About jhowkins

jhowkins · ‎11-18-2014

Still no resolution for this issue @kasu_praveen Should I find the answer, I will definitely post it here.

jhowkins · ‎05-15-2014

I've tried several different combinations, including the one you've suggested, without success. I've even tried the example provided by Splunk... also no luck. I should note that this was previously an implementation of Splunk 5 prior to getting upgraded to 6. Perhaps there is a known issue with Web Framework when upgrading? If so, what is the solution? Perhaps this is an issue Splunk's internal Web Frameworks developers might be able to answer...

jhowkins · ‎05-07-2014

I'm having trouble implementing a custom TimeRange picker using Splunk 6 & SplunkJS (splunkjs/mvc/timerangeview -- dialogOptions property). Here is an example of the template that has the issue... ... {% block content %} <div id="mytimerangeview" /> {% endblock content %} {% block js %} <script> var deps = [ "splunkjs/ready!", ... "splunkjs/mvc/timerangeview" ]; require(deps, function(mvc,_) { ... var TimeRangeView = require("splunkjs/mvc/timerangeview"); var dlgopts = { showPresets:false, showPresetsRealTime:false, showPresetsRealTimeOnly:false, showPresetsRelative:false, showPresetsAllTime:false, showCustom:false, showCustomRealTime:false, showCustomRelative:false, showCustomDate:true, // Only show CustomDate showCustomDateTime:false, showCustomAdvanced:false, enableCustomAdvancedRealTime:false }; var mytimerange = new TimeRangeView({ id: "mysearch_id", managerid: "mysearch_mgr_id", preset: "Yesterday", dialogOptions: dlgopts, el: $("#mytimerangeview") }).render(); mytimerange.on("change", function() { mysearch.search.set(mytimerange.val()); }); ... )}; I left out the SearchManager bits to prevent confusion. Note that everything works except the dialogOptions property. I am still seeing everything, despite trying to hide everything but the CustomDate option. I've tried following the example on Splunk's website found here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_timerange.html Not sure if I'm doing something wrong or if this isn't working for anyone else. I noticed that the dialogOptions property was not available in WebFramework 1.0 -- see here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.0/compref_timerange.html I'm not sure which version Splunk 6 has "built-in" -- more importantly, does it actually support the TimeRangeView dialogOptions property. Whatever the case, I'd like to use it. Any good info on this problem would be a great help.

jhowkins · ‎04-10-2014

Take a look at the solutions I've provided below. Let me know if that works for you.

jhowkins · ‎04-09-2014

I suspect you're only getting single points on the linechart but they are not connected. If this is the case, try the following; Assuming you've already set your chart type to "Line"... - Click "Format" to the upper left of the chart on the Visualization tab - From the General tab, click the "Connect" button (right-most) next to "Null Values" - Click Apply and your linechart will have connected dots If your events are not continuous, you could also acheive the same thing by setting cont=f ... ... | timechart cont=f avg(timeDiff) I've made some assumptions here. Hopefully I answered your question -- if not, I'd need more detail... a screenshot is always nice.

jhowkins · ‎04-07-2014

If you would rather create an extraction by sourcetype and using a wildcard, you can do it but it requires a little regex trickery... To capture the sourcetypes you provided, you can use the following as your sourcetype; (?::){0}*_apache_access

jhowkins · ‎04-07-2014

To answer your question, yes there is a way to use wildcards to use a single extraction against multiple sourcetypes. See my answer below.

jhowkins · ‎04-02-2014

I ran into a similar issue where I have 60 different sourcetypes all belonging to the same host. Depending on the contents of your files, you could create a transform and/or extraction that captures similar things contained within each file. When you create your regex pattern, just make sure it qualifies something within the data that distinguishes it from everything else. If you can provide an example of the file contents and your intentions, I can provide a better answer.

jhowkins · ‎03-03-2014

Without knowing where you want to get your static list of redirects, I have worked out the following solution: Start by creating a lookup file. For this example, we'll call it "url_loader_config.csv" Add the following header row to the lookup file: ID,URL Add rows for as many static URLs you want based on a matching field: Your_ID_Field Example: ID,URL 123,http_COLON_//www_DOT_splunk_DOT_com 456,your_dashboard_name 789,http_COLON_//www_DOT_your-static-url_DOT_com Note: Your_ID_Field will serve as a value to match against the lookup table. 3.) Enter your search that produces the table (replace #your-table-producing-search-here# ) and change $click.fields.Your_ID_Field$ to whatever field (I'm guessing $click.fields.series$ maybe?): <module name="Search" autoRun="true"> <param name="search">#your-table-producing-search-here#</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <module name="Search"> <param name="search">|inputlookup url_loader_config.csv | table ID,URL | where ID="$click.fields.Your_ID_Field$"</param> <module name="ResultsValueSetter"> <param name="fields">ID,URL</param> <module name="Redirector"> <param name="url">$URL$</param> </module> </module> </module> </module> </module> You may want to modify the |inputlookup search to make sure everything still works if the ID field doesn't match anything in the lookup file: |inputlookup url_loader_config.csv | table ID,URL | where ID="$click.fields.Your_ID_Field$" | stats count | eval URL = if(count == 0, "http_COLON_//www_DOT_splunk_DOT_com",URL) | table ID,URL I can't post external URLs, so I've substituted periods with "DOT" and colons with "COLON". I hope this works for you.

jhowkins · ‎03-03-2014

If you want implement the date as a text label in your dashboard using Javascript, you can also do the following (again, I'm assuming you're using advanced XML and SideView Utils' HTML module); <module name="HTML"> <param name="html"> <![CDATA[ <script> var theDate = new Date(); $$(function() { $$( "#ReportTitle" ).text(theDate); }); </script> <h3>Monthly status report <Label id="ReportTitle" ></h3> ]]> </param> </module> I hope this helps!

jhowkins · ‎03-03-2014

Assuming you are using advanced XML for your dashboard and you're willing to use SideView Utils' HTML module, the following will work; <module name="HiddenSearch" autoRun="True"> <param name="search">index=_internal | stats count | eval ReportLabel = "Monthly status report ".strftime( time(), "%B %e, %Y %k:%M:%S %p") | table ReportLabel</param> <module name="HTML"> <param name="html"> <![CDATA[ <p>$results[0].ReportLabel$</p> ]]> </param> </module> </module> You don't necessarily need to concatenate with an eval either. You could change the code above as follows: eval = strftime( time(), "%B %e, %Y %k:%M:%S %p") and <![CDATA[ <p>Monthly status report $results[0].ReportLabel$</p> ]]> Note: index=_internal can be swapped for whatever index you feel comfortable using You can format the date/time using Splunk's date and time format variables: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

jhowkins · ‎02-13-2014

I think you're asking if you can click on a specific cell within a given row on a table and then be redirected to another view based on the value of the cell. If that is the case... '$click.value2$' is the cell value from the cell you clicked on. You must specify the drilldown parameter for SimpleResultsTable to be "all". ... <module name="SimpleResultsTable"> <param name="drilldown">all</param> ... Unfortunately, the SideView Utils' Table module won't work for this. It's either an undocumented feature or is simply not supported yet.

Posts	12
Solutions	1
Karma Given	0
Karma Received	7
Member Since	‎01-28-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Web Framework - SplunkJS Stack - TimeRangeView dia...

Re: Web Framework - SplunkJS Stack - TimeRangeView...

Re: Web Framework - SplunkJS Stack - TimeRangeView...

Web Framework - SplunkJS Stack - TimeRangeView dia...

Re: splunk report

Re: splunk report

Re: Applying Field Extractions to Several Sourcety...

Re: Applying Field Extractions to Several Sourcety...

Re: Applying Field Extractions to Several Sourcety...

Re: Static redirects per table row sideview utils

Re: Concatenate date in label

Re: Concatenate date in label

Re: Row Table cell Clicking redirecting to view