Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About VatsalJagani
VatsalJagani
Champion
Member since:
02-15-2018
Online
Community Statistics
| Posts | 788 |
| Solutions | 104 |
| Karma Given | 101 |
| Karma Received | 178 |
| Member Since | 2018-02-15 |
Activity Feed
- Posted Re: How to populate a dropdown using a search SPL query in Dashboard Studio? on Dashboards & Visualizations. 3 hours ago
- Posted Re: How to create multiple tabs in splunk dashboard studio? on Dashboards & Visualizations. 7 hours ago
- Got Karma for Re: How to create multiple tabs in splunk dashboard studio. 7 hours ago
- Posted Re: Help getting field extraction from information in field=source on Getting Data In. 7 hours ago
- Posted Re: How to populate a dropdown using a search SPL query in Dashboard Studio? on Dashboards & Visualizations. yesterday
- Posted Re: Help getting field extraction from information in field=source on Getting Data In. yesterday
- Posted Re: Why is one field not been extracted as expected? on Splunk Search. yesterday
- Posted Re: Dell EMC Isilon Add-on for Splunk Enterprise on All Apps and Add-ons. Tuesday
- Got Karma for Re: Dynamic Dropdown Uniqueness Issue- Is it possible to retain all the values of x?. Tuesday
- Posted Re: Field extraction needed on Splunk Enterprise. Tuesday
- Got Karma for Re: How to create a search that will show other fields like dest_bunit with the port?. Tuesday
- Posted Re: How to refresh on specific panel with other dashboard after click? on Dashboards & Visualizations. Tuesday
- Got Karma for Re: Upgrade Readiness App: splunkbaseapps.csv for app updates. Tuesday
- Posted Re: Dynamic Dropdown Uniqueness Issue- Is it possible to retain all the values of x? on Dashboards & Visualizations. Monday
- Posted Re: How to create a search that will show other fields like dest_bunit with the port? on Splunk Search. Monday
- Posted Re: How to refresh on specific panel with other dashboard after click? on Dashboards & Visualizations. Monday
- Posted Re: Upgrade Readiness App: splunkbaseapps.csv for app updates on All Apps and Add-ons. Monday
- Posted Re: How to create multiple tabs in splunk dashboard studio on Dashboards & Visualizations. Monday
- Got Karma for Re: How to update all alert parameters via post api?. Sunday
- Posted Re: Why won't Splunk start even with the daemon (splunkd) already running [failed]? on Splunk Enterprise. Sunday
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
3 hours ago
Reference to create dataSource - https://docs.splunk.com/Documentation/Splunk/8.2.6/DashStudio/dsOpt
... View more
7 hours ago
@harrysplunk - Sorry, but no idea. Customization with your JS is very far it seems for dashboard studio. No idea if they have plan to add native supports for tabs or not.
... View more
7 hours ago
@harry17preet - props.conf (HF) [my:api:ce2]
TRANSFORMS-extract_instance = extract_instance transforms.conf (HF) [extract_instance]
SOURCE_KEY = MetaData:Source
REGEX = \/(.+\/)(?:[^_]+_[^_]+_[^_]+_)(?<instance>[^_]+)
WRITE_META = true fields.conf (SH) [instance]
INDEXED = true Please note you have to deploy props.conf and transforms.conf at HF (indexing level) and fields.conf on SH. Also, not that at index time source value (MetaData:Source) will be prefixed by "source::", but I think your regex will still work, but please confirm on your end. (Reference/Doc - https://docs.splunk.com/Documentation/Splunk/latest/Admin/transformsconf ) I hope this helps!!! Karma/upvote would be appreciated.
... View more
yesterday
@mihir_hardas - You can set dataSource to your inputs. And add a search as dataSource. "inputs": {
"input_RtgCL23i": {
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "user"
},
"title": "Select user",
"type": "input.dropdown",
"dataSources": {
"primary": "ds_eiFyjWZU"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"user\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"user\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
}, Examples picked from this page - https://docs.splunk.com/Documentation/Splunk/8.2.6/DashStudio/inputs#Example:_Search-based_cascading_inputs there are other examples also there. I hope this helps!!
... View more
yesterday
@harry17preet - EXTRACT is a search-time parameter. You need to add on the Search Head and not on HF.
... View more
yesterday
@glpadilla_sol - Try searching like this: index=bar foo="*hello*" | where foo="hello" (added wildcard(*) in the search command.) I hope this helps!!!
... View more
Tuesday
@splunker1993 - You need to add a server certificate into your Splunk instance and set the path of the certificate file as described here. Alternatively, you can disable the certificate check but that will communicate over an unencrypted channel. Both options describe here in the doc: https://splunkbase.splunk.com/app/2689/#/details I hope this helps!!!
... View more
Tuesday
@mbasharat - I've tested in regex101. Please check here to see if you are getting what you need - https://regex101.com/r/DoWz5Q/1 Of course, I'm not gonna test in a live environment because my environment will not have this data. Generally, the preferred practice is that you test all configuration changes in a staging environment. I hope this helps!!!!
... View more
Tuesday
@beginner1 - To pass the token from the right panel you need to make use of the URL. Ex. /en-US/app/<my-app>/second_dashboard?my_token=$my_token$form.my_token=$my_token$ (please take care of URL encodings as require) - I would suggest setting both form.<token-name> and just <token-name>. (for safer side) It cannot be synced the other way around. (from right side to left side panel) because of security restrictions of the HTML iframe component.
... View more
Monday
1 Karma
@BrentHetherwick - Here for the dropdown: Field for Label - is like the title Field for Value - is like the ID Hence ID has to be unique. Now Field for Label and Field for Value both could be the same field does not necessarily have different fields. Now if you want X as value and title both, and as you mentioned X is unique. For Y you cannot do that same because Y value is not unique. Or you can try updating this query while keeping everything else in the current state to see if this works what you expect or not: | inputlookup LT | fields X, Y | stats values(X) as X by Y | eval X=mvjoin(X, ", ") I hope this helps!!! Karma/upvote would be appreciated!!!
... View more
Monday
1 Karma
Or this: | tstats `summariesonly` count as dest_bunits from datamodel=EndPoint.Port by Endpoint.Port.dest_port, Endpoint.Port.dest_bunit If not, try below: | tstats `summariesonly` count as dest_bunits from datamodel=EndPoint.Port by Port.dest_port, Port.dest_bunit I hope this helps!!!
... View more
Monday
@beginner1 - You can try the below solution. I personally have not tried it. But this sounds interesting. You can use an HTML iframe. Something like this in your dashboard XML code. <row>
<panel>
... panel in which you are having links to dashboards ...
... when user clicks a link set a token (tkn_dashboard_url) with the URL in the value ...
... use relative URL, don't put search head IP in it so it can be reused ...
</panel>
<panel>
<html>
<iframe src="$tkn_dashboard_url$" title="Iframe for the dashboard on the right."></iframe>
</html>
</panel>
<row> I've no idea how this will go but give it a try, logically I think it should work. Hope this helps!!! Karma/upvote would be appreciated!!!
... View more
Monday
1 Karma
@nishikubom - Readiness App is built by Splunk itself, so I'm not sure about its release. But in general, if you are sure that the App's latest version (that you are using) is python3 compatible you should not worry about it. As that was the sole purpose of the Readiness app, to tell you which App is not compatible with the new Splunk version 8.x and python3 at the time when it was initially created. I hope this helps!!! Karma/upvote would be appreciated!!!
... View more
Monday
1 Karma
@harrysplunk - Currently it's not possible in Dashboard studio. Also, with simple XML alone I think you cannot do that, you need to use Javascript to achieve that. In dashboard studio, you cannot include a JS file currently. I hope this helps!! Karma/upvote would be appreciated!!!
... View more
Sunday
@Judeumeh - Do you mean you are seeing "[failed] splunkd is already running error" while running "splunk start" command? * That basically means your Splunk is already running. * Maybe you are just not able to access Splunk UI. * Check firewall rules to see if Splunk web port (default 8000) is accessible outside the machine if you are not using the browser locally on the machine. I hope this helps!!!
... View more
Sunday
@ang3loliveira - You have two options: You have a report/alert already scheduled and running and you want to export the results of last execution. Use the REST API solution as provided by @aasabatini You have report but not schedule and running. Use Python SDK to run and get results and then use few lines in python script to send data to where you want to. https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearchespython/ Note that you can do first REST API call also with Python-Splunk-SDK. I hope this helps!!! Karma/upvote would be appreciated!!!
... View more
Sunday
@mbasharat - Try this regex: [\r\n]+(?<_KEY_1>[^\n:]+):(?<_VAL_1>[^\r\n]+) I hope this helps!!!!
... View more
Sunday
@Santosh2 - You can take some predefined steps in case of data input issues: Check if you have inputs.conf entry for these files Have you specified the right index? Have you created that index on the Indexer? Make sure you are not filtering the data with transforms.conf config check for queue=null line in transforms.conf If you see any, make sure it's not related to your data Make sure you are receiving other data from that host. index=_internal host=<hostname-that-has-inputs.conf> Make sure you have permission to read the index data and also make sure no other restriction being applied. You can check with Splunk Admin. I hope this helps!!! Upvote/karma would be appreciated!!
... View more
Sunday
1 Karma
Hello @mosh , I'm a Splunk Community moderator here. I'm glad that you figured out the answer to your own question. You can accept your own answer by clicking "Accept as Solution". This may be helpful for other users visiting your question in the future. Happy Splunking!!!
... View more
Sunday
@utk123 - You can use a regular bar chart available in Splunk (though as mentioned by @gcusello you also have the option to use custom visualization/charts from Splunkbase) You can use the timechart command to generate the results. It's difficult to form an exact Splunk query without looking at data formats. I hope this helps!!
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
7 hours ago
|
Karma from
Karma given to
