Any fix to remove these insecure requests warning generated from connectionpool.py script. Thanks ... View more

@ waechtler_amasol Any fix to remove these insecure requests warning generated from connectionpool.py script or Splunk ITSI scripts. Thanks ... View more

Hi Is it possible to do the same for string values in fields instead of numeric. Am trying this but not working any help provided is appreciated. if (cell.field !== "source_subnet") { if (value !== "100%") { $td.addClass("range-cell").addClass("range-severe"); } // Update the cell content $td.text(value).addClass('string'); } Please ignore am using "100%" as string. Thanks ... View more

Hi Is it possible to do the same for string values in fields instead of numeric. Am trying this but not working any help provided is appreciated. if (cell.field !== "source_subnet") { if (value !== "100%") { $td.addClass("range-cell").addClass("range-severe"); } // Update the cell content $td.text(value).addClass('string'); } Please ignore am using "100%" as string. Thanks ... View more

Hi Is it possible to do the same for string values in fields instead of numeric. Am trying this but not working any help provided is appreciated. if (cell.field !== "source_subnet") { if (value !== "100%") { $td.addClass("range-cell").addClass("range-severe"); } // Update the cell content $td.text(value).addClass('string'); } Please ignore am using "100%" as string. Thanks ... View more

Hi Is it possible to do the same for string values in fields instead of numeric. Am trying this but not working any help provided is appreciated. if (cell.field !== "source_subnet") { if (value !== "100%") { $td.addClass("range-cell").addClass("range-severe"); } // Update the cell content $td.text(value).addClass('string'); } Please ignore am using "100%" as string. Thanks ... View more

what ever the search may be, finally the results are ordered according to what time they have been received to Splunk. tail command should work for you, if you want to view those last events. ... View more

Hi @donna_oquinn I am not sure if there is any facility to do that. But with tail command you can get the last results on last page as needed. As events are ordered by _time, and Tail command goes in reverse order index=_internal | tail 10 Thanks ... View more

Hi Reddi694325 ITSI default installation comes with modules like Application server module, database module, operating system module, etc. These modules have the services, entities, KPIS created for generic use so that you can use or duplicate them according to your use case. You can always delete these Services, entities, kpis, from Configure section in ITSI UI app, or completely removing these modules from service side. Thanks ... View more

Hi You didn't properly mention where you are seeing this behavior. you can always do stats to list all values in field --- your search | stats count by host if you are facing issue in timechart, chart command , use this -- ----- your search | timechart count by host useother=f usenull=f Thanks ... View more

That's an individual glass table which can be imported by using above methods from KV STORE ... View more

may i know what exactly are you looking for ? what do you mean by glass table page image ? ... View more

Hi All the objects in ITSI (Services, Entities, Glass Tables) are stored in KV STORE, not like usual dashboard xml or HTML files in case of splunk enterprise A kv store collection is created for every object type in ITSI which can be found in SA-ITOA app - default/local directory - tranforms.conf [glasstable] collection = itsi_pages external_type = kvstore fields_list = title, object_type, latest_label, svg_coordinates, _key and location to kvstore is - $splunkhome$/var/lib/splunk/kvstore. if you want to back up glass table objects there are many end points and method in ITSI which can do CRUD operations on this KVSTORE. go through these links which will help you to get to data in ITSI. https://docs.splunk.com/Documentation/ITSI/4.2.0/Configure/BackupandRestoreITSIconfig https://docs.splunk.com/Documentation/ITSI/4.2.0/Configure/kvstore_to_json.pyoperations https://docs.splunk.com/Documentation/ITSI/4.2.0/RESTAPI/ITSIRESTAPIreference Thanks ... View more

It should return time field other wise you cant plot chart or not even know when that specific value happened or changed ... View more

Hi take a look at below pic Replace alert_123 with your alert name. Thanks ... View more

Hi Try to search in main index, by default events goes to main index index=main Thanks ... View more

Hi are you looking timechart command, this will plot a chart for every time span. yourquery | timechart span=1h count(yourfieldname) change the span to others like 1m,5m,1h,1d etc & take a look at this timechart command doc https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Timechart Thanks ... View more

Hi Just check if you gave (EVENT_BREAKER) instead of LINE_BREAKER attribute [cycledata] LINE_BREAKER = (CycleDataTask finished) SHOULD_LINEMERGE = false the above should work Thanks ... View more

Hi Are you looking for this index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count(devtype) as count & if you are looking for distinct count - index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype) but this only gives the unique values & count of devtype field which is not you are looking for i guess. Thanks ... View more

Hi Check with CLEAN_KEYS setting in props.conf, if it can help. Thanks ... View more

Hi Splunk assigns that sourcetype to files which are having less than 100 lines or 100 events in file. Check the PREFIX_SOURCETYPE in props.conf Thanks ... View more

Hi Go to splunk bin location Ex: 1) ./splunk install app foo.tar 2) ./splunk install app https://splunkbase.splunk.com/app/1603/ Thanks ... View more

Does that means you have Extract-classname in props of searchhead for above extracted fields? Thanks ... View more