Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kdimaria
kdimaria
Communicator
Member since:
08-01-2017
06-05-2020
Community Statistics
| Posts | 99 |
| Solutions | 2 |
| Karma Given | 20 |
| Karma Received | 5 |
| Member Since | 08-01-2017 |
Activity Feed
- Got Karma for Re: How do you add JS in xml?. 03-19-2021 02:05 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: How do you add JS in xml? for niketn. 06-05-2020 12:49 AM
- Karma Re: Need help on predict command usage in graph for niketn. 06-05-2020 12:49 AM
- Karma Re: Need help on predict command usage in graph for Sukisen1981. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to add icon to a panel instead of table so there are no borders? for niketn. 06-05-2020 12:49 AM
- Karma Re: Can you include a visualization (pie chart) in splunk alert e-mail pdf attachment? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Is the Splunk predict command useful? for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Get Latest event per month? for FrankVl. 06-05-2020 12:49 AM
- Karma Re: Splunk predict command period vs future_timespan? for jkat54. 06-05-2020 12:49 AM
- Karma Re: Splunk predict command period vs future_timespan? for niketn. 06-05-2020 12:49 AM
- Karma Re: How to replace specific field value? for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Is there a way to add text to dashboard panel from a HTML text box? for niketn. 06-05-2020 12:49 AM
- Got Karma for How can you change the width of a column in a table(HTML) or add a new line break to a field?. 06-05-2020 12:49 AM
- Got Karma for Splunk predict command period vs future_timespan?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-06-2018
03:38 AM
I have everything set up following this document: https://www.splunk.com/blog/2017/02/03/how-to-easily-stream-aws-cloudwatch-logs-to-splunk.html
It was working fine and always pushing the logs to Splunk but every time the server gets restarted, the logs stop being sent. But, if the server is restarted again after that, it's fine. The error message in cloudwatch says like ":rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed" and "SSL routines:ssl3_get_key_exchange:bad signature:.", not really sure how to make it so that if the server is restarted that it doesn't affect the cloudwatch logs from being pushed to Splunk.
... View more
08-24-2018
03:36 AM
I have added libraries on my search app like JQuery-UI and Font Awesome icons that I use in my dashboards. But, for some reason, every time I restart Splunk or the search head, the dashboards say they can't find these libraries. But, when I check the server, they are still there. Then, if I restart it again, the dashboard works.
Does anyone know why this might be happening or what I can do to avoid having to remember to restart it twice every time? Thanks
... View more
06-15-2018
03:47 AM
Since you are already aware of the xml charting colour options , I assume you have added the relevant color codes in the dashboard xml.
Now, I had a similar issue , not with pie charts but with a column line graph with multiple overlays. For some reason if you use charting.seriesColors , stuff will get disruptive. My colors on applying this (even though the number of fields charted was constant and 7 in number)but when i changed it to option 2 , charting.fieldColors then things became correct.
That being said, you have a pie chart here and the number of 'slices' in the pie chart is important. if the number of slices are constant and you apply charting.fieldColors with the slices mentioned things should work out
... View more
05-30-2018
11:42 AM
2 Karma
@kdimaria, adding on the the point by @kmaron, Splunk adds following three classes to table data timestamp , string and numeric . While timestamp and string columns are left aligned, numeric columns are right aligned. And the behavior is same for both Table Header as Well Table Body (i.e. Data Rows). You can use CSS to apply your own style override for numeric class to be aligned left . Following code can be added to Simple XML Dashboard to align both Header and Body text to left for numeric fields (where table id is tableWithCSSToAlignHeaderText 😞
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
#tableWithCSSToAlignHeaderText table thead th.numeric,#tableWithCSSToAlignHeaderText table tbody tr td.numeric{
text-align:left !important;
}
</style>
</html>
</panel>
</row>
Following is a run anywhere dashboard example in Simple XML based on Splunk's _internal index.
<dashboard>
<label>Table Column Header Alignment</label>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
#tableWithCSSToAlignHeaderText table thead th.numeric,#tableWithCSSToAlignHeaderText table tbody tr td.numeric{
text-align:left !important;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<title>Table with CSS to Align Header Text</title>
<table id="tableWithCSSToAlignHeaderText">
<title>Splunk _internal Last 10 Errors</title>
<search>
<query>index=_internal sourcetype=splunkd log_level!=INFO
| bin _time span=1h
| stats count by _time component log_level
| head 10</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
Alternative to above approach you can also move the following CSS code to a static CSS file and refer the same in your dashboard, after uploading to appserver/static folder. As stated earlier the table ID used in the following example is tableWithCSSToAlignHeaderText :
#tableWithCSSToAlignHeaderText table thead th.numeric,#tableWithCSSToAlignHeaderText table tbody tr td.numeric{
text-align:left !important;
}
... View more
05-17-2018
01:29 PM
Correct. The wizard has a page specifically for configuring authentication. It accepts a URL for the login page since it may not be the same page you want to monitor.
... View more
04-10-2018
12:56 AM
Glad to hear that. You're welcome 🙂
I changed my original comment to an answer.
... View more
04-03-2018
05:58 AM
Hello there,
many answers in this portal, here are couple:
https://answers.splunk.com/answers/4279/timezone-and-timestamp-modification-at-search-report-time.html
https://answers.splunk.com/answers/58027/change-timezone-of-logs.html
also in docs:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Applytimezoneoffsetstotimestamps
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Commontimeformatvariables
if it only apply to you as a user, you can change your user default time zone to EST and you supposed to see timestanps as EST
hope it helps
... View more
02-27-2018
11:10 AM
1 Karma
Since both your searches return single row, you can also do these:
index=a sourcetype=a | stats count as queue | eval Name="PA" | table Name queue count | appendcols [ search index=b sourcetype=b | stats count as count]
OR
index=a sourcetype=a | stats count as queue | eval Name="PA" | table Name queue count | eval count=[ search index=b sourcetype=b | stats count as search]
As @adonio suggested, these merging both queries into one would be optimal solution, as compared to all of the above solution with subsearches.
... View more
02-19-2018
10:13 AM
Thank you again! I have everything I need now. Have a nice day! 🙂
... View more
01-10-2018
05:25 AM
Hi kdimaria,
Usually Splunk dashboards are in XML, but in the above way it's possible to insert in XML a css element without modifying css.
Using Javascripts, it's possible to modify panels width not column width, to modify column width the only way is css.
Bye.
Giuseppe
... View more
11-17-2017
07:02 AM
@kdimaria, Glad it worked. If your entire team specializes in HTML dashboard then it is great. You will open up your dashboard to all the possibilities you can imagine 🙂
... View more
11-14-2017
08:27 AM
I figured this out but can't delete the question. I forgot to add the visualization with mvc. it fixed the problem.
... View more
11-09-2017
05:34 AM
Simple XML will get you out of most of complicated situations through CSS Extension, JavaScript Extension and Splunk JS Stack. Once you switch to HTML you have complete control of your dashboard and virtually you open up Splunk Dashboard for full fledged web development. However, you have to be really get used to the "extra line of code" (which were abstract in Simple XML). With that trade off in mind. Code as much as possible in Simple XML and switch to HTML only if unavoidable or when dashboard is stable and almost final.
... View more
02-06-2019
12:51 AM
Hi Experts,
Kindly answer my below scenario.
I have search query it displays five columns(c1,c2,c3,c4,c5).If i click on C3 column any record pop dashboard should display and C3 column value should pass as input to that dashboard.
Thanks in adavance
... View more
11-02-2017
06:02 AM
@kdimaria, I am not sure if it fits but have you tried Table Row Expansion example on Splunk Dashboard Examples App ?
... View more
10-13-2017
07:24 AM
Hi kdimaria,
you could try something like this (if my_time is the field name in your logs but not _time):
| eval field=if(my_time>earliest AND my_time<latest,new calculation, old calculation)
Bye.
Giuseppe
... View more
10-03-2017
09:19 AM
Hi,
Yes, I get what you mean - high(pred) and low(pred) ae missing. However, try this :
timechart span=5min avg(p) as Act |predict Act AS pred algorithm=LLP5 upper95=high lower95=low holdback=30 future_timespan=70 | eval pred=if(isnull(Act),pred,Act) |rename high(pred) AS X|fields _time,Act,X,pred
You will get X plotted as the high limit values.///apply same and rename low(pred) to Y .
Choose X and Y names as something like hmmm maybe - "High / Low Limit"
I use he MLTK app like @niketnilay is saying....
... View more
09-07-2017
05:12 AM
Thank you! I think I understand now. the period was just very confusing.
... View more
08-30-2017
03:42 PM
1 Karma
Then you can add this:
| eval Message1=mvindex(message, 0)
| eval Message2=mvindex(message, 1)
| eval Message3=mvindex(message, 2)
| eval Message4=mvindex(message, 3)
| eval Message5=mvindex(message, 4)
... View more
08-30-2017
10:21 AM
Thank you this worked 🙂
... View more
07-24-2019
05:59 PM
Have you checked that the fields are spelled correctly and capitalized properly and the field value is also correctly spelled/capped? I know it’s silly but it’s critical. The fields and values need to exist and need to be exact. Do you have example data?
... View more
01-09-2019
08:15 AM
@lianlim
So what I was trying to do was have a table with an "Alert" column so that people could add alerts to a specific part in the table. Each row was an application that was being monitored then we wanted people to be able to add alerts to applications if needed. So I used a Jquery Dialog to create the prompt to get information to add to the alert column but a Javascript prompt also works:
element1.on("click", function(e) {
e.preventDefault();
if(e.field == "Alert"){
e.preventDefault();
var appname = e.data["row.App"];
var type = "User";
var dialog = $('<p>Enter an alert note for <b>' + appname + '</b> or clear the previous alert note. </p>').dialog({
position: myPos,
buttons: {
"Enter Alert Note": function(){
var note = prompt("Enter alert note for '" + appname + "'","");
var username = prompt("Enter Your Name: ", "");
if(note && username){
notesearch.settings.attributes.search = "| makeresults | eval Notes=\"" + note + "\" | eval application=\"" + appname + "\" | eval type=\"" + type + "\" | eval name=\"" + username + "\" | collect index=splunk-test source=app_alerts";
notesearch.startSearch();
setTimeout(function(){search1.startSearch();},2000);
$(this).dialog("close");
}
$(this).dialog("close");
},
"Clear Previous Note": function(){
notesearch.settings.attributes.search = "| makeresults | eval application=\"" + appname + "\" | eval type=\"" + type + "\" | collect index=splunk-test source=app_alerts";
notesearch.startSearch();
setTimeout(function(){search1.startSearch();},2000);
$(this).dialog("close");
}
},
width:350
}).css("font-size", "15px");
}
So I added a click event for the table and when the user clicked on the "Alert" field they would be prompted to enter an alert note for the application (row) that they clicked on. I used makeresults to set all the values I needed from the variables gathered from the dialog and the collect command to save my alerts in a certain index and source so that when the search for the table runs again it will pick up the alert. I just created a blank searchelement called notesearch and changed it to run the search i needed. So my main table search does a join on application and retrieves the latest alert from the app_alerts source so that it is displayed on the table after refreshing. Hope this helps.
... View more
