Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jitendragupta
jitendragupta
Path Finder
Member since:
10-31-2017
07-14-2022
Community Statistics
| Posts | 39 |
| Solutions | 3 |
| Karma Given | 7 |
| Karma Received | 2 |
| Member Since | 10-31-2017 |
Activity Feed
- Karma Re: Diff help please for nabeel652. 06-05-2020 12:50 AM
- Karma Can you help me with an issue I'm having with Splunk DB connect? for harishalipaka. 06-05-2020 12:50 AM
- Karma How do I obtain Splunk Add-on for OPC? for mlewis103125. 06-05-2020 12:50 AM
- Karma Re: Increase the size of a sparkline that is part of a single value visualization. for vnravikumar. 06-05-2020 12:50 AM
- Got Karma for Re: How to drilldown from panel having image to other panel having images ?. 06-05-2020 12:50 AM
- Got Karma for Re: Pie-chart with count from different search criteria. 06-05-2020 12:50 AM
- Karma Re: How can I take Backup of My Saved Searches,Macros and Index Data ? for ajayabburi508. 06-05-2020 12:49 AM
- Karma Re: How can I take Backup of My Saved Searches,Macros and Index Data ? for mayurr98. 06-05-2020 12:49 AM
- Karma Re: How can I get total duration of time for which each user logged in to splunk for this month. for gcusello. 06-05-2020 12:49 AM
- Posted Re: help for calculating a trend in a table panel on Splunk Search. 12-10-2019 01:12 AM
- Posted Re: How to use Time Picker(Time range) in "inputlookup"? on Splunk Search. 08-01-2019 06:37 AM
- Posted Re: Column chart on Splunk Search. 08-01-2019 12:54 AM
- Posted Re: How to add mouse hover to display the details in the dashboard panel? on Dashboards & Visualizations. 07-31-2019 06:16 AM
- Posted Re: How to create an alert for missing value not present in result that its missing in given threshold time on Alerting. 07-30-2019 03:51 AM
- Posted Re: Splunk and Artificial Intelligence on #Random. 07-30-2019 01:16 AM
- Posted Re: help on an hyperlink towards static folder on Dashboards & Visualizations. 07-22-2019 10:59 PM
- Posted Re: Increase max time for a script alert on Splunk Search. 07-19-2019 04:01 AM
- Posted Re: Increase max time for a script alert on Splunk Search. 07-19-2019 03:30 AM
- Posted Re: help to rename automatically random pie label on Splunk Search. 07-19-2019 02:37 AM
- Posted Re: help to rename automatically random pie label on Splunk Search. 07-18-2019 06:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-10-2019
01:12 AM
try this:
index="toto" sourcetype="tutu" assigned_group="titi"
| dedup incident_number
| eval Month=strftime(_time,"%Y-%m")
| stats count by Month
| sort -Month
| delta count as Diff
| eval percentageTrend =(Diff/count)*100
... View more
08-01-2019
06:37 AM
If you want to use earliest and latest mandatorily in your search, push your data to index. In setting -> Add Data -> Upload, select your CSV file. Now _time field value will be the same as timestamp value in your CSV file. After this, select an index or create a new index and add data and start searching.
OR if you want to use inputlookup, use this code at the start of query:
| inputlookup <lookup name>.csv | eval summarydateformat=round(strptime(<time-field>,"%m/%d/%y"),0) | where (summarydateformat >="$time_tok1.earliest$" and summarydateformat <="$time_tok1.latest$")
Replace time-field with the timestamp of your CSV file and time format accordingly. Add a date picker with token name as time_tok1. Add "$time_tok1.earliest$" and "$time_tok1.latest$" in your searches. But in this approach u will not be able to select "last 24 hr", "last 30 days" etc. U can only select To and From date from the date picker.
... View more
08-01-2019
12:54 AM
Do u have a time field in your graph? Time is required to plot your field values in a graph. Please check this code:
<dashboard>
<label>column chart</label>
<row>
<panel>
<chart>
<search>
<query>| makeresults | eval field1=10 | eval field2=16 | eval field3=6 | eval field4=4 | eval time="2019-08-01 13:13"
| append [| makeresults | eval field1=20 | eval field2=5 | eval field3=11 | eval field4=9 | eval time="2019-08-01 14:13"]
| append [| makeresults | eval field1=15 | eval field2=26 | eval field3=17 | eval field4=17 | eval time="2019-08-01 15:13"]
| append [| makeresults | eval field1=26 | eval field2=13 | eval field3=25 | eval field4=26 | eval time="2019-08-01 16:13"]
| eval newfield1=field1+field2 | eval newfield2=field3+field4 | table time newfield1 newfield2</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="charting.fieldColors">{"newfield1": 0x0583F2,"newfield2": 0x05DBF2}</option>
</chart>
</panel>
</row>
</dashboard>
... View more
07-31-2019
06:16 AM
You can accomplish this easily if you convert it to HTML dashboard. The same way I am displaying Percent Speed in my dashboard using the title tag. This formula comes as a tooltip when u hover on the panel. No need for CSS and js. Please check code.
<div id="panel1" class="dashboard-cell" style="width: 25%" title="Percent Speed=TPH (C6) / ROM">
<div class="dashboard-panel clearfix">
<h4 class="panel-title" style=" color:white;text-align: center;" >Plant Optimal Factor</h4>
<div class="panel-element-row">
<div id="element1" class="dashboard-element single" style="width: 100%">
<div class="panel-body"></div>
</div>
</div>
</div>
</div>
... View more
07-30-2019
03:51 AM
You can try like below query. Run this in some cron schedule. If the number of results is greater than zero set an alert.
index=indexname earliest=-2s | where ogid !=abc or ogid !=xyz
... View more
07-30-2019
01:16 AM
You can get many real-time examples here:
https://splunkbase.splunk.com/app/2890/
... View more
07-22-2019
10:59 PM
You have already created a hyperlink. The text "patches" in working as a hyperlink. If you want more you can decorate your hyperlink like this:
<row>
<panel>
<html>
<p>
<a href="http://blogs.bmc.com/wp-content/uploads/2016/06/database-blue.png" target="_blank" style="font-style: oblique; text-decoration: underline;">Patches</a>
</p>
</html>
</panel>
</row>
... View more
07-19-2019
04:01 AM
To avoid this we have throttle option in Splunk. When your alert condition is fired, it will wait for that number of minutes which u have set in the throttle. And only after the throttle period, the next alert is fired. So this will avoid multiple instances of the same script.
... View more
07-19-2019
03:30 AM
Hi, Plz Make it a schedule alert which runs on cron schedule and change its timing to every 30 minutes from Cron Expression. As shown in the screenshot:
... View more
07-19-2019
02:37 AM
If u know all possible values of the process_name, add them together in a case statement.
... View more
07-18-2019
06:32 AM
What does this query give you? ->
index="x" sourcetype="x" | table process_name | dedup process_name
The only output of this query comes as a label in your pie chart.
I am not sure whether aliasing is there or not in Splunk. You can try this manual process:
[| inputlookup host.csv
| table host] index="x" sourcetype="x"
| bucket _time span=3m
| where process_cpu_used_percent>80
| dedup host process_name
| stats count(host) as Total by process_name
| sort -Total limit=10) | eval process_name=if(process_name="mfevtp","McAFEE ",process_name)
... View more
07-18-2019
01:28 AM
Hi @pgadhari. Your requirements can be accomplished in XML by using dropdown, multi-select etc. options But for click action, I have to see this. I'll check and reply to you.
... View more
07-15-2019
10:38 PM
From setting option, convert your dashboard to HTML and then copy the code.
link text
... View more
07-15-2019
05:04 AM
Plz check this output, this is as per your requirement:
| makeresults | eval id="abcd@xxxx" | append [| makeresults | eval id="efgh@xxxx"] | append [| eval id="xyza@xxxx"]
| table id
| join type=outer id![alt text][1] [ | makeresults | eval id="ijk@xxxx" | append [| makeresults | eval id="xyza@xxxx"] | table id ]
... View more
07-15-2019
02:43 AM
My previous answer was for HTML dashboard, not for XML dashboard using HTML tag in it. You have to add that code in javascript section of html code. I have converted yr code to HTML and modified it as per ur requirements. Please check.
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<title>test</title>
<link rel="shortcut icon" href="/en-US/static/@A355AFB27EEAA7F8B8580D369873D5E6410C8A39BE47873A36FD947C3062A3E6/img/favicon.ico" />
<link rel="stylesheet" type="text/css" href="{{SPLUNKWEB_URL_PREFIX}}/static/build/css/bootstrap-enterprise.css" />
<link rel="stylesheet" type="text/css" href="{{SPLUNKWEB_URL_PREFIX}}/static/build/css/splunkjs-dashboard.css" />
<meta name="referrer" content="never" />
<meta name="referrer" content="no-referrer" />
<script>
window._splunk_metrics_events = {
push : function() {},
active: false,}
</script>
</head>
<body class="simplexml preload locale-en" data-splunk-version="7.3.0" data-splunk-product="splunk">
<!--
BEGIN LAYOUT
This section contains the layout for the dashboard. Splunk uses proprietary
styles in <div> tags, similar to Bootstrap's grid system.
-->
<header>
<a aria-label="Screen reader users, click here to skip the navigation bar" class="navSkip" href="#navSkip" tabIndex="1">Skip Navigation ></a>
<div class="header splunk-header">
<div id="placeholder-splunk-bar">
<a href="{{SPLUNKWEB_URL_PREFIX}}/app/launcher/home" class="brand" title="splunk > listen to your data">splunk<strong>></strong></a>
</div>
<div id="placeholder-app-bar"></div>
</div>
<a id="navSkip"></a>
</header>
<div class="dashboard-body container-fluid main-section-body" data-role="main">
<div class="dashboard-header clearfix">
<h2>test</h2>
</div>
<div id="row1" class="dashboard-row dashboard-row1">
<div id="panel1" class="dashboard-cell" style="width: 33.33%;">
<div class="dashboard-panel clearfix">
<h2 class="panel-title">Network</h2>
<div class="panel-element-row">
<div id="element1" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<h3><b><img src="https://www.propylon.com/wp-content/uploads/2018/11/computer-98401_640.png"></b></h3>
</div>
</div>
</div>
</div>
</div>
<div id="panel2" class="dashboard-cell" style="width: 33.33%;">
<div class="dashboard-panel clearfix">
<h2 class="panel-title">Infrastructure</h2>
<div class="panel-element-row">
<div id="element2" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<h3><b><img src="https://www.propylon.com/wp-content/uploads/2018/11/computer-98401_640.png"></b></h3>
</div>
</div>
</div>
</div>
</div>
<div id="panel3" class="dashboard-cell" style="width: 33.33%;">
<div class="dashboard-panel clearfix">
<h2 class="panel-title">Storage</h2>
<div class="panel-element-row">
<div id="element3" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<h3><b><img src="https://www.propylon.com/wp-content/uploads/2018/11/computer-98401_640.png"></b></h3>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="row2" class="dashboard-row dashboard-row2">
<div id="test" class="dashboard-cell" style="width:100%;" data-original-id="test">
<div class="dashboard-panel clearfix">
<div class="panel-element-row">
<div id="element4" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<h1>Network Racks</h1><div><img src="http://www.fiber-optic-solutions.com/wp-content/uploads/2018/09/Cable-Management.jpg"></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="row3" class="dashboard-row dashboard-row3">
<div id="panel4" class="dashboard-cell" style="width:100%;">
<div class="dashboard-panel clearfix">
<div class="panel-element-row">
<div id="element5" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<h1>Infrastructure Racks</h1><div><img src="https://banner2.kisspng.com/20180325/dow/kisspng-computer-servers-19-inch-rack-it-infrastructure-de-server-5ab740e7681c26.8375372715219591434264.jpg"></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="row4" class="dashboard-row dashboard-row4">
<div id="panel5" class="dashboard-cell" style="width: 100%;">
<div class="dashboard-panel clearfix">
<div class="panel-element-row">
<div id="element6" class="dashboard-element html" style="width: 100%">
<div class="panel-body html">
<h1>Storage Racks</h1><div><img src="https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSvdoasC9-31RhU3Zdb6q27m9bVqpjJ_mn3ujrEetfxAftJhiBr"></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<!--
END LAYOUT
-->
<script src="{{SPLUNKWEB_URL_PREFIX}}/config?autoload=1" crossorigin="use-credentials"></script>
<script src="{{SPLUNKWEB_URL_PREFIX}}/static/js/i18n.js"></script>
<script src="{{SPLUNKWEB_URL_PREFIX}}/i18ncatalog?autoload=1"></script>
<script src="{{SPLUNKWEB_URL_PREFIX}}/static/build/simplexml/index.js"></script>
<script type="text/javascript">
$("#row2").show();
$("#row3").hide();
$("#row4").hide();
$("#panel1").click(function(){
$("#row2").show();
$("#row3").hide();
$("#row4").hide();
});
$("#panel2").click(function(){
$("#row3").show();
$("#row2").hide();
$("#row4").hide();
});
$("#panel3").click(function(){
$("#row4").show();
$("#row3").hide();
$("#row2").hide();
});
// <![CDATA[
// <![CDATA[
//
// LIBRARY REQUIREMENTS
//
// In the require function, we include the necessary libraries and modules for
// the HTML dashboard. Then, we pass variable names for these libraries and
// modules as function parameters, in order.
//
// When you add libraries or modules, remember to retain this mapping order
// between the library or module and its function parameter. You can do this by
// adding to the end of these lists, as shown in the commented examples below.
require([
"splunkjs/mvc",
"splunkjs/mvc/utils",
"splunkjs/mvc/tokenutils",
"underscore",
"jquery",
"splunkjs/mvc/simplexml",
"splunkjs/mvc/layoutview",
"splunkjs/mvc/simplexml/dashboardview",
"splunkjs/mvc/simplexml/dashboard/panelref",
"splunkjs/mvc/simplexml/element/chart",
"splunkjs/mvc/simplexml/element/event",
"splunkjs/mvc/simplexml/element/html",
"splunkjs/mvc/simplexml/element/list",
"splunkjs/mvc/simplexml/element/map",
"splunkjs/mvc/simplexml/element/single",
"splunkjs/mvc/simplexml/element/table",
"splunkjs/mvc/simplexml/element/visualization",
"splunkjs/mvc/simpleform/formutils",
"splunkjs/mvc/simplexml/eventhandler",
"splunkjs/mvc/simplexml/searcheventhandler",
"splunkjs/mvc/simpleform/input/dropdown",
"splunkjs/mvc/simpleform/input/radiogroup",
"splunkjs/mvc/simpleform/input/linklist",
"splunkjs/mvc/simpleform/input/multiselect",
"splunkjs/mvc/simpleform/input/checkboxgroup",
"splunkjs/mvc/simpleform/input/text",
"splunkjs/mvc/simpleform/input/timerange",
"splunkjs/mvc/simpleform/input/submit",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/savedsearchmanager",
"splunkjs/mvc/postprocessmanager",
"splunkjs/mvc/simplexml/urltokenmodel"
// Add comma-separated libraries and modules manually here, for example:
// ..."splunkjs/mvc/simplexml/urltokenmodel",
// "splunkjs/mvc/tokenforwarder"
],
function(
mvc,
utils,
TokenUtils,
_,
$,
DashboardController,
LayoutView,
Dashboard,
PanelRef,
ChartElement,
EventElement,
HtmlElement,
ListElement,
MapElement,
SingleElement,
TableElement,
VisualizationElement,
FormUtils,
EventHandler,
SearchEventHandler,
DropdownInput,
RadioGroupInput,
LinkListInput,
MultiSelectInput,
CheckboxGroupInput,
TextInput,
TimeRangeInput,
SubmitButton,
SearchManager,
SavedSearchManager,
PostProcessManager,
UrlTokenModel
// Add comma-separated parameter names here, for example:
// ...UrlTokenModel,
// TokenForwarder
) {
var pageLoading = true;
//
// TOKENS
//
// Create token namespaces
var urlTokenModel = new UrlTokenModel();
mvc.Components.registerInstance('url', urlTokenModel);
var defaultTokenModel = mvc.Components.getInstance('default', {create: true});
var submittedTokenModel = mvc.Components.getInstance('submitted', {create: true});
urlTokenModel.on('url:navigate', function() {
defaultTokenModel.set(urlTokenModel.toJSON());
if (!_.isEmpty(urlTokenModel.toJSON()) && !_.all(urlTokenModel.toJSON(), _.isUndefined)) {
submitTokens();
} else {
submittedTokenModel.clear();
}
});
// Initialize tokens
defaultTokenModel.set(urlTokenModel.toJSON());
function submitTokens() {
// Copy the contents of the defaultTokenModel to the submittedTokenModel and urlTokenModel
FormUtils.submitForm({ replaceState: pageLoading });
}
function setToken(name, value) {
defaultTokenModel.set(name, value);
submittedTokenModel.set(name, value);
}
function unsetToken(name) {
defaultTokenModel.unset(name);
submittedTokenModel.unset(name);
}
//
// SEARCH MANAGERS
//
//
// SPLUNK LAYOUT
//
$('header').remove();
new LayoutView({"hideAppBar": false, "hideChrome": false, "hideSplunkBar": false})
.render()
.getContainerElement()
.appendChild($('.dashboard-body')[0]);
//
// DASHBOARD EDITOR
//
new Dashboard({
id: 'dashboard',
el: $('.dashboard-body'),
showTitle: true,
editable: true
}, {tokens: true}).render();
//
// VIEWS: VISUALIZATION ELEMENTS
//
var element1 = new HtmlElement({
"id": "element1",
"useTokens": true,
"el": $('#element1')
}, {tokens: true, tokenNamespace: "submitted"}).render();
DashboardController.addReadyDep(element1.contentLoaded());
var element2 = new HtmlElement({
"id": "element2",
"useTokens": true,
"el": $('#element2')
}, {tokens: true, tokenNamespace: "submitted"}).render();
DashboardController.addReadyDep(element2.contentLoaded());
var element3 = new HtmlElement({
"id": "element3",
"useTokens": true,
"el": $('#element3')
}, {tokens: true, tokenNamespace: "submitted"}).render();
DashboardController.addReadyDep(element3.contentLoaded());
var element4 = new HtmlElement({
"id": "element4",
"useTokens": true,
"el": $('#element4')
}, {tokens: true, tokenNamespace: "submitted"}).render();
DashboardController.addReadyDep(element4.contentLoaded());
var element5 = new HtmlElement({
"id": "element5",
"useTokens": true,
"el": $('#element5')
}, {tokens: true, tokenNamespace: "submitted"}).render();
DashboardController.addReadyDep(element5.contentLoaded());
var element6 = new HtmlElement({
"id": "element6",
"useTokens": true,
"el": $('#element6')
}, {tokens: true, tokenNamespace: "submitted"}).render();
DashboardController.addReadyDep(element6.contentLoaded());
// Initialize time tokens to default
if (!defaultTokenModel.has('earliest') && !defaultTokenModel.has('latest')) {
defaultTokenModel.set({ earliest: '0', latest: '' });
}
submitTokens();
//
// DASHBOARD READY
//
DashboardController.ready();
pageLoading = false;
}
);
// ]]>
</script>
</body>
</html>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-14-2022
10:09 AM
|
Karma given to
