About behudelson

behudelson · ‎04-23-2019

Hi @laksman239, thanks for the assist. I was trying to use a data model field that an autolookup props.cong entry was more suitable for. props.conf entry: [my_source_type] LOOKUP-class = mylookup LookupID as SourceIdentifier OUTPUT LookupField Thanks!

behudelson · ‎04-22-2019

It looks like you set up a field extraction without editing the field names and then saved it. To remove them, you will need to remove the field extraction. Go to Settings->Fields->Field Extractions. Make sure you have the right app selected. Filter by the name of your sourcetype. If you don't know that, sort by owner and look for your username. Delete the entry that you did not mean to create. If you see multiple entries and are unsure which one is yours go to Settings->Fields->Field Transoformations. Sort by owner and click into the ones owned by your username. Look for the one that has a field list similar to the one below: Take note of the name on that screen at the upper left hand corner. Go back to Settings->Fields->Field Extractions. Find the extraction that has your name as owner with that transformation name in its name. Delete it.

behudelson · ‎04-22-2019

Hi all, I am trying to use data models to extract a search time value from a lookup. However, the value I am using to join to the lookup table is extracted from the source. I have no other way to get the value other than from the file name. For example, I have the following regex extraction against source. It is configured in both my data model and as a calculated field: (?<SourceFolder>[\w-]+).(?<SourceIdentifier>\d+)[\D]+ When I preview or run a search, these fields get populated. I also have a lookup that has the SourceIdentifier field with matching values. I configured a lookup field in DataModels to add some of the lookup fields to my searches. My lookup field configuration is at the bottom of the list. When I preview or run a search, these fields do not get populated. Splunk documentation says: "When Splunk software evaluates calculated fields, it evaluates each expression as if it were independent of all other fields. You cannot chain calculated field expressions, where the evaluation of one calculated field is used in the expression for another calculated field." (https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/definecalcfields) However, at the bottom of the data models page there is a message that says: "Calculated fields are processed in the order above, so ensure any dependent fields are defined first. Drag to rearrange." (You can find this message by clicking into an unaccelerated data model and scrolling to the bottom of the page.) I've attempted to work on this issue in both Splunk Enterprise and Splunk Cloud. Both are running v 7.0.8. Is what I am attempting to do possible? If not, is there another route to accomplish the same thing? Thank you!

behudelson · ‎01-18-2019

Thanks @dhirendra761! For some reason I needed a fresh installation of Splunk Enterprise in order for 3.1.2 to function, but now everything is good to go. I appreciate your help!

behudelson · ‎01-18-2019

Thanks @dhirendra761. I did not restart after removing the folder. I will give that a shot today. I appreciate your time!!

behudelson · ‎01-17-2019

Hi @dhirendra761 I installed 3.1.2 but it just hands at the Set Up DB Connect. My installation steps were: delete splunk_app_db_connect folder from apps containing 3.1.3. Install 3.1.3 from Manage Apps-> Install app from file. I also noticed that there is a version 3.1.4. Does it also have the same issue with Server 2016?

behudelson · ‎01-15-2019

Hi @dhirendra761 I may not have a chance to test this out until Thursday, but as soon as I confirm that it works I will accept your answer. Thank you for taking the time to assist me!

behudelson · ‎01-15-2019

Hi @dhirendra761, -------------- is my email. Thank you!

behudelson · ‎01-14-2019

Hi @dhirendra761, Thanks for responding. MS Server 2016.

behudelson · ‎01-11-2019

Not a dumb question, but yes, I created the index 🙂 Also, I did search _internal and the log entries aren't very useful. This 'status=FAILED' doesn't give me much information. (I obfuscated sensitive details with ++++) 2019-01-10 10:16:00.202 -0500 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=+++++++ jdbc_url=jdbc:jtds:sqlserver://++++++++++:14330/IntegrationMart;useCursors=true;domain=+++++++;useNTLMv2=false db_read_time=2 hec_record_process_time=23 format_hec_success_count=57 status=FAILED input_name=++++++++++_fact batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2019-01-10_10:16:00 end_time=2019-01-10_10:16:00 duration=190 read_count=57 write_count=0 filtered_count=0 error_count=0

behudelson · ‎01-11-2019

Hi @MousumiChowdhury, Thanks for asking. My input is batch and my timestamp is current time. The query takes about 5 seconds to return results from the SQL editor. No template is selected.

behudelson · ‎01-10-2019

Hello, I have a test server and I am trying to use DBConnect to index some SQL data. Everything appears to be configured appropriately. In the input configuration screen, my search returns results. I've attached an image of the edit input screen. I am running DB Connect version 3.1.4 on Splunk Enterprise 7.0.3 with a dev/test license. Thank you for any help you can provide!

behudelson · ‎09-27-2018

I wasn't asking how to connect to the REST API. I can do that. I was asking how to pull down source files from my apps using the REST API.

behudelson · ‎09-27-2018

Hello, I am using Splunk Cloud and I would like to use the REST API to pull down source files of my applications. Is this possible? It is not clear to me from the documentation. I am using curl and the C# SDK. Thank you!

behudelson · ‎09-02-2018

Thanks Rich.

behudelson · ‎09-02-2018

Hey Rich, thank you. That worked. If you post this as an answer to the question I am happy to give you credit for solving it.

behudelson · ‎08-31-2018

Hi I have two Splunk deployments, one running Splunk 7.1.0 on Windows Server 2016 and Splunk 7.1.2 on Windows 10. When I run Splunk from the bin folder, or any Splunk command, I see the Splunk window open, but then it immediately closes. I would like to have the window remain open so I can read the output. Am I running the wrong command to open the CLI? Thank you!

behudelson · ‎06-12-2018

Hi @niketnilay, thank you for responding. The heatmap would get warmer for the sum of the numbers. I essentially want the heatmap of the second chart applied to the first chart. (The second just shows the sum of the numbers from the first).

behudelson · ‎06-12-2018

Hello, I have a scenario where I want to build a heatmap to show usage of a piece of equipment (lets say a computer), but for each cell in the heatmap I would like to use fieldformat (or a similar solution) to subdivide the data to describe the usage. Here is an example, I will start with this data: Day Hour Type Count Mon 0800 Teacher 1 Mon 0800 Student 2 Mon 0900 Teacher 0 Mon 0900 Student 4 Mon 1000 Teacher 1 Mon 1000 Student 2 Mon 1100 Teacher 0 Mon 1100 Student 3 Tue 0800 Teacher 1 Tue 0800 Student 0 Tue 0900 Teacher 1 Tue 0900 Student 2 Tue 1000 Teacher 0 Tue 1000 Student 3 Tue 1100 Teacher 1 Tue 1100 Student 0 Wed 0800 Teacher 2 Wed 0800 Student 0 Wed 0900 Teacher 1 Wed 0900 Student 2 Wed 1000 Teacher 0 Wed 1000 Student 3 Wed 1100 Teacher 1 Wed 1100 Student 0 I can chart the data as shown. where the numbers represent Teacher/Student Count: 0800 0900 1000 1100 Mon 1/2 0/4 1/2 0/3 Tue 1/0 1/2 0/3 1/0 Wed 2/0 1/2 0/3 1/0 Or like so (with a heatmap) where the numbers represent the sum: 0800 0900 1000 1100 Mon 3 4 3 3 Tue 1 3 3 1 Wed 2 3 3 1 However, I am unable to figure out how to show the first chart with the ratios using a heatmap based on the sums in the second chart. Thank you for any assistance!

behudelson · ‎03-28-2018

niketnilay, This is a fantastic solution. Thank you. I didn't know that I could hide a row and add custom css from the style tag in a panel. Neat!! Best, Ben

behudelson · ‎03-28-2018

The search query is actually independent from the content of the panels/dashboard. I am using rest to identify what roles the user is assigned to. If the user has a specific role, I want to hide the Splunk bar from them. The use case is that I have business users who I want to prevent from seeing menus they don't need to see. More importantly, I do not want them to have search capabilities. However, if I remove search from the permissions or if I remove read access from the Search and Reporting app, they cannot see the dashboards do not run queries.

behudelson · ‎03-28-2018

Just in case anyone is still seeking an answer to this question. somesoni2 is partially correct. Configure your link as follows: ...... <link> <![CDATA[/app/search/seconddashboard?form.sourcetype=$click.name2$&form.field1.earliest=$earliest$&form.field1.latest=$latest$]]> </link> ...... In the link above the token name is the same name as the token name in the destination dashboard. In this case, it is using the default names. If you then configure your destination dashboard panels to use the Shared Time Picker (field1), the panels will load with the intended values. You should not have to change any Simple XML markup on the destination page for this to work.

behudelson · ‎03-28-2018

Hi logloganathan, Thank you for assisting me! The modification did not work. The Splunk bar is visible for both true and false values of the token. Also, I am getting a warning in the source editor for the top line "Non-boolean value "$$hideSplunkBar$$"" identified. Best, Ben

behudelson · ‎03-28-2018

Hello, I am trying to control the hideSplunkBar attribute using a token. Regardless of the token's value ("true", "false", 1, or 0) the attribute always evaluates to true and hides the Splunk Bar. If I don't use a token, the attribute behaves as expected. My use case is that I would like to hide the Splunk bar for a certain role. I have sample code below. Thank you for any input you may have! <form hideSplunkBar="$hideSplunkBar$"> <search> <query>| search | table hidesplunkbar</query> <done> <eval token="hideSplunkBar">$result.hidesplunkbar$</eval> </done> </search> . . . </form>

behudelson · ‎01-05-2018

It's not static though. It is subject to change.

Posts	31
Solutions	0
Karma Given	9
Karma Received	4
Member Since	‎11-11-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Data model calculated field dependencies

Splunk DB Connect: Data not indexing

How do you use the REST API to pull down source fi...

How do I keep the Splunk CLI from disappearing in ...

Using a heatmap against fieldformated field

How can I use a token to set hideSplunkBar?

Count occurrences of all values of a field for ano...

filter a table in a dashboard from textbox

How to get percentages of value pairs

Re: Data model calculated field dependencies

Re: Why is field ingestion not working when ingest...

Data model calculated field dependencies

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Re: Splunk DB Connect: Data not indexing

Splunk DB Connect: Data not indexing

Re: How do you use the REST API to pull down sourc...

How do you use the REST API to pull down source fi...

Re: How do I keep the Splunk CLI from disappearing...

Re: How do I keep the Splunk CLI from disappearing...

How do I keep the Splunk CLI from disappearing in ...

Re: Using a heatmap against fieldformated field

Using a heatmap against fieldformated field

Re: How can I use a token to set hideSplunkBar?

Re: How can I use a token to set hideSplunkBar?

Re: How to pass a token to a Timepicker?

Re: How can I use a token to set hideSplunkBar?

How can I use a token to set hideSplunkBar?

Re: Count occurrences of all values of a field for...