About vidda42

vidda42 · ‎08-23-2016

i had the same problem. it come from date format. i change Output Timestamp Format: yyyy-MM-dd HH:mm:ss to Output Timestamp Format: epoch time. Now McAfee ePO data is indexing

vidda42 · ‎02-07-2013

Hi there ! Thanks for your answer, but the case is that the "earliest" & "latest" values come from the TimeRangePicker when you select Today. All the other cases are working fine. I'm getting the values using : $search.timeRange.earliest$ & $search.timeRange.latest$ David

vidda42 · ‎02-07-2013

Hi all ! I'm building a view in advanced XML, with a TimeRangePicker, associated with 2 searches. The first search (panel_row1_col1) is showing Table, and all is fine. The second search (panel_row1_col2) is building a "double-bargraph", showing the "Today" graph, and the same graph for 7 days earlier. That is to say that, if it's Monday the 7th, you'll get also the graph for Monday 1st on the same graph. This view is really usefull and easy-to-read : My problem is that I can't do the following operation : now-7d , for the drawing on the right. Is there any way to rewrite the "now" value, or to get a value that allows a substract ? Final request for drawing the double-bar-graph is : earliest=@d latest=now action="reject" CF="xxxxx" | multikv | eval ReportKey="today" | append maxtime=120 [ search earliest=@d-604800 latest=now-518400 action="reject" CF="xxxxx" | multikv | eval ReportKey="last week" | eval new_time=time+86400*7 ] | eval _time=if(isnotnull(new_time), new_time, _time) | timechart span=1h count by ReportKey I get the following : __Invalid value "now-518400" for time term 'latest'_ David

vidda42 · ‎02-06-2013

Hi dude ! Just had the same problem with my dashboards view... As I have to do my stuff VERY QUICKLY, I searched and found the following. Just one thing before I tell you how to solve this, keep in mind that it is, for me, the "quick & dirty" method ! 🙂 (maybe it is the right & only one !) -= Let's say that the new created user is TOTO, and the concerned app is SEARCH =- 1) Go to your new user directory : [root@Splunk local]# pwd /opt/splunk/etc/users/TOTO/search/local 2) Backup your actual viewstates.conf, just in case : [root@Splunk local]# cp viewstates.conf viewstates.conf_ORI 3) Overwrite your user viewstates.conf with the admin's one : [root@Splunk local]# cp ../../../admin/search/local/viewstates.conf . cp: overwrite `./viewstates.conf'? y 4) Restart your splunk instance : [root@Splunk local]# chown -R splunk:splunk /opt/splunk/ && /opt/splunk/bin/splunk restart 5) ENJOY your dashboard with no more viewstates errors !!! 😉 David

vidda42 · ‎01-16-2013

Hey ! You can deal with Transforms/Extract. 1) Create a Transform with : - Regex : (\w+)=([\w\d]+) - Source Key : _raw - Format : $1::$2 2) Associate that Transform with an Extract pointing to your source. & you're done ! 🙂 David

vidda42 · ‎12-23-2012

Hi there ! Below an extract from the "Terms and Conditions of Use" : 6.TERMINATION We may terminate a Splunk Website user's account in our absolute discretion and for any reason. We are especially likely to terminate for reasons that include, but are not limited to, the following: 1.) violation of these Terms; 2.) abuse of site resources or attempt to gain unauthorized entry to the site or site resources; 3.) use the Splunk Websites Services in a manner inconsistent with the Purpose; 4.) a user's request for such termination; and 5.) requirement of applicable law, regulation, court or governing agency order. Our termination of any user's access to the Splunk Websites or any Services hereunder may be effected without notice and, on such termination, we may immediately deactivate or delete user's account and/or bar any further access to such files. Splunk shall not be liable to any Splunk Website user or other third party for any termination of that user's Splunk Website access or account hereunder. Right now, I'm trying to find out how to request for such termination, because I have another account I would like to close... David

vidda42 · ‎12-21-2012

Hi again all ! I finally got my dashboard working fine with 'live' area charts combined with a 'live' gauge next to them. The problem in this type of request is that you will get, as a result of your search, several lines. In my case, one per second elapsed. With this, you will be able to graph them as a line or area chart updating every x second(s). But, you can't display a 'live' gauge with these results. So, the trick is that you have to get ONLY one result, to be able to show it in a 'live' gauge. To do this, you have to " | tail 1" your search. Sum-up: If you need a 'live' line or area chart : action="drop" | timechart span=1s count If you need a 'live' gauge (radial, meter, filler) counter : action="drop" | bucket _time span=1s | stats count(_raw) as eps by _time | table eps | tail 1 Enjoy now ! David

vidda42 · ‎12-21-2012

Hi all ! Just can't figure out how to get this work. I am searching for firewall drops in my indexed logs, so I currently have this search : action="drop". I would like to have the drop-rate (per second) of all the firewalls and display it on a radial gauge. Can anyone help me with that...? Thanx ! David

Posts	8
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎05-28-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to append a value to the TimeRangePicker value...

Live count in radial gauge

Re: Why is Splunk Add-on for McAfee ePO data not i...

Re: How to append a value to the TimeRangePicker v...

How to append a value to the TimeRangePicker value...

Re: Unable to viewstate information; formatting ma...

Re: Value pairs are not automatically being parsed...

Re: Delete Splunk Account

Re: Live count in radial gauge

Live count in radial gauge