.custom_r1p2_vi'=="line"">
<set token="show_row1p2_line">true</set>
</condition>
<condition match="'result.custom_r1p3_vi'=="line"">
<set token="show_row1p3_line">true</set>
</condition>
</progress>
and only the first condition match statement is applying. The other 3 condition matches do not apply when the results are there, and the tokens should all be true.
I saw this answer, but every time i try to do it, i get XML errors stating i'm missing closing tags:
https://answers.splunk.com/answers/575552/set-multiple-tokens-using-condition-match.html
What am i doing wrong?
... View more
10-30-2018
04:39 PM
answer can be found here:
https://answers.splunk.com/answers/696030/is-there-anyway-to-pass-rowfield-name-without-clic.html
... View more
10-30-2018
04:37 PM
got it. thanks
... View more
10-30-2018
04:34 PM
it is a table. and i did try it and it is working. is this documented? i could not find that.
thanks a million.
PS. i can't mark this as resolved for some reason.
... View more
10-30-2018
04:04 PM
I need to get field values after a search finishes and pull fields from the finished search and set those values as tokens. i'm using $row.field_name$ but it's literally passing that text rather than the values.
... View more
10-30-2018
02:37 PM
hello, i did change my 'progress' flags to 'done'. Also my code shows i am already using $row.field_value$.
From what i'm reading, it sounds like it has to be a drilldown/CLICKED value. it can't just be set from a search finishing and pulling the fields from the finished search.
The way i have it set, it just sets the token as the literal words "$row.field_name$" and not expected field values.
... View more
08-07-2018
11:44 AM
Hello,
I have 3 panels on a single dashboard.
The first panel is visible where it TABLEs out a list of events which you can click on.
The second panel is hidden and is waiting on the value you click on from the first panel and runs a search and displays more events in a TABLE.
The third panel is also hidden and populated by the first and second panels then writes to a kvstore
Problem I'm having is passing the tokens from the second panel to the third panel. Example below:
My snippet of the second panel from XML
<search>
<query>
my search <token from panel1>... | table field1 field2
</query>
<earliest>-15m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.resultCount' > 0">
<set token="set_field1_tok">$row.field1$</set>
<set token="set_field2_tok">$row.field2$</set>
<set token="fix_earliest">-15m</set>
<set token="fix_latest">now</set>
</condition>
</progress>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
when I call $set_field1_tok$ and/or $set_field2_tok$ in panel3 I literally get the values "$row.field1$" and "$row.field2$" and not the expected field value. Am I doing this right? Or is this wrong?
Thanks.
... View more
10-12-2017
07:56 PM
i updated my question with the unifwd outputs. But let me look into the btool and i'll come back.
Thanks,
John
... View more
10-12-2017
03:47 PM
Hello,
As the question states, i'm looking to send events from a universal forwarder to a heavy forwarder to have filtered. Once filtered, i'd like to change the sourcetype. I have not implemented this yet. This is for me to propose to upper management to agree on. I want to make sure the props/transforms piece is correct. I think the filtering is good, however i just want to make sure the syntax is all good.
I've listed my config and config details:
ON UNIVERSAL FORWARDER
inputs.conf
[monitor://c:\program files\app1\web.log]
_TCP_ROUTING = filter_heavy_forwarders
index = cmis_index
sourcetype = app1_web_logs
ON UNIVERSAL FORWARDER
outputs.conf
[tcpout]
defaultGroup=infosec_indexers
[tcpout:infosec_indexers]
autoLB = true
server = infosec_server1:9997,infosec_server2:9997,infosec_server3:9997…,infosec_server16:9997
[tcpout:cmis_indexers]
autoLB = true
server = cmis_server1:9997
[tcpout:filter_heavy_forwarders]
autoLB = true
Server = filter_hvyfwd1:9998,filter_hvyfwd2:9998
ON HEAVY FORWARDER
props.conf
[app1_web_logs]
TRANSFORMS-routing = app1_web_filter
TRANSFORMS-changest = app1_cmis_web
ON HEAVY FORWARDER
transforms.conf
[app1_web_filter]
REGEX = (Events|To|Filter)
DEST_KEY = _TCP_ROUTING
FORMAT = cmis_indexers
[app1_cmis_web_st]
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::app1_cmis_web
ON HEAVY FORWARDER
outputs.conf
[tcpout]
defaultGroup=none
[tcpout:cmis_indexers]
autoLB = true
server = cmis_server1:9997
... View more
06-02-2017
03:04 PM
Micahkemp answered this question. However he posted a comment, so i could not mark it, so i'm just adding the details and marking it as answered.
With my dilemma use MVEXPAND:
| mvexpand check_amount |eval fixed_value = round(check_amount / 100, 2)
or index the data as separate lines and then use the |EVAL in a search or in the props to have the work performed automatically.
Thanks,
John
... View more
06-02-2017
03:01 PM
I might be be able to do just that. I know indexing this file and breaking the file at each line will make life easier, I just had other data in the heading of the file that may be needed... I don't know yet.
Thanks man. I'll mark this as answered.
... View more
06-02-2017
02:30 PM
Should i remove my existing props/transforms that is already doing the multi-value extraction prior to using mvexpand?
... View more
06-02-2017
02:21 PM
Yes that is a multi-value field and I believe this is the problem. However, i'm looking for a solution to see if there is any way around it to get the desired results.
... View more
06-02-2017
02:16 PM
yes, the check_amount field is still populated with the old set of values 0000020621 and etc. but the new fixed_value field is not there and i have no modified values: 206.21, etc.
... View more
06-02-2017
02:08 PM
I still have this issue in verbose mode or if i change the field name with EVAL.
If i did "|eval fixed_value = round(check_amount / 100, 2)" the "fixed_value" field never shows up.
... View more
