thank you very much @Sukisen1981. but is the example code above related to the new screenshot ? I cannot find any Field1-2-3 there best regards Altin PS. as for the positioning of the inputs above above - I have done exactly that - but it doesn't work ... View more

I am sorry but I am not getting this. If I hide the Submit button, then how shall I run again the "first" search? let us say I change the time range - which is part of the first. best regard Altin PS. to say the truth I went for the Submit button because of some strange behavior and pain I encountered when working with some master-slave drop-downs - just asked a new Question on that ... View more

"Have field1 at a master level outside the panel for the remaining 2 fields and the remaining 2 filters inside the panel housing the stats table?" A. Yes "place the submit button after filed1" A. field1 is time input element. submit is AFTER that (to the right of time) I didn't got the rest, how can I achieve the search-on-change thanks and regards Altin ... View more

unfortunately it is not. the inputs have to be set by the user - and reload go on regards Altin ... View more

Hi I did the change to 1025 - it didn't work. and I turned it again to 9998 - same result. In both cases, when I start Splunk I have the following output: [splunk@srvsplunk bin]$ ./splunk start Splunk> CSI: Logfiles. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _telemetry _thefishbucket history main omega_ca_nt omega_ds omega_ds_idx_01 omega_nt_ora summary Done Checking filesystem compatibility... Done Checking conf files for problems... Invalid key in stanza [dbx_java_installation_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 17: doc_title (value: DB Connect JVM installation). Invalid key in stanza [dbx_driver_installation_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 41: doc_title (value: DB Connect JDBC Driver installation). Invalid key in stanza [dbx_connections_configuration_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 69: doc_title (value: DB Connect connection configuration,DB Connect identity configuration). Invalid key in stanza [dbx_data_lab_configuration_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 85: doc_title (value: DB Connect input configuration,DB Connect output configuration,DB Connect lookup configuration). Invalid key in stanza [dbx_java_server_configuration_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 98: doc_title (value: DB Connect Java Server configuration). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at http://127.0.0.1:8000 to be available........ Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://srvsplunk:8000 the very strange thing on the above - is that the startup problems DO NOT appear with the 9998 port as an original setting after the DB Connect App Install, but they DO appear even when the port is set again to 9998 (after trying 1025). regards Altin ... View more

I did the change to 1025 - it didn't work. and I turned it again to 9998 - same result. In both cases, when I start Splunk I have the following output: [splunk@srvsplunk bin]$ ./splunk start Splunk> CSI: Logfiles. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _telemetry _thefishbucket history main omega_ca_nt omega_ds omega_ds_idx_01 omega_nt_ora summary Done Checking filesystem compatibility... Done Checking conf files for problems... Invalid key in stanza [dbx_java_installation_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 17: doc_title (value: DB Connect JVM installation). Invalid key in stanza [dbx_driver_installation_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 41: doc_title (value: DB Connect JDBC Driver installation). Invalid key in stanza [dbx_connections_configuration_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 69: doc_title (value: DB Connect connection configuration,DB Connect identity configuration). Invalid key in stanza [dbx_data_lab_configuration_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 85: doc_title (value: DB Connect input configuration,DB Connect output configuration,DB Connect lookup configuration). Invalid key in stanza [dbx_java_server_configuration_health_check] in /opt/splunk/etc/apps/splunk_app_db_connect/default/checklist.conf, line 98: doc_title (value: DB Connect Java Server configuration). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at http://127.0.0.1:8000 to be available........ Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://srvsplunk:8000 the very strange thing on the above - is that the startup problems DO NOT appear with the 9998 port as an original setting after the DB Connect App Install, but they DO appear even when the port is set again to 9998 (after trying 1025). regards Altin ... View more

thank you, but how can this be performed when I am re-directed to the URL? http://192.168.1.71:8000/en-US/app/splunk_app_db_connect/ftr#/welcome?_k=hkfaxp which then hangs. the original (title) message "Can not communicate with task server, please check your settings." - I can fully see only with a Print-screen to Bmp regards Altin ps. and I did all on the URL given above to no result ... View more

Your answer is correct @493669 remove of the NT_EVENT_ID= made it. I think my initial "Search is waiting for input...." happened because I hadn't refreshed the form. The DB_NAME is OK whenever as a value or as * Thank you very much, best regards Altin ... View more

thank you very much I did that and I do get "Search is waiting for input...." in every multi-select combination ... View more

thank you very much @493669 but code pasted looks the same did you mean replace <valuePrefix>NT_EVENT_ID ="</valuePrefix> with <valuePrefix>"</valuePrefix> ? best regards Altin ... View more

It is an existing input that is not displayed. It is set to * default at the input element (dropdown). ... View more

Thank you very much @nikita_p and @niketn I added the debug table title and get the following result (tested with a Database set to *) Multiselect Output Empty "" - $field_nt_event_id$ All "" - (NT_EVENT_ID ="") 44444 "" - (NT_EVENT_ID ="4") 88888 "" - (NT_EVENT_ID ="8") 44444 and 88888 "" - (NT_EVENT_ID ="4" OR NT_EVENT_ID ="8") best regards Altin ... View more

Resolved - by advise of Mr. niketnilay and Mr. DalJEanis. Resolved by using both: 1. drop-down label - for unchanged display of information (no add-remove Backslash 2. drop-down value - for using Backslash escaping searching a filed containing such. I am putting the working code here for rookies like me. The change consisted only in using OS_USER_VALUE in the drop-down - first part. .......................................................................................... <input type="dropdown" token="field_os_user" searchWhenChanged="true"> <label>OS User</label> <fieldForLabel>OS_USER</fieldForLabel> <fieldForValue>OS_USER_VALUE</fieldForValue> <search> <query>.............. | DEDUP OS_USER | FIELDS OS_USER | eval OS_USER_VALUE=replace(OS_USER,"\\\\","\\\\\\")</query> <earliest>$field_time.earliest$</earliest> <latest>$field_time.latest$</latest> </search> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> </input> .......................................................................................... <table> <title>NT records</title> <search> <query>.............. | search OS_USER = $field_os_user$ | table _time .......................................... </query> <earliest>$field_time.earliest$</earliest> <latest>$field_time.latest$</latest> </search> <option name="rowNumbers">true</option> </table> .......................................................................................... The second part has not changed, is put just to see the rest - and to underline the fact that the solution is smartly framed in the drop-down area only - very very nice !!! thanks and best regards Altin ... View more

and also - a coding for every possible backslash-ed value of the field? <query>| makeresults | eval OS_USER="administrator" | append [| makeresults | eval OS_USER="NT AUTHORITY\SYSTEM"] | append [| makeresults | eval OS_USER="DEV001\Administrator"] | fields - _time | eval OS_USER_VALUE=replace(OS_USER,"\\\\","\\\\\\")</query> </search> .................................................................. these 3 users are just an illustration. there can be hundred users, and even more! should I write 10 lines of extra code - hard-coded for each option, of each field? best regards Altin ... View more

but if it takes so much with a single field, what would be for a dataset of 100 fields, where some 20/30 of them do have a backslash in content? regards Altin ... View more

tried also with CDATA <query> `mc_sysdba` | search OS_USER =<![CDATA[$field_os_user$]]> | table _time DB_HOST NT_RECORD_NO OS_USER | sort - _time NT_RECORD_NO </query> same behavior again - backslash-ed options return no records ... View more

thank you very much for your help Sir, but I didn't got a clue on the last posts, unfortunately less and less on each one. may be it is my fault, may be it is not. I browsed the forum and found no solution on this case, only some gray answers, not green ones. I will remove or replace the backslash in origin and not feed it at all to Splunk - which seems to me has a "digestion" problem with it, 🙂 thank you anyway for your efforts best regards Altin ... View more

Truly my drop-down is to be populated dynamically. I made a static version here for the sake of simplicity. As for the above - sorry - it was somehow confusing. I am going to Paste the whole code below: <form> <label></label> <fieldset submitButton="false"> <input type="time" token="field_time"> <label>Time</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="field_os_user" searchWhenChanged="true"> <label>OS User</label> <fieldForLabel>OS_USER</fieldForLabel> <fieldForValue>OS_USER</fieldForValue> <search> <query>`mc_sysdba` | DEDUP OS_USER | FIELDS OS_USER</query> <earliest>$field_time.earliest$</earliest> <latest>$field_time.latest$</latest> </search> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <table> <title>SYSDBA records</title> <search> <query>`mc_sysdba` | search OS_USER = $field_os_user$ | table _time DB_HOST NT_RECORD_NO OS_USER | sort - _time NT_RECORD_NO</query> <earliest>$field_time.earliest$</earliest> <latest>$field_time.latest$</latest> </search> </table> </panel> </row> </form> tried the above with: | search OS_USER = $field_os_user|s$ but this case it was no result for all cases - Administrator and * included As seen above - the drop-down's OS Users are derived with a Dedup from a certain "dataset". What I need to realize is: 1. See the OS user values as they are with their own single backslash "\" - in both drop-down and table. 2. Be able to search the table with a backslash-ed OS User at your disposal for further queries thanks and regards Altin ... View more

Thank you very much for your answers. I tried quotes round the token - and it returned no records in all cases. The token is already quoted start and end. Furthermore, the fields must appear as they come - without being changed. This means the values in the drop-down should be in original: NT AUTHORITY\SYSTEM DEV001\Administrator and not: NT AUTHORITY\\SYSTEM DEV001\\Administrator I guess this drops the solution with $Label$ ? In first place I was looking for some kind of general quotation in Splunk, which once encapsulating a string - this later can have anything inside and still creates no problem ? Most RDBMS-s have this, and I wish Splunk too, cause if it doesn't, that will be a bad news. best regards Altin ... View more

Thank you Sir I didn't exactly got the part "from underneath the dash", but I am pasting below the code for drop-down and search: <input type="dropdown" token="field_os_user_aa"> <label>field1</label> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> <choice value="Administrator">Administrator</choice> <choice value="NT AUTHORITY\SYSTEM">NT AUTHORITY\SYSTEM</choice> <choice value="DEV001\Administrator">DEV001\Administrator</choice> </input> </fieldset> <row> <panel> <table> <title>SYSDBA records</title> <search> <query>`mc_sysdba` | table DB_HOST DB_NAME NT_RECORD_NO USERNAME OS_USER TERMINAL RETURNCODE ACTION_CMD | search USERNAME = $field_username$ OS_USER = $field_os_user_aa$ | sort - _time NT_RECORD_NO</query> <earliest>$field_time.earliest$</earliest> <latest>$field_time.latest$</latest> </search> </table> </panel> </row> thanks and best regards Altin ... View more

No Sir no third parties only Simple XML my app is meant to be this way - at least in its initial version. I think I will satisfy myself with a: 1. Manual Index install 2. Manual TCP Input creation I might also look to implement both in a setup.xml Let me ask you one more question please. I did the following test. 1. Installed app_name.spl (with built-in index creation) 2. populated the app with some data and confirmed data presence 3. delete the app by stop-splunk and delete app-dir in /etc/app 4. after splunk restart I noticed that the index was not present anymore on the GUI 5. installed the same app_name.spl again. Nothing failed, kind of "index xxxxx already exists" - very good! after this I noticed in the app that the "old" index data were preserved and during the install the existing index's data were not erased by a new empty index. This is very good too, but I need to know: Is this the always behavior of the .spl install ? If yes - will this continue in the future otherwise I think I will go for a manual index create/setup too thanks and best regards Altin ... View more