About kdimaria

kdimaria · ‎01-09-2019

@lianlim So what I was trying to do was have a table with an "Alert" column so that people could add alerts to a specific part in the table. Each row was an application that was being monitored then we wanted people to be able to add alerts to applications if needed. So I used a Jquery Dialog to create the prompt to get information to add to the alert column but a Javascript prompt also works: element1.on("click", function(e) { e.preventDefault(); if(e.field == "Alert"){ e.preventDefault(); var appname = e.data["row.App"]; var type = "User"; var dialog = $('<p>Enter an alert note for <b>' + appname + '</b> or clear the previous alert note. </p>').dialog({ position: myPos, buttons: { "Enter Alert Note": function(){ var note = prompt("Enter alert note for '" + appname + "'",""); var username = prompt("Enter Your Name: ", ""); if(note && username){ notesearch.settings.attributes.search = "| makeresults | eval Notes=\"" + note + "\" | eval application=\"" + appname + "\" | eval type=\"" + type + "\" | eval name=\"" + username + "\" | collect index=splunk-test source=app_alerts"; notesearch.startSearch(); setTimeout(function(){search1.startSearch();},2000); $(this).dialog("close"); } $(this).dialog("close"); }, "Clear Previous Note": function(){ notesearch.settings.attributes.search = "| makeresults | eval application=\"" + appname + "\" | eval type=\"" + type + "\" | collect index=splunk-test source=app_alerts"; notesearch.startSearch(); setTimeout(function(){search1.startSearch();},2000); $(this).dialog("close"); } }, width:350 }).css("font-size", "15px"); } So I added a click event for the table and when the user clicked on the "Alert" field they would be prompted to enter an alert note for the application (row) that they clicked on. I used makeresults to set all the values I needed from the variables gathered from the dialog and the collect command to save my alerts in a certain index and source so that when the search for the table runs again it will pick up the alert. I just created a blank searchelement called notesearch and changed it to run the search i needed. So my main table search does a join on application and retrieves the latest alert from the app_alerts source so that it is displayed on the table after refreshing. Hope this helps.

kdimaria · ‎11-06-2018

I have everything set up following this document: https://www.splunk.com/blog/2017/02/03/how-to-easily-stream-aws-cloudwatch-logs-to-splunk.html It was working fine and always pushing the logs to Splunk but every time the server gets restarted, the logs stop being sent. But, if the server is restarted again after that, it's fine. The error message in cloudwatch says like ":rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed" and "SSL routines:ssl3_get_key_exchange:bad signature:.", not really sure how to make it so that if the server is restarted that it doesn't affect the cloudwatch logs from being pushed to Splunk.

kdimaria · ‎08-24-2018

I have added libraries on my search app like JQuery-UI and Font Awesome icons that I use in my dashboards. But, for some reason, every time I restart Splunk or the search head, the dashboards say they can't find these libraries. But, when I check the server, they are still there. Then, if I restart it again, the dashboard works. Does anyone know why this might be happening or what I can do to avoid having to remember to restart it twice every time? Thanks

kdimaria · ‎07-18-2018

Please see my answer I just posted.

kdimaria · ‎07-18-2018

Please try the below HTML. I used outputcsv to create a csv file at first then it will continue to append to it once you hit submit. You can find the actual csv file in /opt/splunk/var/run/splunk/csv/ I display the results of the CSV file created using |inputcsv (I called it newcsv but you can change that) I used JavaScript to grab the two values of the input boxes after hitting Submit then have a search that runs in the background to create and append to the csv file. <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <title>Javascript into cvs</title> <link rel="shortcut icon" href="/en-US/static/@24D34014EFF4EDD633D5FCC87B2373BECCE2DBCDB974E848545A9EF99E0D05BF/img/favicon.ico" /> <link rel="stylesheet" type="text/css" href="{{SPLUNKWEB_URL_PREFIX}}/static/build/css/bootstrap-enterprise.css" /> <link rel="stylesheet" type="text/css" href="{{SPLUNKWEB_URL_PREFIX}}/static/css/build/pages/dashboard-simple-bootstrap.min.css" /> <link rel="stylesheet" type="text/css" media="all" href="{{SPLUNKWEB_URL_PREFIX}}/static/app/search/dashboard.css" /> <meta name="referrer" content="never" /> <meta name="referrer" content="no-referrer" /> <script> window._splunk_metrics_events = { push : function() {}, active: false, } </script> </head> <body class="simplexml preload locale-en" data-splunk-version="7.0.1" data-splunk-product="enterprise">  <header> <a class="navSkip" href="#navSkip" tabindex="1">Screen reader users, click here to skip the navigation bar</a> <div class="header splunk-header"> <div id="placeholder-splunk-bar"> <a href="{{SPLUNKWEB_URL_PREFIX}}/app/launcher/home" class="brand" title="splunk > listen to your data">splunk<strong>></strong></a> </div> <div id="placeholder-app-bar"></div> </div> <a id="navSkip"></a> </header> <div class="dashboard-body container-fluid main-section-body" data-role="main"> <div class="dashboard-header clearfix"> <h2>Javascript into cvs</h2> </div> <div class="fieldset"> input1: <input type="text" id="input1" size="20" name="input1"> input2: <input type="text" id="input2" size="20" name="input2"> <div class="form-submit" id="search_btn"> <button class="btn btn-primary submit">Submit</button> </div> </div> <div class="dashboard-row"> <div class="dashboard-cell" style="width: 25%"> <div class="dashboard-panel" style="border-style:solid;border-color:#CCCCCC;border-width:1px;background:white;margin-right:2px;margin-left:2px;"> <div style="margin-left:12px;margin-bottom:0px;"> <h3 style="margin-bottom:0px;" title="This table captures key application per data center."><strong>newcsv.csv Data</strong></h3> </div> <div id="csvElement" class="dashboard-element table" style="width: 100%"> </div> </div> </div> </div> </div>  <script src="{{SPLUNKWEB_URL_PREFIX}}/config?autoload=1" crossorigin="use-credentials"></script> <script src="{{SPLUNKWEB_URL_PREFIX}}/static/js/i18n.js"></script> <script src="{{SPLUNKWEB_URL_PREFIX}}/i18ncatalog?autoload=1"></script> <script src="{{SPLUNKWEB_URL_PREFIX}}/static/build/simplexml/index.js"></script> <script type="text/javascript"> // <![CDATA[ // <![CDATA[ // // LIBRARY REQUIREMENTS // // In the require function, we include the necessary libraries and modules for // the HTML dashboard. Then, we pass variable names for these libraries and // modules as function parameters, in order. // // When you add libraries or modules, remember to retain this mapping order // between the library or module and its function parameter. You can do this by // adding to the end of these lists, as shown in the commented examples below. require([ "splunkjs/mvc", "splunkjs/mvc/utils", "splunkjs/mvc/tokenutils", "underscore", "jquery", "splunkjs/mvc/simplexml", "splunkjs/mvc/layoutview", "splunkjs/mvc/simplexml/dashboardview", "splunkjs/mvc/simplexml/dashboard/panelref", "splunkjs/mvc/simplexml/element/chart", "splunkjs/mvc/simplexml/element/event", "splunkjs/mvc/simplexml/element/html", "splunkjs/mvc/simplexml/element/list", "splunkjs/mvc/simplexml/element/map", "splunkjs/mvc/simplexml/element/single", "splunkjs/mvc/simplexml/element/table", "splunkjs/mvc/simplexml/element/visualization", "splunkjs/mvc/simpleform/formutils", "splunkjs/mvc/simplexml/eventhandler", "splunkjs/mvc/simplexml/searcheventhandler", "splunkjs/mvc/simpleform/input/dropdown", "splunkjs/mvc/simpleform/input/radiogroup", "splunkjs/mvc/simpleform/input/linklist", "splunkjs/mvc/simpleform/input/multiselect", "splunkjs/mvc/simpleform/input/checkboxgroup", "splunkjs/mvc/simpleform/input/text", "splunkjs/mvc/simpleform/input/timerange", "splunkjs/mvc/simpleform/input/submit", "splunkjs/mvc/searchmanager", "splunkjs/mvc/savedsearchmanager", "splunkjs/mvc/postprocessmanager", "splunkjs/mvc/simplexml/urltokenmodel" // Add comma-separated libraries and modules manually here, for example: // ..."splunkjs/mvc/simplexml/urltokenmodel", // "splunkjs/mvc/tokenforwarder" ], function( mvc, utils, TokenUtils, _, $, DashboardController, LayoutView, Dashboard, PanelRef, ChartElement, EventElement, HtmlElement, ListElement, MapElement, SingleElement, TableElement, VisualizationElement, FormUtils, EventHandler, SearchEventHandler, DropdownInput, RadioGroupInput, LinkListInput, MultiSelectInput, CheckboxGroupInput, TextInput, TimeRangeInput, SubmitButton, SearchManager, SavedSearchManager, PostProcessManager, UrlTokenModel // Add comma-separated parameter names here, for example: // ...UrlTokenModel, // TokenForwarder ) { var pageLoading = true; // // TOKENS // // Create token namespaces var urlTokenModel = new UrlTokenModel(); mvc.Components.registerInstance('url', urlTokenModel); var defaultTokenModel = mvc.Components.getInstance('default', {create: true}); var submittedTokenModel = mvc.Components.getInstance('submitted', {create: true}); urlTokenModel.on('url:navigate', function() { defaultTokenModel.set(urlTokenModel.toJSON()); if (!_.isEmpty(urlTokenModel.toJSON()) && !_.all(urlTokenModel.toJSON(), _.isUndefined)) { submitTokens(); } else { submittedTokenModel.clear(); } }); // Initialize tokens defaultTokenModel.set(urlTokenModel.toJSON()); function submitTokens() { // Copy the contents of the defaultTokenModel to the submittedTokenModel and urlTokenModel FormUtils.submitForm({ replaceState: pageLoading }); } function setToken(name, value) { defaultTokenModel.set(name, value); submittedTokenModel.set(name, value); } function unsetToken(name) { defaultTokenModel.unset(name); submittedTokenModel.unset(name); } // // SEARCH MANAGERS // var addToCSV = new SearchManager({ id: "addToCSV", earliest_time: "0", latest_time: "now", preview: true, cache: false, search: "", }, {tokens: true, tokenNamespace: "submitted"}); var csvSearch = new SearchManager({ id: "csvSearch", earliest_time: "0", latest_time: "now", preview: true, cache: false, search: "| inputcsv newcsv.csv", }, {tokens: true, tokenNamespace: "submitted"}); // // SPLUNK LAYOUT // $('header').remove(); new LayoutView({"hideChrome": false, "hideAppBar": false, "hideSplunkBar": false, "hideFooter": false}) .render() .getContainerElement() .appendChild($('.dashboard-body')[0]); // // DASHBOARD EDITOR // new Dashboard({ id: 'dashboard', el: $('.dashboard-body'), showTitle: true, editable: true }, {tokens: true}).render(); // // VIEWS: VISUALIZATION ELEMENTS // var csvElement = new TableElement({ "id": "csvElement", "count": 20, "dataOverlayMode": "none", "drilldown": "row", "rowNumbers": "false", "wrap": "true", "link.visible": true, "managerid": "csvSearch", "el": $('#csvElement') }, {tokens: true, tokenNamespace: "submitted"}).render(); // // VIEWS: FORM INPUTS // // // SUBMIT FORM DATA // var submit = new SubmitButton({ id: 'submit', el: $('#search_btn') }, {tokens: true}).render(); submit.on("submit", function() { var input1 = document.getElementById("input1").value; var input2 = document.getElementById("input2").value; addToCSV.settings.attributes.search = "| makeresults | eval input1=\"" + input1 + "\" | eval input2=\"" + input2 + "\" | outputcsv append=true newcsv"; addToCSV.startSearch(); alert("newcsv.csv has been created or added to. It is stored in /opt/splunk/var/run/splunk/csv/newcsv.csv"); setTimeout(function(){csvSearch.startSearch();},2000); }); // Initialize time tokens to default if (!defaultTokenModel.has('earliest') && !defaultTokenModel.has('latest')) { defaultTokenModel.set({ earliest: '0', latest: '' }); } if (!_.isEmpty(urlTokenModel.toJSON())){ submitTokens(); } // // DASHBOARD READY // DashboardController.ready(); pageLoading = false; } ); // ]]> </script> </body> </html>

kdimaria · ‎07-10-2018

thank you 🙂

kdimaria · ‎07-10-2018

I am trying to see the average users by day but when there are no events or users for a certain day the _time field doesn't show up or put a zero so the calculation is wrong. I am looking back the previous week so I should see Monday through Friday but I only see Monday Tuesday and Wednesday. I tried fillnull but that did not work. I want to see Thursday and Friday as 0 to calculate the avg correctly. index=* | where isnotnull(user) | where date_wday!="saturday" AND date_wday!="sunday"| bin _time span=24h | stats dc(user) as Users by _time| fillnull Users value=0 | stats avg(Users) as Users

kdimaria · ‎06-14-2018

This works!

kdimaria · ‎05-31-2018

First I just want to say I know of all the commands to change the colors. like "charting.seriesColors": "[0x337ab7,0xF89406,0x59d685,0xffa100,0xff001d]" and "charting.fieldColors": "{\"Sucess\":0x337ab7,\"Error\":0xF89406}" BUT I want to know if there is some reason why my dashboard is picking the darkest/ugliest colors. When I open the pie chart in search, it picks completely different and bright colors. Examples: The one on the left is when I click "Open in search" and the one on the right is in the dashboard. I've tried using the series.colors but it sometimes picks the same colors for two slices. Why is my dashboard picking completely different colors? Thanks

kdimaria · ‎05-30-2018

The table header's alignments seem completely random. Some are aligned to the left and others are aligned to the right. Is there a way to make them all the same? I know how to change the alignments of the cells but I want to change the headers.

kdimaria · ‎05-23-2018

Thank you so much for your time and effort! This works!

kdimaria · ‎05-23-2018

Ignore the lookup, I just want to do | eval host="spx*" | join host [search index=linux blah blah ] but that doesn't work. Unless there is someway in the props.conf to help me JOIN using wildcards, I would appreciate if you moved your answer to a comment so this question looks unanswered and other people can chime in. thanks!

kdimaria · ‎05-23-2018

Sorry but that is not what I'm looking for. I am trying to JOIN with a wildcard. That question is doing a lookup and outputing a field from that same lookup that matches the wildcards. not the same.

kdimaria · ‎05-23-2018

I have a lookup that contains host names with wildcards. I am trying to do a inputlookup to grab those host names with the wildcards and then join those host names to find all other hosts that have a similar name. For example, one host in my lookup for application test is spx*. application test has a bunch of hosts that start with spx and I want to join on all of those possibilities and find them in the linux index. Example Code: | inputlookup application_hosts.csv | fields application,host| where application="test" AND host="spx*" | join host type=left [search index=linux sourcetype=df latest=now earliest=-15m | dedup host | table host mount] When I join the hosts with the wildcard * they dont pick up the hosts they should. Is it possible to join using a wildcard?

kdimaria · ‎05-14-2018

So theres two places for input? one for the URL we need authentication for then we put in the credentials then we put the other URL that we want monitored that is past that single sign on page?

kdimaria · ‎05-09-2018

Thanks, Does this app do the same time of monitoring by getting the response code and the response time? And when I go to the link it redirects me to an entirely different webpage to log in then I can access a bunch of different webpages. Will it work for that?

kdimaria · ‎05-09-2018

Is there some way to configure the App to have login credentials so it passes the single sign on page? When I put the url's I want, it returns 200 but I am assuming it is pinging the sign on page and not the actual URL because when you go to that url in a browser, it redirects to the sign on page. Thanks.

kdimaria · ‎04-09-2018

Thanks so much! this worked! if you want to put this as an answer so I can accept it thatd be great!

kdimaria · ‎04-09-2018

@FrankVI ok but im still running into the issue that its displaying January-December when I would like it to display the current month last. So have the graph show May-April

kdimaria · ‎04-09-2018

@FrankVI , you never use the month variable in the stats? I assumed it was supposed to be month instead of date_month because that query didnt work. Using the month it puts it from January-December but I want the latest month on the right to be the current month. Sorry please let me know if you have any suggestions.

kdimaria · ‎04-06-2018

Theres a query im running in the background to calculate the availability for the current month based on the previous days. so the availability for today is from April 1-6th and its a percentage. So im trying to grab the latest for that month so that on the graph for april, itll show whatever the latest is so the availability that was calculated for today (april 6th) and the previous months should be the last day of the moth but, its not grabbing the latest. it looks like its grabbing the first of each month

kdimaria · ‎04-06-2018

For some reason when I do this the months are not in normal order. They're all out of order for some reason. Do you know why this is? thanks!!!

kdimaria · ‎04-06-2018

sorry i shouldve been more clear, availability is a percentage. its not a number that means up or down. its a percentage that is calculated every day to determine that app's availability 0-100%. so the numbers change every day based on if it was up or down. starts at 100 then decreases if there was an outage. so an application will always have an availability percentage because it resets to 100 every day to calculate the availability for today then we can calculate for the month. so the way the query is set up is its showing the availability total for the month based on the past however days the month has had and i want to graph by the month so i wanted to grab the latest calculation because that is the final availability calculation per app per month if that makes sense

kdimaria · ‎04-06-2018

yes it is a number

kdimaria · ‎04-06-2018

Those stats give me the correct numbers but I want to graph it having the x-axis be the month and the lines being each application

Posts	99
Solutions	2
Karma Given	20
Karma Received	5
Member Since	‎08-01-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

AWS cloudwatch logs stop reporting after Server ge...

Why is restarting Splunk messing up my dashboard l...

Why is stats avg() not putting in zeros by _time?

Why is my dashboard picking the darkest colors for...

How to change table header alignments?

How to join using a wildcard?

Website Monitoring App: monitor sites beyond a sin...

Get Latest event per month?

How to convert GMT timestamp to EST?

How to add a new column to a row?

Re: Is there a way to add text to dashboard panel ...

AWS cloudwatch logs stop reporting after Server ge...

Why is restarting Splunk messing up my dashboard l...

Re: How to create two text boxes on a dashboard wi...

Re: How to create two text boxes on a dashboard wi...

Re: Why is stats avg() not putting in zeros by _ti...

Why is stats avg() not putting in zeros by _time?

Re: How can I show all values in a pie chart inste...

Why is my dashboard picking the darkest colors for...

How to change table header alignments?

Re: How to join using a wildcard?

Re: How to join using a wildcard?

Re: How to join using a wildcard?

How to join using a wildcard?

Re: Website Monitoring App: monitor sites beyond a...

Re: Website Monitoring App: monitor sites beyond a...

Website Monitoring App: monitor sites beyond a sin...

Re: Get Latest event per month?

Re: Get Latest event per month?

Re: Get Latest event per month?

Re: Get Latest event per month?

Re: Get Latest event per month?

Re: Get Latest event per month?

Re: Get Latest event per month?

Re: Get Latest event per month?