About davebrooking

davebrooking · ‎11-21-2014

Given the limited information you've provided and I don't have a Splunk instance to hand - try something like | inputlookup CustomLookupTable | join type=outer name [search eventtype=Eventtype1] | ...

davebrooking · ‎11-21-2014

Not really as I said I don't understand what you're trying to achieve. I need more details. What is your current search?

davebrooking · ‎11-21-2014

I don't really understand what you're trying to achieve, but the inputlookup command should give you the output you've described. | inputlookup CustomLookupTable However, I suspect that isn't really you're requirement. I would probably start by trying to use the inputlookup command to read in the lookup as the start of the search, and then use a join type=outer with your search of eventtype=Eventtype1 as the subsearch within the join. You may also find the fillnull command useful if you need to give values to fields which are null in the output.

davebrooking · ‎11-19-2014

My understanding is that all events should be indexed irrespective of whether the event contains a field that Splunk can identify as timestamp or not. The indexing process goes through a number of steps to try and identify which date/time to use, the process is described in the documentation. Your 'missing' events may have a timestamp of when the input was indexed by Splunk, which according to the documentation is the timestamp of last resort. There are also other settings in the conf files that may affect whether indexing can detect your timestamps, many of which are shown in the pages following the above documentation reference. If the date in your event is null, what timestamp would you like it to be associated with the event? Should it be the time the event was indexed? Can you also post an example of an event that is missing the date field? Is the date stayed field populated or not?

davebrooking · ‎11-15-2014

I think you're right - I should have used coalesce

davebrooking · ‎11-13-2014

I think your field is being ingested by Splunk as a null value, It's just that displaying the raw data in Splunk doesn't show NULL in the same way as the SSMS interface does. You can make the field appear as NULL in a search by using an eval statement, something like ... | eval fieldname=if(isnull(fieldname),"NULL",fieldname) | ... The eval won't change the raw data, it'll just change that field's value for the rest of the search. Do you really want to manipulate the raw data before indexing it? Personally, I'd need a really good reason to do that in Splunk, as it can adversely affect indexing performance. There is a section in the Getting Data In documentation regarding anonymizing data that allows data to be manipulated prior to indexing, you should be able to use that method if you really must.

davebrooking · ‎11-13-2014

Take a look at the eval coalesce function - as the documentation states This function takes an arbitrary number of arguments and returns the first value that is not null.

davebrooking · ‎11-12-2014

I'm not sure I'm totally understanding your question. What is your SQL statement? What should appear in the Splunk output if the int column is zero? Could you use the SQL COALESCE function on the int column that's being returned to set it to a value - maybe zero, and add this to your lookup table?

davebrooking · ‎11-04-2014

If the format of the filename is not a fixed number of period separated names, you could use something like SourceFile\=(?P<yourfield>(\w+|\.)+?)(|\.\w*B00)\sDestFile\=

davebrooking · ‎11-04-2014

I think this question relates to the old Google Maps app From the documentation on Apps - All available options to the module can be found at the module reference at your Splunk instance at http://localhost:8000/modules#Splunk.Module.GoogleMaps I think the parameter name needed to control zooming is zoomLevel If I've got it totally wrong what version of Splunk are you running?

davebrooking · ‎11-04-2014

Is there something missing from the rex command you posted in query1 in the original question? I think the supplied answer is trying to use the same rex command as shown in query 1 from the original question.

davebrooking · ‎11-04-2014

Sorry, I was using the concept from this answer, but had no Splunk instance to test on. I've since had a chance to try the technique on a small subset of data and noticed quite sizeable differences in execution time depending on whether you use stats count or gentimes start=-1 at the start of the subsearch with return or table as the last command in the subsearch. I'm getting consistently better execution times using sourcetype=abc [|stats count | eval source="*"+strftime(now(),"%Y%m%d")+"*" | table source]

davebrooking · ‎11-03-2014

What if you try adding the specific field name to the search - something like sourcetype=abc source=[|gentimes start=-1 | eval source=""+strftime(now(),"%Y%m%d")+"" | return source] Does that improve the performance?

davebrooking · ‎10-31-2014

Is the disabled attribute really set to 1? If it is then the input is marked as disabled. It needs to be set to 0 (zero) for the input to be enabled.

davebrooking · ‎10-30-2014

davebrooking · ‎10-28-2014

I think the streamstats command is what you may need to use to rank the events - take a look at this answer, I believe it should point you in the right direction Dave

davebrooking · ‎09-11-2014

I know the question specifically states a html dashboard, but I've used the following javascript detailed in this answer with Simple XML using Splunk 6.1.1 - could it also be applied to a HTML dashboard? http://answers.splunk.com/answers/149563/simple-xml-display-2-panels-in-a-row-with-different-widths Dave

davebrooking · ‎09-10-2014

A further test and this time the restart didn't resolve the issue. However, I was able to overtype the 2001 with 2014 in the date box and I also used the calendar pop up to select the appropriate date. This appears to have resolved the issue and I can search on the correct timerange again, but it all seems a little flakey.

davebrooking · ‎09-10-2014

I've just replicated the 2001 search phenomenon on Splunk 6.1.1. I entered a date of 20014 by mistake and the search uses 2001 in the timerange. I had to restart Splunk to resolve the problem. Logging in and out of Splunk didn't help in my situation. Dave

davebrooking · ‎09-02-2014

I don't have an instance of Splunk to test on at the moment, but can you sort the data so its order is reversed prior to the delta command?

davebrooking · ‎08-08-2014

Thanks for the suggestion. This works as expected when the interval is a number of seconds, but doesn't work if the interval is a cron schedule e.g. * 1 * * * . I tested in a 6.1.1 Splunk instance.

davebrooking · ‎08-08-2014

Is it possible to find the time of the next scheduled run of a scripted input from within Splunk? The Searches, reports and alerts in Settings has a column for Scheduled time, which appears to be the time of the next execution of the item. In the S.o.S app the Data Inputs Overview dashboard there are fields for endtime and interval when you select a specific input, and using these I could calculate the next scheduled run time. Similarly the endtime and interval fields are available with the REST API data/inputs/script. The calculation is quite simple when the interval is a number of seconds but is more difficult when the interval is provided as a cron schedule. I was looking for a solution that returned something like the Scheduled time field from the Searches, reports and alerts screen but for scripted inputs. Dave

davebrooking · ‎08-08-2014

For completeness, I thought I'd post the js I ended up using to help other novice web developers. I needed to manipulate the panels in rows 2, 3 and 4 of my dashboard, so the script I've used is require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) { // Grab the DOM for the first dashboard row var panelRow = $('.dashboard-row').first(); // Grab the DOM for the second dashboard row panelRow = $(panelRow).next(); // Get the dashboard cells (which are the parent elements of the actual panels and define the panel size) var panelCells = $(panelRow).children('.dashboard-cell'); // Adjust the cells' width $(panelCells[0]).css('width', '60%'); $(panelCells[1]).css('width', '40%'); // Manipulate the third dashboard row panelRow = $(panelRow).next(); panelCells = $(panelRow).children('.dashboard-cell'); $(panelCells[0]).css('width', '60%'); $(panelCells[1]).css('width', '40%'); // Manipulate the fourth dashboard row panelRow = $(panelRow).next(); panelCells = $(panelRow).children('.dashboard-cell'); $(panelCells[0]).css('width', '60%'); $(panelCells[1]).css('width', '40%'); // Force visualizations (esp. charts) to be redrawn with their new size $(window).trigger('resize'); }); I'm sure the code could be improved, but it works for me. Thanks for the pointer to the "Layout Customization: Panel Width" in the Splunk 6.x Dashboard Examples. Dave

davebrooking · ‎08-06-2014

I had an old version of the Splunk 6.x dashboard examples installed, it doesn't appear to have that particular dashboard. I'll download the new version, and let you know how I get on. Thanks Dave

davebrooking · ‎08-06-2014

First my disclaimer. This is my first attempt at using css/js to manipulate dashboards and I have no grounding as a Web Developer whatsoever. The following is my uneducated interpretation of what I'm seeing. I'm trying to create a Simple XML dashboard in Splunk 6.1 where the panels in a row use different proportions of the row. The first panel I want to use 60% of the row, and the second panel use the remaining 40% of the row. I'm using a Chrome browser, and when I view the html using Inspect element there always seems to be a div statement that sets the width of the last visible dashboard cell to 50% - if there are 3 panels in the row, it sets the width of the last visible cell to 33.33%. <div class="dashboard-cell last-visible" style="width: 50%;"> I've seen some application.css files, from a 4.3 app using Advanced XML, that used the following to set the panels in a row to separate widths .splview-dashboard .panel_row2_col .layoutCell { width: 40% !important; } .splview-dashboard .panel_row2_col .firstCell { width: 60% !important; } In my 2 panel row, the dashboard-cell last-visible setting seems to force the last panel to be 50% of the row, irrespective of other width settings for that row. Is there something similar to the above that I can do in css or js to override the dashboard-cell last-visible setting? I've managed to change a html version of the dashboard to allow the panels in a row to have different widths, this was covered by the example code at http://dev.splunk.com/view/SP-CAAAEVJ, but can this be done in Simple XML, or by using Simple XML Extensions. Dave

Posts	119
Solutions	15
Karma Given	1
Karma Received	60
Member Since	‎09-23-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Is it possible to find when the next scheduled run...

Simple XML - Display 2 panels in a row with differ...

Re: How to include all results from a joined looku...

Re: How to include all results from a joined looku...

Re: How to include all results from a joined looku...

Re: How to write regex to identify and use current...

Re: Why does my int field from mssql database not ...

Re: Why does my int field from mssql database not ...

Re: case and isnull for multiple fields

Re: Why does my int field from mssql database not ...

Re: How to write regex to extract a string, but ig...

Re: Need to add a zoom level and center to google ...

Re: How to combine my two search queries using joi...

Re: Why the function "strftime" not working in my...

Re: Why the function "strftime" not working in my...

Re: Why are Apache logs on a Windows server not fo...

Re: What is the correct search syntax for my join ...

Re: How to get only first 3 events as a result fo...

Re: How to customize the width of panels in an HTM...

Re: Why time range picker on default Splunk 6.1.x ...

Re: Why time range picker on default Splunk 6.1.x ...

Re: How to use delta command to calculate change o...

Re: Is it possible to find when the next scheduled...

Is it possible to find when the next scheduled run...

Re: Simple XML - Display 2 panels in a row with di...

Re: Simple XML - Display 2 panels in a row with di...

Simple XML - Display 2 panels in a row with differ...

Join the Conversation