Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About cadrija
cadrija
Path Finder
Member since:
02-26-2018
03-05-2025
Community Statistics
| Posts | 41 |
| Solutions | 1 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 02-26-2018 |
Activity Feed
- Posted Re: After Splunk upgrade from 9.2.2 to 9.3.1 getting cmath error in saved search on Splunk Search. 03-05-2025 03:13 AM
- Posted Re: After Splunk upgrade from 9.2.2 to 9.3.1 getting cmath error in saved search on Splunk Search. 03-05-2025 03:11 AM
- Posted After Splunk upgrade from 9.2.2 to 9.3.1 getting cmath error in saved search on Splunk Search. 03-03-2025 10:02 PM
- Tagged After Splunk upgrade from 9.2.2 to 9.3.1 getting cmath error in saved search on Splunk Search. 03-03-2025 10:02 PM
- Posted Re: append new row with few different values kv store on Knowledge Management. 10-24-2024 04:00 AM
- Posted Saved time input to 'All time' as default on page load data is not showing on Dashboards & Visualizations. 06-11-2024 08:54 AM
- Posted Can SignalFX be used on Splunk Enterprise on-premise server? If yes then how to approach. on All Apps and Add-ons. 11-20-2022 09:48 PM
- Posted Re: I have choropleth map in a panel of dashboard, on load map showing Africa by default, how to change it to US on load on All Apps and Add-ons. 12-26-2021 09:21 PM
- Posted I have choropleth map in a panel of dashboard, on load map showing Africa by default, how to change it to US on load. on All Apps and Add-ons. 12-20-2021 11:05 PM
- Posted I have created a pie chart visualization in splunk, I want to change it to doughnut visualization. on All Apps and Add-ons. 12-20-2021 12:15 AM
- Posted How can I show organization's banner at the top of Splunk Dashboard. In my case it is coming below the label & filters. on All Apps and Add-ons. 12-19-2021 09:43 PM
- Posted Re: How to change color of area chart? on All Apps and Add-ons. 12-17-2021 04:18 AM
- Posted Re: How to change color of area chart? on All Apps and Add-ons. 12-17-2021 01:57 AM
- Karma Re: How to change color of area chart? for rrovers. 12-17-2021 01:57 AM
- Karma Re: How to change color of area chart? for isoutamo. 12-17-2021 01:56 AM
- Posted Re: How to change color of area chart? on All Apps and Add-ons. 12-17-2021 01:41 AM
- Posted Re: How to change color of area chart? on All Apps and Add-ons. 12-17-2021 12:15 AM
- Posted How to change color of area chart? on All Apps and Add-ons. 12-16-2021 09:24 PM
- Posted How to remove the Clone option for normal users viewing any dashboard. on All Apps and Add-ons. 12-16-2021 04:49 AM
- Posted Re: I have a table that has batch ID, start & end time of each batch. How can I get the duration i.e. runtime of eac on Dashboards & Visualizations. 12-13-2021 05:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-05-2025
03:13 AM
@gcusello Yes python was upgraded to 3.9 while upgrading Splunk 9.3.1, and it was throwing error to upgrade numpy then I upgraded Numpy to 1.26.0 to make it compatible with the python version.
... View more
03-05-2025
03:11 AM
@livehybrid Yes this is an internally developed app. I tried installing cmath sudo -H ./splunk cmd python3 -m pip install cmath -t /opt/splunk/etc/apps/stormwatch/bin/site-packages But getting error WARNING: The directory '/root/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag. ERROR: Could not find a version that satisfies the requirement cmath (from versions: none) ERROR: No matching distribution found for cmath
... View more
03-03-2025
10:02 PM
We upgraded our Splunk enterprise from 9.2.2 to 9.3.1, after the upgrade one of the app is not working as the related saved search is failing to execute. The saved search is throwing below error. command="execute", Exception: Traceback (most recent call last): File "/opt/splunk/etc/apps/stormwatch/bin/execute.py", line 16, in <module> from utils.print import print, append_print File "/opt/splunk/etc/apps/stormwatch/bin/utils/print.py", line 3, in <module> import pandas as pd File "/opt/splunk/etc/apps/stormwatch/bin/site-packages/pandas/__init__.py", line 138, in <module> from pandas import testing # noqa:PDF015 File "/opt/splunk/etc/apps/stormwatch/bin/site-packages/pandas/testing.py", line 6, in <module> from pandas._testing import ( File "/opt/splunk/etc/apps/stormwatch/bin/site-packages/pandas/_testing/__init__.py", line 69, in <module> from pandas._testing.asserters import ( File "/opt/splunk/etc/apps/stormwatch/bin/site-packages/pandas/_testing/asserters.py", line 17, in <module> import pandas._libs.testing as _testing File "pandas/_libs/testing.pyx", line 1, in init pandas._libs.testing ModuleNotFoundError: No module named 'cmath'
... View more
- Tags:
- search
Labels
- Labels:
-
search job inspector
10-24-2024
04:00 AM
@sivaranjiniG Please let us know the solution as we are facing the same task.
... View more
06-11-2024
08:54 AM
My Splunk instance (Splunk Enterprise Server 9.0.8) is a standalone for demo purpose, hence has only demo data. It should only show data for 'All time' as all the data are of 2022 - 2023. I saved time input to 'All time' as default but on page load it is not showing any data in the whole dashboard. Next I select any other time option and then again on selecting 'All time' whole dashboard starts showing all the expected data. Please help me.
... View more
Labels
- Labels:
-
panel
11-20-2022
09:48 PM
I have installed the available SignalFX plug-in on my Splunk Enterprise instance on-premise server. I tried searching for tutorials/documentations on how to setup SignalFX on Splunk Enterprise on-premise server. But moving forward I got to know that to collect data, the Splunk Distribution of OpenTelemetry Collector should be used, and the steps for it mentions Splunk Observability Cloud. Please help me understand if SignalFX be used for Splunk Enterprise version, if yes then how.
... View more
Labels
- Labels:
-
configuration
12-26-2021
09:21 PM
I have got the solution in the general settings of the visualization. Using the highlighted option automatically took the focused region.
... View more
12-20-2021
11:05 PM
This is the home page for all other dashboard, hence 4 panels are being shown in a row. Each panel drill downs to their specific dashboards. Here on loading of the page the choropleth map is by default showing the map of Africa. But the business wants to show the North & South American continents by default on loading of the page. Is it possible to set the view of the map, like this
... View more
Labels
- Labels:
-
dashboard
12-20-2021
12:15 AM
My current panel looks like this How to make it look like doughnut like below With the total inside the hollow center like this Is there any way to do this, please let me know.
... View more
Labels
- Labels:
-
dashboard
12-19-2021
09:43 PM
How can I show organization's banner at the top of Splunk Dashboard. In my case it is coming below the label & filters. Below is my code snippet. <dashboard theme="light" hideChrome="true" hideExport="true">
<label>*Welcome To Lending Command Center*</label>
<description>Lending Command Center is a collection of visualized data which will provide the client with details on its business at various levels of technology and operations.</description>
<row>
<html>
<center><img src="/static/app/search/Header-black@2x-100.jpg" ></img></center>
</html>
</row>
... View more
Labels
- Labels:
-
dashboard
12-17-2021
04:18 AM
The graph is for Application Operation Insights, I have mentioned all the 3 fields that is used for the graph to check if any one also is responding to the color code. <dashboard theme="light" hideChrome="true" hideExport="true">
<label>*Welcome To Lending Command Center*</label>
<description>Lending Command Center is a collection of visualized data which will provide the client with details on its business at various levels of technology and operations.</description>
<row>
<html>
<center><img src="/static/app/search/Header-black@2x-100.jpg" ></img></center>
</html>
</row>
<row>
<panel>
<html>
<b>
<font size="4" color="#BF17FC" face="graphik"> Business Insights</font>
</b>
<br/>
<b>
<font size="2" color="#D28BFC">Insights on business aspects based on location and pricing options used and overview on areas of business expansions and exposures</font>
</b>
</html>
<map>
<search>
<query>source="VLS_OUTSTANDING_GEO.csv" host="dev-bnk-loaniq-" sourcetype="csv" | rename OST_CDE_TRSRY_AREA as "Country" | stats count by "Country" | geom geo_countries featureIdField="Country"</query>
<earliest>0</earliest>
<sampleRatio>1</sampleRatio>
</search>
<!--<title>Insights on business aspects based on location and pricing options used and overview on areas of business expansions and exposures</title>-->
<option name="drilldown">all</option>
<option name="mapping.choroplethLayer.colorBins">5</option>
<option name="mapping.choroplethLayer.colorMode">categorical</option>
<option name="mapping.choroplethLayer.maximumColor">0x5A4575</option>
<option name="mapping.choroplethLayer.minimumColor">0x62b3b2</option>
<option name="mapping.choroplethLayer.neutralPoint">0</option>
<option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
<option name="mapping.choroplethLayer.showBorder">1</option>
<option name="mapping.data.maxClusters">100</option>
<option name="mapping.legend.placement">bottomright</option>
<option name="mapping.map.center">(0,0)</option>
<option name="mapping.map.panning">1</option>
<option name="mapping.map.scrollZoom">0</option>
<option name="mapping.map.zoom">2</option>
<option name="mapping.markerLayer.markerMaxSize">50</option>
<option name="mapping.markerLayer.markerMinSize">10</option>
<option name="mapping.markerLayer.markerOpacity">0.8</option>
<option name="mapping.showTiles">1</option>
<option name="mapping.tileLayer.maxZoom">7</option>
<option name="mapping.tileLayer.minZoom">0</option>
<option name="mapping.tileLayer.tileOpacity">1</option>
<option name="mapping.type">choropleth</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<link target="_self">/app/loaniq/new_pricing_dashboard</link>
</drilldown>
</map>
</panel>
<panel>
<html>
<b>
<font size="4" color="#BF17FC" face="graphik"> Application Operation Insights</font>
</b>
<br/>
<b>
<font size="2" color="#D28BFC">Insights on the technical aspects of the application for its maintenance and analyze and forecast areas of improvements in the technical operations</font>
</b>
</html>
<chart>
<search>
<query>index=* sourcetype="jackrabbit-3" "userLogInFailed" |timechart count by IPAddress</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.fieldColors">{"_time":0x9932CC, "count":0x9932CC, "IPAddress":0x9932CC}</option>
<option name="charting.axisTitleX.text">Time</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">area</option>
<!--<option name="charting.seriesColors">#D28BFC</option>-->
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<link target="_self">/app/loaniq/userlogin</link>
</drilldown>
</chart>
</panel>
<panel>
<!--<title>Business Operation Insights</title>-->
<html>
<b>
<font size="4" color="#BF17FC" face="graphik"> Business Operation Insights</font>
</b>
<br/>
<b>
<font size="2" color="#D28BFC">Insights on the timely intervals providing understanding of the business operations and how they are performing</font>
</b>
</html>
<chart>
<search>
<query>| dbxquery query="SELECT CUS_CDE_DEPT, CUS_CDE_EXPENSE, CUS_CDE_BRANCH, CUS_TSP_REC_CREATE, CUS_CDE_CUST_STAT, CUS_CID_CUST_ID, CUS_NME_FULL_NAME, CUS_CDE_COUNTRY FROM \"LoanIQDB\".\"LS2USER\".\"VLS_CUSTOMER\" WHERE CUS_CDE_CUST_STAT IN ('ACT','SKEL') " connection="loaniq_10_10_2_10" |eval CUS_TSP_REC_CREATE_epoc = strptime(CUS_TSP_REC_CREATE,"%Y-%m-%d") | eval CUS_TSP_REC_CREATE = strftime(CUS_TSP_REC_CREATE_epoc,"%Y") | eval Year=strftime(now(),"%Y") |where CUS_TSP_REC_CREATE==Year | stats count by CUS_CDE_DEPT | rename CUS_CDE_DEPT as Department</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="charting.fieldColors">{"Department":0x9932CC, "count":0x9932CC}</option>
<option name="charting.axisTitleX.text">Department</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">area</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_self">/app/loaniq/onboarded_customers_</link>
</drilldown>
</chart>
</panel>
<panel>
<!--<title>Infrastructure Operation Insights</title>-->
<html>
<b>
<font size="3" color="#BF17FC" face="graphik">Infrastructure Operation Insights</font>
</b>
<br/>
<b>
<font size="2" color="#D28BFC">Insights on business aspects based on location and pricing options used and overview on areas of business expansions and exposures</font>
</b>
</html>
<table>
<search>
<query>index=* sourcetype="WMI:FreeDiskSpace" PercentFreeSpace<100 | search host=* | where NOT IN (Name,"_Total","HarddiskVolume1") | eval FreeSpace=(FreeMegabytes/1024) | table host, Name, PercentFreeSpace | rename host as Host | rename Name as "Drive Name", PercentFreeSpace as "Free Space in %" | sort by Host, "Drive Name" | sort -_time | dedup Host, "Drive Name"</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<!--<title>Insights on business aspects based on location and pricing options used and overview on areas of business expansions and exposures</title>-->
<option name="drilldown">cell</option>
<format type="color" field="Free Space in GB">
<colorPalette type="minMidMax" maxColor="#DC4E41" minColor="#FFFFFF"></colorPalette>
<scale type="minMidMax"></scale>
</format>
<format type="color" field="Free Space in %">
<colorPalette type="minMidMax" maxColor="#EAB4FC" minColor="#FFFFFF"></colorPalette>
<scale type="minMidMax"></scale>
</format>
<format type="number" field="Free Space in %">
<option name="precision">0</option>
<option name="unit">%</option>
</format>
<drilldown>
<link target="_self">/app/loaniq/os_metrics</link>
</drilldown>
</table>
</panel>
</row>
</dashboard> @isoutamo
... View more
12-17-2021
01:41 AM
I included the this in source file While the page is loading the area is changing colors in the range of blue, the finally setting as grey.
... View more
12-16-2021
09:24 PM
The automatic color of area chart is coming grey. I want it to change to purple color as per the organization's theme. Kindly help me on how to do it.
... View more
12-16-2021
04:49 AM
I want to remove this clone option & the 3 dots option for normal users i.e. for the role = users
... View more
Labels
- Labels:
-
dashboard
12-13-2021
05:31 AM
@ITWhisperer Okay, got it let me check how to get the full date time. Thank you.
... View more
12-13-2021
03:06 AM
I have a table that has batch ID, start & end time of each batch. How can I get the duration i.e. runtime of each batch. When I am running this query then the duration field is coming blank. index="bodata" | where BEX_TSP_START!="NULL" AND BEX_TSP_END!="NULL" | where BEX_DTE_BSNS=="09-12-2021" | eval Duration=strptime(BEX_TSP_END,"%H:%M.%S")-strptime(BEX_TSP_START,"%H:%M.%S") | table BEX_NUM_JOB,Duration Please help.
... View more
Labels
- Labels:
-
panel
12-12-2021
11:16 PM
@gcusello This works! Thanks a lot!
... View more
12-12-2021
11:10 PM
@gcusello Okay let me try this.
... View more
12-12-2021
11:08 PM
Thanks @ITWhisperer
... View more
12-12-2021
10:21 PM
I have the following data in the table. I need to get the duration of the batch running time, I have the start & end time of each date. I need to calculate Batch_End-Batch_Start. Normal eval is not giving me any output. Hence I was thinking of converting the timestamps in epoc & then doing eval Duration=(End_epoc-Start_epoc). For this I need to convert timestamp like 2021-12-09 11:46:50.000069 to epoch time. Please help.
... View more
Labels
- Labels:
-
dashboard
12-08-2021
12:52 AM
@ITWhisperer Kindly help me know if this is possible.
... View more
12-08-2021
12:49 AM
I have data in source which shows Y/N for fields investor, borrower, guarantor, benefic for each customer. Need to show a pie chart that shows count of investor, borrower, guarantor, benefic that are Y based on the customer ID. Like if a customer has only investor = Y, then investor count will be 1 If a customer has all the fields = Y, then all the params count will be 1 only. Below is the data snip index="customerdata" | table CUS_CID_CUST_ID,CUS_IND_INVESTOR, CUS_IND_BORROWER, CUS_IND_GUARANTOR, CUS_IND_BENEFIC User wants to see like this
... View more
Labels
- Labels:
-
chart
12-07-2021
02:54 AM
My current query source="VLS_OUTSTANDING_GEO.csv" host="dev-bnk-loaniq-" sourcetype="csv" | geostats latfield=AREA_LATITUDE longfield=AREA_LONGITUDE sum(OST_AMT_FC_CURRENT) count by OST_CDE_RQST_CCY Giving below field in snip I want to show proper name instead of sum(OST_AMT_FC_CURRENT) in the tooltip. I want to show the summation of the count also in the tooltip. Like this Also is it possible not to show the latitude & longitude in the tooltip.
... View more
Labels
- Labels:
-
stats
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-05-2025
07:24 AM
|
Karma given to
