Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About rtev
rtev
Path Finder
Member since:
10-31-2017
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 1 |
| Karma Given | 10 |
| Karma Received | 2 |
| Member Since | 10-31-2017 |
Activity Feed
- Karma Re: DBConnect: OSError: [Errno 2] No such file or directory validate java command: /usr/java/latest/bin/java. for teunlaan. 06-05-2020 12:50 AM
- Karma Re: Why are events not sorting in Chronological Order with a basic search? for Ranazar. 06-05-2020 12:49 AM
- Got Karma for Why are events not sorting in Chronological Order with a basic search?. 06-05-2020 12:49 AM
- Karma Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command? for sjaworski. 06-05-2020 12:48 AM
- Karma Splunk local account login to splunkweb when SAML authentication is enabled? for jeff. 06-05-2020 12:48 AM
- Karma Re: Splunk local account login to splunkweb when SAML authentication is enabled? for suarezry. 06-05-2020 12:48 AM
- Karma Limit choices in default TIMEPICKER for jlhamlet. 06-05-2020 12:47 AM
- Karma How can I set a token to the current logged-in username in SimpleXML dashboards without using Javascript? for jbrodsky_splunk. 06-05-2020 12:47 AM
- Karma Re: How can I set a token to the current logged-in username in SimpleXML dashboards without using Javascript? for jbrodsky_splunk. 06-05-2020 12:47 AM
- Karma Re: How can I set a token to the current logged-in username in SimpleXML dashboards without using Javascript? for twollenslegel_s. 06-05-2020 12:47 AM
- Got Karma for Re: Limit choices in default TIMEPICKER. 06-05-2020 12:47 AM
- Karma Re: Which is better NOT or != for gkanapathy. 06-05-2020 12:45 AM
- Posted Re: _audit and _internal index data retention on Getting Data In. 05-14-2020 11:47 AM
- Posted Re: DBConnect: OSError: [Errno 2] No such file or directory validate java command: /usr/java/latest/bin/java. on All Apps and Add-ons. 02-04-2020 07:22 AM
- Posted Re: How to dynamically change a web framework visualization's binding to a search manager? on Splunk Dev. 12-18-2018 05:19 AM
- Posted Re: How to dynamically change a web framework visualization's binding to a search manager? on Splunk Dev. 12-15-2018 10:26 AM
- Posted Re: How to dynamically change a web framework visualization's binding to a search manager? on Splunk Dev. 12-14-2018 03:17 PM
- Posted Re: Limit choices in default TIMEPICKER on All Apps and Add-ons. 12-13-2018 10:16 PM
- Posted How to dynamically change a web framework visualization's binding to a search manager? on Splunk Dev. 12-13-2018 05:10 PM
- Tagged How to dynamically change a web framework visualization's binding to a search manager? on Splunk Dev. 12-13-2018 05:10 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
05-14-2020
11:47 AM
Make the changes in $SPLUNK_HOME/etc/master-apps/local/indexes.conf on the Master and Splunk should recognize it needs a new bundle.
... View more
02-04-2020
07:22 AM
This worked for me too.
... View more
12-18-2018
05:19 AM
I posted the - possible - answer. When/If I have time to verify it works I'll accept it. Thanks for your comments.
... View more
12-15-2018
10:26 AM
Business People want a dashboard that iterates running a search over and over, adjusting part of the search, until certain conditions are met. Don't actually need this functionality now, but figured I'd answer the question after I found what looked like the answer. Splunk documentation is somewhat fractured in different locations, but it's definitely improving steadily.
... View more
12-14-2018
03:17 PM
It looks like Web Framework components have a method:
settings.set( property, value )
described as:
Sets the value of property to the
specified value for the current
component.
which means the answer may be:
var search1 = new SearchManager({ id="search1" ... });
var search2 = new SearchManager({ id="search2" ... });
var tableView = new TableView({ "managerid": "search1" ... });
tableView.settings.set("managerid", "search2");
... View more
12-13-2018
10:16 PM
1 Karma
Looks like somewhere between 7.0.2 and 7.1.2 the API for the Time Picker was deprecated and replaced.
timepickerview.js contents:
define(function(require) {
var console = require('util/console');
console.warn(
'%s is deprecated. Please require %s instead.',
'splunkjs/mvc/simpleform/timepickerview',
'splunkjs/mvc/simpleform/timerangeview');
return require('./timerangeview');
});
There's some documentation about it over in the WebFramework Documentation.
Take a look at TimelineView there for the details:
require([
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/timerangeview",
"splunkjs/mvc/simplexml/ready!"
], function(SearchManager, TimeRangeView) {
// Create a search manager
var mysearch = new SearchManager({
id: "example-search",
preview: true,
search: "index=_internal | head 50",
status_buckets: 300,
required_field_list: "*"
});
// Instantiate a view using the default time range picker
var mytimerange = new TimeRangeView({
id: "example-timerange",
managerid: "example-search",
preset: "Today",
el: $("#mytimerangeview")
}).render();
// Update the search manager when the time range changes
mytimerange.on("change", function() {
mysearch.settings.set(mytimerange.val());
});
// Create a custom time range picker
// Show the Presets panel, hide the Real-time and Advanced panels
var mypresetsettings = {
showPresets: true,
showCustomRealTime: false,
showCustomAdvanced:false,
};
// Define custom preset values
var mypresetvalues = [
{label: 'Last 13 minutes', earliest_time: '-13m', latest_time: 'now'},
{label: 'Last 42 minutes', earliest_time: '-42m', latest_time: 'now'}
];
// Instantiate a view using the custom time range picker
var mytimerange_custom = new TimeRangeView({
id: "example-timerange_custom",
managerid: "example-search",
presets: mypresetvalues,
dialogOptions: mypresetsettings,
el: $("#mytimerangeview_custom")
}).render();
// Update the search manager when the time range changes
mytimerange_custom.on("change", function() {
mysearch.settings.set(mytimerange_custom.val());
});
});
(* shamelessly cut and pasted from there )
... View more
12-13-2018
05:10 PM
After following along with a published example I'm trying to perform something like this...
var search1 = new SearchManager({ ... });
var search2 = new SearchManager({ ... });
var tableView = new TableView({ ... "managerid": "search1" }).render();
// change search manager binding for tableView from search1 to search2.
tableView.setManagerId(search2); // ????
The source code for many of the visualizations is located in SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/splunkjs/mvc and, at least some of them, inherit functionality from the BaseVisualizationView class (visualizationview.js). That class contains a private method that gives the impression that visualizations react to connection manager changes.
363 _onManagerChange: function(managers) {
364 // clean up listeners
365 if (this.managers) {
366 _.each(this.managers, function(manager) {
367 this.stopListening(manager);
368 }, this);
369 this.managers = null;
370 }
371 if (managers == null || managers.length === 0) {
372 this.message('no-search');
373 return;
374 }
375 if (managers) {
376 this.managers = managers;
377 this._bindDataSources();
378 _.each(this.managers, function(manager) {
379 // only for primary manager
380 if (manager.getType() === 'primary') {
381 this.primaryManager = manager;
382 this._clearPrimaryResults();
383 this.message('empty');
384 // listeners for all managers
385 this.listenTo(manager, 'search:fail', this._onPrimarySearchFail);
386 this.listenTo(manager, 'search:error', this._onPrimarySearchError);
387 this.listenTo(manager, 'search:start', this._onPrimarySearchStart);
388 this.listenTo(manager, 'search:progress search:done', this._onPrimarySearchProgress);
389 this.listenTo(manager, 'search:done', this._onPrimarySearchDone);
390 this.listenTo(manager, 'search:cancelled', this._onPrimarySearchCancelled);
391 this.listenTo(manager, 'search:refresh', this._onPrimarySearchRefresh);
392 manager.replayLastSearchEvent(this);
393 }
394 }, this);
395 }
396 },
It may be that the files Datasource.es and SearchManagerConnection.es located in SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/helpers/search play some role in orchestrating connections between Visualizations and SearchManagers.
Currently it seems that if this is a feature of the Web Framework public API it's not documented. I'm making this post in the hope that someone can give me a quick answer rather than continuing to comb through the source code. Thank you!
... View more
- Tags:
- splunk-enterprise
09-17-2018
11:27 AM
There is one setting for browser caching in the web.conf:
use_future_expires = [True | False]
* Determines if the Expires header of /static files is set to a far-future date
* Defaults to True
Oddly, overriding this setting to "False" does not appear to change the behavior of the web server:
Splunk (7.1.2) was restarted between web requests and an 'Empty Cache and Hard Reload' was performed in the browser (Chrome). I was reviewing the headers of the default.css file.
Putting this behavior aside (which may be due to a simple misunderstanding on my part)...
The current default value for max-age in the Cache-Control header is so large (1 year) that changes to static files do not propagate to the users quickly forcing them to clear their browser caches.
I'm hoping there is a way to override the default value of max-age?
The idea would be to set it to a value of 86400 or 172800 (1 or 2 day(s)) to allow changes to flow out to users without disruption in about a day or so but not disable browser caching entirely.
... View more
09-01-2018
08:07 AM
Earlier this morning I noticed some other similar aberrant behaviors related to events showing up multiple times when zooming into different slices of the timeline. Similarly I don't know if it's a symptom of the same issue but it seems likely. I will accept your answer when things get straightened out. Thank you!
... View more
08-31-2018
06:10 PM
I should also mention that Transparent Huge Page memory management was disabled one day ago on all (Linux) hosts across the cluster.
... View more
08-31-2018
05:57 PM
I should mention that the timestamps resolve down to milliseconds...
... View more
08-31-2018
05:56 PM
The timestamps are coming in as Unix Epoch time and are extracted correctly. I've checked the difference between the _indextime and _time and there are no events for which the skew is greater than 4-5 seconds. I'd be glad to share a couple of examples of the data that is being ingested and the related props configuration if you think that might shed some light on the matter. Thanks!
... View more
08-31-2018
05:14 PM
I can't edit my own post... Correction: The version was upgraded to 7.1.2.
... View more
08-31-2018
03:25 PM
1 Karma
Today, I noticed that, when performing a basic search, the events are not sorted chronologically. Additionally, not all events 'match up' correctly to the timeline.
I have not found any other posts which document this strange behavior.
With a simple | sort _time , the events sort as expected and correlate to the timeline accurately.
The deployment was upgraded from 7.0.2 to 7.1.2 one week ago.
Here's some screenshots that show the behavior:
Does anyone have any ideas how to fix this issue?
... View more
