Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ziegfried
ziegfried
Influencer
Member since:
11-17-2009
01-26-2022
Community Statistics
| Posts | 668 |
| Solutions | 234 |
| Karma Given | 406 |
| Karma Received | 928 |
| Member Since | 11-17-2009 |
Activity Feed
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-09-2024 12:24 PM
- Got Karma for Re: Add reports to dashboards. 12-07-2023 11:17 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-18-2023 02:05 AM
- Got Karma for Re: How do you add dummy events to a search result?. 11-06-2022 11:06 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 09-19-2022 02:38 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 05-12-2022 04:02 PM
- Got Karma for Re: IIS FTP LOG TIMEZONE PROBLEM. 04-28-2022 04:28 AM
- Got Karma for Re: How do I list all active input stanzas in all apps?. 03-27-2022 08:43 PM
- Got Karma for Re: How do you add dummy events to a search result?. 01-11-2022 01:42 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 11-11-2021 02:06 AM
- Got Karma for Re: How to format _time field in results email?. 10-19-2021 11:43 AM
- Got Karma for Re: How do I determine my indexing volume by host, source, or sourcetype?. 06-07-2021 08:24 AM
- Got Karma for Re: convert bytes to megabytes in report. 05-19-2021 08:15 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 04-30-2021 10:07 AM
- Got Karma for Re: Terminate User Session. 03-16-2021 08:22 AM
- Got Karma for Re: Splunk DB Connect - dbquery inline search and time filtering not working. 03-02-2021 02:20 PM
- Got Karma for Re: how to find the earliest and latest event in an index?. 12-09-2020 09:22 AM
- Got Karma for Re: Multiple Values per Event - transforms.conf regex. 11-24-2020 06:58 AM
- Got Karma for Re: convert bytes to megabytes in report. 10-29-2020 03:10 PM
- Got Karma for Re: convert time format. 10-17-2020 03:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 5 |
06-05-2018
04:47 AM
1 Karma
This is not possible with the current version of the app. Since this is a repeated ask, it is on the TODO list, though.
... View more
06-05-2018
04:45 AM
Changes in 2.x:
Added support for message attachments
Added support for showing a list of fields from the search results along with the slack message
Allows the user to override the webhook URL for each alert
Improved logging
Updated app icon
Allow certain aspects of message attachment to be configured (conf file only for now)
... View more
04-11-2018
05:22 PM
Version 1.1.0 should be cloud compatible.
... View more
04-04-2018
04:42 PM
I assume this is version 1.1.0 of the app?
You could try to increase the logger level for alert actions temporarily to see more information in the logs:
Navigate to "Settings" -> "Server settings" -> "Server logging"
Search for the log channel "sendmodalert"
Select logging level "DEBUG"
NOTE: This will increase cause detailed logs to be produced for all alert actions and might have an
inpact on system performance. It is not recommended to do this on a production system.
... View more
05-24-2017
01:31 PM
geostats expects field names for latfield/longfield instead of values. Otherwise your search looks reasonable. Try this instead:
earliest=-15m object="Processor" counter="% Processor Time" sourcetype=CPU | where Value>90 | table host Value | eval lat=25.204849 | eval long=55.270783 | geostats latfield=lat longfield=long avg(count)
... View more
05-24-2017
01:28 PM
The custom cluster map does not support results split-by a field. You'll have to remove ... by dest_ip part from geostats)
... View more
05-24-2017
01:24 PM
1 Karma
The custom cluster map does not support split-by (ie. the geostats ... by Country part). It will display only the first series.
Example to plot the overall count:
... | geostats latfield=lat longfield=lon count
... View more
03-22-2017
03:32 PM
2 Karma
... | eval binary=replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(tostring(mynumber, "hex"), 3), "0", "0000"), "1", "0001"), "2", "0010"), "3", "0011"), "4", "0100"), "5", "0101"), "6", "0110"), "7", "0111"), "8", "1000"), "9", "1001"), "A", "1010"), "B", "1011"), "C", "1100"), "D", "1101"), "E", "1110"), "F", "1111")
... View more
03-22-2017
03:15 PM
1 Karma
You'll have to reference tokens in depends="..." with $ signs:
<input type="radio" token="YourTokenHere" depends="$NoSuchToken$" searchWhenChanged="true">
... View more
03-17-2017
01:35 PM
4 Karma
Here's an example:
require(['splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!'], function(mvc) {
var envTokenModel = mvc.Components.get('env');
// Grab a specific env token
console.log(envTokenModel.get('app'));
// Log all env tokens
console.log(envTokenModel.toJSON());
// React to env token changes:
envTokenModel.on('change', function() {
console.log(arguments);
});
});
... View more
11-02-2016
09:57 AM
Do you have a a simple example that shows your problem?
... View more
09-17-2016
01:46 PM
2 Karma
The visualization can only display a single, numeric (positive) value for each marker. The label is always derived from this numeric value and can not be customized.
The search results are expected to contain pre-aggregated clusters, such as typically generated by the geostats command.
... | geostats count
... | geostats sum(bytes)
... | geostats avg(magnitude) maxzoomlevel=18
So this is similar to the built-in marker map visualization splunk provides, except that the custom cluster map does not support results split-by another dimension (where the built-in viz shows multiple pie segments).
... View more
07-06-2016
01:01 AM
I've just added support for specifying a custom tile server URL. It's included in the version 1.2 of the app.
... View more
04-15-2016
09:14 AM
3 Karma
The click on the map will also expose a set of tokens denoting the bounds of the cluster:
$click.bounds.south$
$click.bounds.east$
$click.bounds.north$
$click.bounds.west$
Here's an example on how to enable what you're after:
<dashboard>
<label>Cluster Map Drilldown Demo</label>
<row>
<panel>
<viz type="viz_clustermap.clustermap">
<search>
<query>index=earthquakes | geostats latfield=latitude longfield=longitude max(mag) maxzoomlevel=18</query>
<earliest></earliest>
<latest></latest>
</search>
<drilldown>
<set token="map.click.south">$click.bounds.south$</set>
<set token="map.click.east">$click.bounds.east$</set>
<set token="map.click.north">$click.bounds.north$</set>
<set token="map.click.west">$click.bounds.west$</set>
</drilldown>
</viz>
</panel>
<panel>
<table>
<search>
<query><![CDATA[index=earthquakes latitude>=$map.click.south$ latitude<$map.click.north$ longitude>=$map.click.west$ longitude<$map.click.east$ | table _time place mag depth]]></query>
</search>
</table>
</panel>
</row>
</dashboard>
... View more
04-12-2016
05:09 AM
2 Karma
Don't worry about the tar warning messages. This is just some additional metadata the tar on OSX included. It's shouldn't cause any problems.
... View more
04-12-2016
01:07 AM
2 Karma
Check out the explanation here: https://regex101.com/r/eY4cN2/1 (tab on the right hand side)
... View more
04-08-2016
02:15 AM
Yeah, this is actually possible use a <change> event handler on the form input. Here's an example:
<input type="dropdown" token="country_code">
<search>
<query>| inputlookup geo_attr_countries.csv</query>
</search>
<fieldForLabel>country</fieldForLabel>
<fieldForValue>iso3</fieldForValue>
<change>
<set token="continent">$row.continent$</set>
</change>
</input>
In this example a token called $continent$ is set on every change of the form input and the value is taken from the same row of the search result (in this case the continent field).
... View more
04-06-2016
02:26 PM
The target is only valid for the <link> action and won't have any effect on token setters.
... View more
04-05-2016
06:21 PM
Are you sure the param name matches on both sides? param.myparam in alert_actions.conf would correspond to <input name="action.my_action.param.myparam"> in the HTML. Also make sure the alert action configuration is exported via metadata/default.meta.
... View more
04-01-2016
04:52 PM
3 Karma
The value of the form input is essentially managed by the data-binding layer of the alert-actions dialog, which responsible of applying the current settings to the HTML form when you're editing an existing alert. So supplying the value attribute won't have any effect.
I'd suggest specifying your default value into your stanza in alert_actions.conf
[my_action]
...
param.myparam = my default value
... View more
10-05-2015
02:12 PM
| rest /servicesNS/-/-/saved/searches | where actions != "" OR 'alert.track'==1 | table title search eai:acl.app eai:acl.owner | rename eai:acl.* as * title as name| search [ rest /services/authentication/current-context/context | rename username as owner | return 1 owner ]
... View more
10-02-2015
02:03 PM
1 Karma
It's possible to list all alerts using the rest search command in SPL. Using this you can create a dashboard panel. Here's an example that lists all alerts, and also redirects to the alert details page when you click on a row:
<dashboard>
<label>Alerts List in Dashboards</label>
<row>
<panel>
<table>
<title>Alerts</title>
<search>
<query>| rest /servicesNS/admin/search/saved/searches | where actions != "" OR 'alert.track'==1 | table title search eai:acl.app eai:acl.owner | rename eai:acl.* as * title as name</query>
<earliest></earliest>
<latest></latest>
</search>
<option name="drilldown">row</option>
<fields>name,search</fields>
<drilldown>
<link>/app/search/alerts?s=%2FservicesNS%2F$row.owner$%2F$row.app$%2Fsaved%2Fsearches%2F$row.name$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
10-02-2015
01:13 PM
The only thing that comes to mind for 6.2 is to use custom Javascript.
... View more
09-29-2015
04:51 PM
2 Karma
As of 6.3 you can use dashboard eval expressions to create tokens, and use that before you redirect to another view:
<drilldown>
<eval token="tmp">mvindex(split('click.value', "-"), 0)</eval>
<link>someothersite?form.num=$tmp$</link>
</drilldown>
... View more
