Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rrovers
rrovers
Communicator
Member since:
09-04-2017
Thursday
Community Statistics
| Posts | 76 |
| Solutions | 8 |
| Karma Given | 110 |
| Karma Received | 15 |
| Member Since | 09-04-2017 |
Activity Feed
- Posted Re: Search in dashboard ends with "waiting for data" on Getting Data In. 08-22-2023 08:22 AM
- Posted Why is Search in dashboard ending with "waiting for data"? on Getting Data In. 08-21-2023 01:07 AM
- Karma Re: show no results message in the dashboard if post panel search return zero results for woodcock. 08-17-2023 07:05 AM
- Karma Re: replace field name with variable month value for ITWhisperer. 08-10-2023 03:02 AM
- Posted Re: why i am getting this error "The search you requested could not be viewed" on Getting Data In. 08-07-2023 10:31 PM
- Karma Re: How to extract the value before a specific character using regex or rex? for mayurr98. 06-29-2023 07:36 AM
- Karma Re: How can I display the html in a field as separate fields? for kamlesh_vaghela. 06-15-2023 02:30 AM
- Posted Re: How can I display the html in a field as separate fields? on Dashboards & Visualizations. 06-13-2023 02:49 AM
- Posted Re: How to join rows to compare values? on Dashboards & Visualizations. 06-13-2023 12:42 AM
- Posted Re: How can I display the html in a field as separate fields? on Dashboards & Visualizations. 06-12-2023 11:50 PM
- Posted How can I display the html in a field as separate fields? on Dashboards & Visualizations. 05-31-2023 04:43 AM
- Posted Re: why i am getting this error "The search you requested could not be viewed" on Getting Data In. 05-04-2023 02:50 AM
- Karma Re: File will not be read, seekptr checksum did not match for a file in splunk for codebuilder. 04-28-2023 07:47 AM
- Posted Tokens are sometimes set and sometimes they're not set when changing picklist value? on Dashboards & Visualizations. 04-25-2023 07:48 AM
- Karma How to unset token if I choose other values from dropdown for spisiakmi. 04-19-2023 06:32 AM
- Karma Re: How to unset token if I choose other values from dropdown for vnravikumar. 04-19-2023 06:32 AM
- Karma Re: Remove rows without result from timechart count query for niketn. 04-19-2023 12:55 AM
- Karma How to change font size of a table in Dashboard Studio? for TheBravoSierra. 03-22-2023 03:05 AM
- Karma Dashboard Studio - Column Data keeps getting detected by a number which cuts off any leading zeroes? for austindodig. 03-22-2023 02:01 AM
- Posted Re: base64 decoding problem in Splunk 9? on Splunk Search. 03-17-2023 01:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-22-2023
08:22 AM
There is 1 token in it but that doesn't seem to be the problem. I solved it now by using a join in stead of index=1... OR index=2.. and that seems to work fine (I know, using a join is not advised). So index=1... join type=inner id [search index=2..] I don't know why the "OR" doesn't work. Maybe caused by a lot of events (2,7 mln for the first index). But that is also the case with other organisations that do give a result.
... View more
08-21-2023
01:07 AM
1 search in a dashboard ends with "waiting for data" for 3 of about 300 organisations. The organisation-name is part of the url. The search ends correctly for most of the organisations.
After refreshing the search (in the dashboard) or clicking on the magnifying glass the result of the search is shown. Job inspection gives no error.
Any idea why what can be the reason that the result is not shown in the dashboard directly?
... View more
Labels
- Labels:
-
data
08-07-2023
10:31 PM
@burwell, this was around the time we migrated to splunk 9 but I think this was still in splunk version 8.x.x.
... View more
06-13-2023
02:49 AM
Hi @kamlesh_vaghela, It's based on your example: dashboard: <dashboard version="1.1" script="convert_to_html.js">
<label>HTML from SPL</label>
<search>
<query>
| makeresults
| eval data="<b>Network Map One </b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br>"
, data1="<b>Network Map Two</b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br>"
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="tokHTML">$result.data1$</set>
</done>
</search>
<row>
<panel>
<html>
<div id="htmlPanelWithToken">
$tokHTML$
</div>
</html>
</panel>
</row>
</dashboard> jscript: require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
],
function ($, mvc,)
{ var mySearch = mvc.Components.get("mySearch");
var mySearchResults = mySearch.data("results");
mySearchResults.on("data", function () {
resultArray = mySearchResults.data().rows; var generateHTMLContent = "";
$("#htmlPanelWithToken").html(generateHTMLContent);
// Iterate Result set
$.each(resultArray, function (index, value)
//{ console.log(index, value)
console.log(index, value[0])
console.log(index, value[1])
console.log(index, value[2])
//Create proper HTML content from result
generateHTMLContent = "<table><tr><td>" + value[1] + "</td><td>" + value[2] + "</td></tr></table>";
// value[1] = data field
// value[2] = data1 field
console.log(generateHTMLContent);
})
$("#htmlPanelWithToken").html(generateHTMLContent);
});
});
... View more
06-13-2023
12:42 AM
maybe this wil help?: <form version="1.1">
<label>tmp-pr-tags</label>
<fieldset>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>Selecteer een PR_Tag:</label>
<choice value="*">PR_Tags...</choice>
<search>
<query>
<![CDATA[
index=main sourcetype=csv source=result_test.csv
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
]]>
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>PR_Tags</fieldForLabel>
<fieldForValue>PR_Tags</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<title>PR_Tags</title>
<table>
<search>
<query>
index=main sourcetype=csv source=result_test.csv
| where PR_Tags="$dropdown_tok$"
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
</query>
</search>
<option name="count">50</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
... View more
06-12-2023
11:50 PM
Hi @kamlesh_vaghela, Thanks for your answer. I copied the source to a dashboard, added the token: <div id="htmlPanelWithToken">
$tokHTML$
</div> and loaded the javascript but the result is not as I expected, namely: <b>Network Map Two</b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br> I expect something like: Network map 2 Device 1:... Device 2:... Is there something wrong in the code or are my expecations not right?
... View more
05-31-2023
04:43 AM
With https://community.splunk.com/t5/Dashboards-Visualizations/Render-HTML-code-from-search-result-in-Splunk-dashboard/m-p/221940 I managed to display the (html) content in 1 field in readable format.
This solution works fine for 1 field at a time (logically, because it's using a token). I want to display all the fields in a dashboard in that format. I can't find out how to do that.
Besides that it's hard to find usefull information to use javascript in combination with splunk but maybe that's because I'm relatively new in using javascript and probably using the wrong keywords. Anyone some suggestions?
... View more
Labels
- Labels:
-
dashboard
-
javascript
-
table
05-04-2023
02:50 AM
I had the same issue. It was caused by a long saved search name. After cloning it too a shorter one it worked well. Thanks to the contributors of https://community.splunk.com/t5/Reporting/When-I-clicked-quot-view-results-quot-on-alert-mail-quot-The/m-p/303643
... View more
04-25-2023
07:48 AM
I've made a dashboard which uses tokens to determine if all searches are ready (ready1, ready2 etc).
If all tokens are set a message is displayed that the dashboard is ready.
When I open the dashboard and choose a value from the picklist sometimes all the tokens are set and sometimes a few are not set. So for example action 1: open dashboard, choose value from picklist, value ready1 is set and for example ready8 is not. Action 2 open the same dashboard choose the same value from picklist. ready1 is not set, ready8 is set and ready10 is not set. So exactly the same action with different results.
Does anyone know a solution for this? Maybe something to do with caching?
... View more
Labels
- Labels:
-
dashboard
03-17-2023
01:51 AM
Answering my own question: Syntax is like this: | code field=randombase64field method=base64 action=decode destfield=test unfortunately it doesn't decode diacritics correctly. Does someone have a solution for that? Apps that worked fine in splunk 8 don't seem to work correct in splunk 9.
... View more
03-13-2023
05:19 AM
After installing splunk 9 we have a problem with decoding ldap-events. We tried several apps but none of them gave us correct results.
We wanted to use the app "Encode / Decode Data for Splunk" but we can't find any instructions of how to use it.
Does anyone have experience with base64 decoding in splunk 9?
... View more
Labels
- Labels:
-
other
02-06-2023
11:07 PM
My search:
| makeresults earliest=-2h
| timechart count as aantal span=1m
returns a list of zero's but for the last/current minute it returns "1". I only want zero's back to combine this search with a timechart.
After combining these searches (makeresults and timechart) there should be no message "no values found" anymore. What do I have to change to have only zero's as a result of my makeresults search?
... View more
Labels
- Labels:
-
timechart
01-05-2023
01:34 AM
I'm not sure if I understand your problem exactly. I think it's not possible to schedule a cron job only on working days. You could run a job on every first 3 days of the month and check in your search if this is a working day. | makeresults
| eval day=strftime(_time,"%a")
| eval aantal=if(day="Mon" OR day ="Tue" OR day="Wed" OR day="Thu" OR day="Fri","0","1")
| append
[ search index=_internal + your search criteria to find if the job has run
| stats count AS aantal]
| stats sum(aantal) In the alert you could set the option to send an email if number of events is 0. If this doesn't solve your problem please give some more details (I don't understand the function of your lookup file, is that just an overview or do you want to run from that lookup or something?, the latter is not possible I think).
... View more
01-03-2023
05:42 AM
Is it an option to make an alert that checks the _internal index at the alert time if the job has run. If result is 0 then send an email.
... View more
12-29-2022
02:36 AM
1 Karma
I don't know what's exactly in your index but this works: |makeresults
|eval end_date="10112022"
| eval created_date="12112022"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y")
| eval created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date If this doesn't solve your problem please give some more information
... View more
07-28-2022
02:35 AM
1 Karma
| makeresults
| eval ID="t1023"
| eval IDlen=len(ID)
| eval IDlen2=IDlen-2
| eval IDtest=substr(ID,IDlen2)
| table IDtest
... View more
07-28-2022
12:23 AM
You can use mvexpand to make multiple events from 1 and mvcombine to make 1 event from multiple. I've used makeresults to be able to check my dashboard. Not exactly what you want but hopefully it wil give you a hint how to solve this. <dashboard>
<label>Test filesize</label>
<fieldset>
<input type="dropdown" token="size_tk_from" searchWhenChanged="true">
<label>File Size from:</label>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">500M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
</input>
<input type="dropdown" token="size_tk_to" searchWhenChanged="true">
<label>File Size to:</label>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">500M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
<![CDATA[
| makeresults
| eval filesize="2G,500M,200M,50M,1G"
| eval filesize=replace(filesize,"50M","50000")
| eval filesize=replace(filesize,"200M","200000")
| eval filesize=replace(filesize,"500M","500000")
| eval filesize=replace(filesize,"1G","1000000")
| eval filesize=replace(filesize,"2G","2000000")
| makemv delim="," filesize
| mvexpand filesize
| where filesize>$size_tk_from$ AND filesize<$size_tk_to$
| table filesize
| sort filesize
| eval filesize=replace(filesize,"500000","500M")
| eval filesize=replace(filesize,"50000","50M")
| eval filesize=replace(filesize,"2000000","2G")
| eval filesize=replace(filesize,"200000","200M")
| eval filesize=replace(filesize,"1000000","1G")
| table filesize
]]>
</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</search>
</table>
</panel>
</row>
</dashboard>
... View more
07-27-2022
04:35 AM
maybe something like this? <dashboard>
<label>Test filesize</label>
<fieldset>
<input type="dropdown" token="size_tk_from" searchWhenChanged="true">
<label>File Size from:</label>
<choice value="*">ALL</choice>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">500M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="size_tk_to" searchWhenChanged="true">
<label>File Size to:</label>
<choice value="*">ALL</choice>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">50M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
<![CDATA[
index=tech_filesystem
| makemv delim="," filesize
| where filesize>$size_tk_from$ AND filesize<$size_tk_to$
| stats count by filesize
]]>
</query>
<earliest>rt-1m</earliest>
<latest>rt</latest>
</search>
</table>
</panel>
</row>
</dashboard>
... View more
07-27-2022
02:58 AM
Maybe I don't understand your question quit right but if you are looking for a list of files between 2 values you could make an extra token and use this search: index=tech_filesystem
| makemv delim="," filesize
| where filesize>$size_tok_from$ AND filesize<$size_tok_to$
| stats count by filesize
... View more
07-27-2022
01:57 AM
2 Karma
add NOT "INTERNAL_SERVER_ERROR" so: index=abc ns=blazegateway ERROR NOT "INTERNAL_SERVER_ERROR"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
Karma from
Karma given to
