Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About rrovers
rrovers
Contributor
Member since:
09-04-2017
11-21-2025
Community Statistics
| Posts | 90 |
| Solutions | 8 |
| Karma Given | 137 |
| Karma Received | 17 |
| Member Since | 09-04-2017 |
Activity Feed
- Karma Re: "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk." error after upgrade to Splunk 6.0.1 for sideview. 11-21-2025 05:45 AM
- Karma Re: Why aren't defined field transformations showing in the GUI? for twinspop. 09-09-2025 04:40 AM
- Karma Re: Why am I unable to append a lookup table with OUTPUTLOOKUP? for esmonder. 04-06-2025 11:35 PM
- Posted Re: Alert is triggered while condition "if number of events is greater than 0" not met on Splunk Search. 02-16-2025 10:28 PM
- Posted Alert is triggered while condition "if number of events is greater than 0" not met on Splunk Search. 02-12-2025 01:21 AM
- Karma Re: Sorting Charts for martin_mueller. 11-25-2024 11:38 PM
- Karma Re: How to set the default value of an input number field to current day's date in Dashboard? for Sharma21. 11-13-2024 05:06 AM
- Posted Re: How can I make the size of tables in splunk studio flexible? on Splunk Enterprise. 10-21-2024 10:06 PM
- Karma Re: How can I make the size of tables in splunk studio flexible? for tej57. 10-21-2024 10:06 PM
- Posted How can I make the size of tables in splunk studio flexible? on Splunk Enterprise. 10-21-2024 07:05 AM
- Tagged How can I make the size of tables in splunk studio flexible? on Splunk Enterprise. 10-21-2024 07:05 AM
- Karma Sound alerts in dashboard studio for Amith55555. 10-21-2024 06:57 AM
- Karma Re: Dashboard Studio search options for richgalloway. 10-15-2024 11:40 PM
- Posted Re: Is it possible to avoid a next button on a dashboard? on Dashboards & Visualizations. 10-15-2024 11:38 PM
- Posted Re: Where can I locate Dashboard Studio search options? on Splunk ITSI. 10-08-2024 06:18 AM
- Karma Where can I locate Dashboard Studio search options? for joock3r. 10-08-2024 06:17 AM
- Posted Re: Is it possible to avoid a next button on a dashboard? on Dashboards & Visualizations. 08-13-2024 10:01 PM
- Posted Is it possible to avoid a next button on a dashboard? on Dashboards & Visualizations. 08-13-2024 05:56 AM
- Posted Re: Export is disabled on panels- How do I enable? on Other Usage. 08-09-2024 02:38 AM
- Karma Re: Where can I change the maximum of the event length to prevent that events are truncated at index-time for tej57. 06-09-2024 11:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-16-2025
10:28 PM
@kiran_panchavat , thanks but it's still not clear to me. Do you mean this sentence in the solution you gave ? "Alerts are triggered if the specified search yields a non-empty search result list." It still looks like a bug to me or at least it's very unclear.
... View more
02-12-2025
01:21 AM
I made a savedsearch with a simple search in it. As a condition I selected "if number of events" "is greater than" with the value "0" although no events are selected the alert is triggered and an email is set. Does anyone else also have this problem? There is a workaround to use "if condition is met" but it doesn't seem logical to me that the option "if number of events" doesn't work properly.
... View more
10-21-2024
10:06 PM
Hi @tej57, Thanks for your answer. Hope this functionality will be realised soon. It's a reason for us to keep using the classic version for most of the dashboards.
... View more
10-21-2024
07:05 AM
We use splunk for creating reports. When I insert a table in dashboard studio I have to define a width and height for it. But the height should be different for each period we run the dashboard because the number of rows can be different per period. How can I do this without changing the layout every month?
... View more
- Tags:
- studio
Labels
- Labels:
-
using Splunk Enterprise
10-15-2024
11:38 PM
In dashboard studio there seems to be no limit and no next-button. Also the pdf shows all the rows so that's a way to solve it.
... View more
10-08-2024
06:18 AM
Same problem here, it's difficult to find how a simple option like option name=count works in studio. I want to display more than 100 rows without a next button. After searching in studio dashboard found it and indeed it is simple. Data display - rows displayed
... View more
08-13-2024
10:01 PM
Hi @isoutamo, I've tried an option more than 100 but then I get directly an error in the dashboard and I can't save it. The problem is not only an export to pdf but also in the dashboard itself there is a "next" button. So I think the app "betterpdf" can't solve this.
... View more
08-13-2024
05:56 AM
I use a stats command in a search in a dashboard which results in about 600 rows. Splunk places a "next" button in the dashboard for each 100 rows (option name="count" is 100). We deliver the result of this dashboard as a pdf so much of the results get lost. I can solve this by using "streamstats" to show the result in parts but I wonder why the limit is 100 and if it is possible to display more than 100 rows at once (without using tricks like streamstats).
... View more
Labels
- Labels:
-
Classic dashboard
08-09-2024
02:38 AM
Hi @gcusello, have you any idea what the reason is for (the lack of) this option and do you know if there are plans to adjust this?
... View more
06-04-2024
11:25 PM
Events longer than 15.000 characters are truncated now. We wonder if there is a limit for this (so for example in the configuration the maximum event length can't be set to a number higher than 50.000). Where and how can we change this limit for a certain index.
... View more
05-23-2024
05:46 AM
Hi, I have a json-file in splunk with an arguments{}-field like this field1=[content_field1] field2=[content_field2] field3=[content_field3] splunk doesn't recognize the fields field1 etc. I assume it is because this is not really json format but I want to be sure. I can extract the files with rex but if splunk can recognize the fields automatically would be better. I think the content of the log-file should be something like this: arguments{}:{"field1":"content_field1",
"field2":"content_field2",
"field3:"content_field3"} but I want to be sure if that's the best way (because when it is the logging has to be changed). Does splunk recognize the fields automatically if events are logged in this way? Is the above mentioned the best way or are there better ways to let splunk recognize the fields automatically?
... View more
Labels
- Labels:
-
field extraction
04-26-2024
06:20 AM
My search ends with: | table Afdeling 20* Voorlaatste* Laatste* verschil It has several detail rows and 1 row with totals. I want to use fillnull for the totals for the 20* columns (2023-10, 2023-11 etc.) but not for Voorlaatste* Laatste* and verschil. I can't use | fillnull 20* value="0.0" because that adds a column "20*" and I don't want to use fillnull 2023-10 etc. Is there a way to do this?
... View more
01-09-2024
10:42 PM
Later we have used an app named decrypt2 and it worked for us with this syntax: | decrypt field=randomfield atob emit('randomfielddecrypt')
... View more
11-03-2023
12:16 AM
Do you mean this: index=dev | rex field=_raw "\b(?(java|javax).[\w.]+Exception)"
| timechart span=30d count by exception_type for graphics choose "Visualisations"
... View more
08-22-2023
08:22 AM
There is 1 token in it but that doesn't seem to be the problem. I solved it now by using a join in stead of index=1... OR index=2.. and that seems to work fine (I know, using a join is not advised). So index=1... join type=inner id [search index=2..] I don't know why the "OR" doesn't work. Maybe caused by a lot of events (2,7 mln for the first index). But that is also the case with other organisations that do give a result.
... View more
08-21-2023
01:07 AM
1 search in a dashboard ends with "waiting for data" for 3 of about 300 organisations. The organisation-name is part of the url. The search ends correctly for most of the organisations.
After refreshing the search (in the dashboard) or clicking on the magnifying glass the result of the search is shown. Job inspection gives no error.
Any idea why what can be the reason that the result is not shown in the dashboard directly?
... View more
Labels
- Labels:
-
data
08-07-2023
10:31 PM
@burwell, this was around the time we migrated to splunk 9 but I think this was still in splunk version 8.x.x.
... View more
06-13-2023
02:49 AM
Hi @kamlesh_vaghela, It's based on your example: dashboard: <dashboard version="1.1" script="convert_to_html.js">
<label>HTML from SPL</label>
<search>
<query>
| makeresults
| eval data="<b>Network Map One </b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br>"
, data1="<b>Network Map Two</b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br>"
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="tokHTML">$result.data1$</set>
</done>
</search>
<row>
<panel>
<html>
<div id="htmlPanelWithToken">
$tokHTML$
</div>
</html>
</panel>
</row>
</dashboard> jscript: require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
],
function ($, mvc,)
{ var mySearch = mvc.Components.get("mySearch");
var mySearchResults = mySearch.data("results");
mySearchResults.on("data", function () {
resultArray = mySearchResults.data().rows; var generateHTMLContent = "";
$("#htmlPanelWithToken").html(generateHTMLContent);
// Iterate Result set
$.each(resultArray, function (index, value)
//{ console.log(index, value)
console.log(index, value[0])
console.log(index, value[1])
console.log(index, value[2])
//Create proper HTML content from result
generateHTMLContent = "<table><tr><td>" + value[1] + "</td><td>" + value[2] + "</td></tr></table>";
// value[1] = data field
// value[2] = data1 field
console.log(generateHTMLContent);
})
$("#htmlPanelWithToken").html(generateHTMLContent);
});
});
... View more
06-13-2023
12:42 AM
maybe this wil help?: <form version="1.1">
<label>tmp-pr-tags</label>
<fieldset>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>Selecteer een PR_Tag:</label>
<choice value="*">PR_Tags...</choice>
<search>
<query>
<![CDATA[
index=main sourcetype=csv source=result_test.csv
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
]]>
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>PR_Tags</fieldForLabel>
<fieldForValue>PR_Tags</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<title>PR_Tags</title>
<table>
<search>
<query>
index=main sourcetype=csv source=result_test.csv
| where PR_Tags="$dropdown_tok$"
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
</query>
</search>
<option name="count">50</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
... View more
06-12-2023
11:50 PM
Hi @kamlesh_vaghela, Thanks for your answer. I copied the source to a dashboard, added the token: <div id="htmlPanelWithToken">
$tokHTML$
</div> and loaded the javascript but the result is not as I expected, namely: <b>Network Map Two</b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br> I expect something like: Network map 2 Device 1:... Device 2:... Is there something wrong in the code or are my expecations not right?
... View more
05-31-2023
04:43 AM
With https://community.splunk.com/t5/Dashboards-Visualizations/Render-HTML-code-from-search-result-in-Splunk-dashboard/m-p/221940 I managed to display the (html) content in 1 field in readable format.
This solution works fine for 1 field at a time (logically, because it's using a token). I want to display all the fields in a dashboard in that format. I can't find out how to do that.
Besides that it's hard to find usefull information to use javascript in combination with splunk but maybe that's because I'm relatively new in using javascript and probably using the wrong keywords. Anyone some suggestions?
... View more
Labels
- Labels:
-
dashboard
-
javascript
-
table
05-04-2023
02:50 AM
I had the same issue. It was caused by a long saved search name. After cloning it too a shorter one it worked well. Thanks to the contributors of https://community.splunk.com/t5/Reporting/When-I-clicked-quot-view-results-quot-on-alert-mail-quot-The/m-p/303643
... View more
04-25-2023
07:48 AM
I've made a dashboard which uses tokens to determine if all searches are ready (ready1, ready2 etc).
If all tokens are set a message is displayed that the dashboard is ready.
When I open the dashboard and choose a value from the picklist sometimes all the tokens are set and sometimes a few are not set. So for example action 1: open dashboard, choose value from picklist, value ready1 is set and for example ready8 is not. Action 2 open the same dashboard choose the same value from picklist. ready1 is not set, ready8 is set and ready10 is not set. So exactly the same action with different results.
Does anyone know a solution for this? Maybe something to do with caching?
... View more
Labels
- Labels:
-
dashboard
03-17-2023
01:51 AM
1 Karma
Answering my own question: Syntax is like this: | code field=randombase64field method=base64 action=decode destfield=test unfortunately it doesn't decode diacritics correctly. Does someone have a solution for that? Apps that worked fine in splunk 8 don't seem to work correct in splunk 9.
... View more
03-13-2023
05:19 AM
After installing splunk 9 we have a problem with decoding ldap-events. We tried several apps but none of them gave us correct results.
We wanted to use the app "Encode / Decode Data for Splunk" but we can't find any instructions of how to use it.
Does anyone have experience with base64 decoding in splunk 9?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-21-2025
05:45 AM
|
Karma from
