×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- About aa70627
aa70627
Communicator
Member since:
02-27-2018
02-28-2025
Community Statistics
| Posts | 49 |
| Solutions | 1 |
| Karma Given | 86 |
| Karma Received | 8 |
| Member Since | 02-27-2018 |
Activity Feed
- Karma Re: Deploying onto Search Head pool sometimes causes errors for napomokoetle. 01-05-2023 04:05 PM
- Karma Re: Deploying onto Search Head pool sometimes causes errors for Muryoutaisuu. 01-05-2023 04:05 PM
- Karma Re: Search head Clustering bundle Network-layer error: Read Timeout while applying bundle from deployer for kchaitanya. 01-05-2023 04:04 PM
- Tagged Re: Search head Clustering bundle Network-layer error: Read Timeout while applying bundle from deployer on Deployment Architecture. 01-05-2023 04:04 PM
- Posted Re: Example for Splunk HEC using Java Spring Boot on Getting Data In. 12-20-2022 07:10 AM
- Posted Re: How do I load local jquery and jquery-ui library for a dashboard? on Dashboards & Visualizations. 07-12-2022 05:39 AM
- Posted How do I load local jquery and jquery-ui library for a dashboard? on Dashboards & Visualizations. 07-08-2022 12:38 PM
- Tagged How do I load local jquery and jquery-ui library for a dashboard? on Dashboards & Visualizations. 07-08-2022 12:38 PM
- Tagged How do I load local jquery and jquery-ui library for a dashboard? on Dashboards & Visualizations. 07-08-2022 12:38 PM
- Tagged How do I load local jquery and jquery-ui library for a dashboard? on Dashboards & Visualizations. 07-08-2022 12:38 PM
- Posted Re: Draggable Modal Context Pop-Up on Dashboards & Visualizations. 07-06-2022 04:07 PM
- Posted Running deployers on different service account than the rest of the clustered environment on Splunk Enterprise. 06-24-2022 04:04 PM
- Posted Re: Is it possible to run scripted input on the search peer? on Getting Data In. 05-20-2022 01:37 PM
- Karma Re: Run scripted input on search peer (IDX) for gcusello. 05-20-2022 01:35 PM
- Posted Is it possible to run scripted input on the search peer? on Getting Data In. 05-20-2022 06:59 AM
- Tagged Is it possible to run scripted input on the search peer? on Getting Data In. 05-20-2022 06:59 AM
- Tagged Is it possible to run scripted input on the search peer? on Getting Data In. 05-20-2022 06:59 AM
- Tagged Is it possible to run scripted input on the search peer? on Getting Data In. 05-20-2022 06:59 AM
- Karma Re: Why does my saved search not appear in the navigation bar on a dashboard? for jkat54. 05-19-2022 01:55 PM
- Posted Re: Is there a parmeter for _TCP_ROUTING when using splunk oneshot? on Getting Data In. 03-30-2022 06:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-20-2022
07:10 AM
@nytins yes. The one that is highlighted as answer helped me resolve the issue.
... View more
07-12-2022
05:39 AM
@VatsalJagani just an fyi, only option 2 will load up the js properly. Option #1 and the one from previous post wouldn't work because Js will complain about incorrect path. Having said that, the issue here is that jquery ui has a dependency for jquery to load up first which is why require.conf is required with shim. I've also changed the waitTime from 0 to higher number but once the js is able to load both query and jqueryui, it throws the error noted from my first post
... View more
07-08-2022
12:38 PM
Please help me load jquery-ui into a dashboard xml
Also, can i load the jquery-ui css inside the require.conf? in the browser console, i'm getting this error:
JQuery Version: 3.6.0 VM4289:50 Uncaught TypeError: Cannot read properties of undefined (reading 'ui') at eval (eval at <anonymous> (dashboard.js:1276:187236), <anonymous>:50:20) at Object.execCb (eval at module.exports (dashboard.js:632:662649), <anonymous>:1658:33) at Module.check (eval at module.exports (dashboard.js:632:662649), <anonymous>:874:51) at Module.eval (eval at module.exports (dashboard.js:632:662649), <anonymous>:1121:34) at eval (eval at module.exports (dashboard.js:632:662649), <anonymous>:132:23) at eval (eval at module.exports (dashboard.js:632:662649), <anonymous>:1164:21) at each (eval at module.exports (dashboard.js:632:662649), <anonymous>:57:31) at Module.emit (eval at module.exports (dashboard.js:632:662649), <anonymous>:1163:17) at Module.check (eval at module.exports (dashboard.js:632:662649), <anonymous>:925:30) at Module.enable (eval at module.exports (dashboard.js:632:662649), <anonymous>:1151:22)
require.config({
waitSeconds: 0,
paths: {
'localjquery':'/static/app/myapp/lib/jquery.min',
'jqueryui':'/static/app/myapp/lib/jquery-ui.min'
},
shim: {
'jqueryui': {
deps: ['localjquery']
}
}
});
require([
// 'splunkjs/ready!',
'underscore',
'backbone',
'localjquery',
'splunkjs/mvc',
'jqueryui',
'splunkjs/mvc/simplexml/ready!'
], function (_,Backbone, $, mvc) {
defaultTokenModel = mvc.Components.get("default");
console.log("JQuery Version:");
console.log(jQuery().jquery);
console.log("JQuery-UI Version:");
console.log($.ui.version);
});
Dashboard
<dashboard script="input_slider_range.js" stylesheet="lib/jquery-ui.min.css">
<label>slider range</label>
<row>
<panel>
<html>
SLIDER
<p>
<label for="amount">Price range:</label>
<input type="text" id="amount" readonly="true" style="border:0; color:#f6931f; font-weight:bold;" />
</p>
<div id="slider-range"></div>
</html>
</panel>
</row>
</dashboard>
... View more
Labels
- Labels:
-
javascript
07-06-2022
04:07 PM
@niketn , how do you determine which widget is available as part of the shared contribution? For example, including this seems to work fine 'jquery.ui.draggable' but including other widgets seems to throw an error 'jquery.ui.slider'
... View more
06-24-2022
04:04 PM
Currently we're running our whole environment on a local splunk account for SH, IDX, CM, DS, etc, all on linux os. Is it possible to run different components with different service accounts? Would it be possible to use a different service account, using AD network group for the DS and leave all other components as is (using a local user account)?
... View more
Labels
- Labels:
-
administration
-
configuration
-
installation
05-20-2022
01:37 PM
My initial question was for the scripted input logs within local server. I wanted to run a script form each indexer and send the data to splunk. I was able to confirm it works the same as a scripted input on UF or SH.
... View more
05-20-2022
06:59 AM
Is it possible to run scripted input on the search peer? Also, is it possible to ensure it runs from all search peers ? Thanks ahead of time.
... View more
Labels
- Labels:
-
scripted input
03-30-2022
06:40 AM
how does it determine where to send the oneshot to in this scenario? I've checked both environment and it only sends the SplunkPROD and not both.
... View more
03-29-2022
09:23 AM
I currently have a UF that is sending data to two different Splunk environment.
[monitor:///data/folder1/]
index=main
sourcetype=applog1
_TCP_ROUTING = SplunkTEST
crcSalt = <SOURCE>
[monitor:///data/folder2/]
index=main
sourcetype=applog2
_TCP_ROUTING = SplunkPROD
crcSalt = <SOURCE>
When i run the following oneshot command it sends it to my SplunkPROD. How do i ensure it sends to SplunkTEST? Is there a setting for _TCP_ROUTING
/opt/splunkforwarder/bin/splunk add oneshot /data/data/folder1/app1.log -index main -sourcetype "applog1"
... View more
Labels
- Labels:
-
inputs.conf
-
universal forwarder
02-26-2021
02:00 PM
I'm interested in using select2 js in splunk 8. Does anyone have any example that can help me get started.
... View more
Labels
- Labels:
-
search job inspector
02-26-2021
01:16 PM
@woodcock that's a creative solution ! Nice
... View more
02-10-2021
11:55 AM
i couldn't agree more
... View more
11-18-2020
11:17 AM
I wanted to thank you for this Visual Studio extension. I saw the conf and its a complete game changer. It makes developing, troubleshooting and supporting inhouse app much more manageable . Thank you!!!!!
... View more
11-02-2020
10:26 AM
Thanks @richgalloway . Your answer should be selected as "solution" cuz it definitely answered it for me and solve it for me.
... View more
10-29-2020
12:49 PM
I stumbled upon the documentation for SPL2 for splunk cloud. Are there any plans for SPL2 for Splunk On-premise? https://docs.splunk.com/Documentation/SCS/current/SearchReference/DifferencesbetweenSPLandSPL2
... View more
10-25-2020
09:48 AM
whats "r. Ismo"? Use a REST API to manually trigger DB inputs >> If this documentation covers just viewing the DBX setting via rest, then what exactly is "manually triggered"? There's many scenarios where we simply want to run the DB input 1x after setting it up, examples include: simply testing out the input to ensure we're getting the data we're expecting to see before finalizing it and setting up an proper cron job to ensure it runs more frequently. our ui may be hanging or having other issues which can hamper us from updating the DB connect until issue is resolved. My question arise because of the splunk documentation, which sounds like this may be possible? If its not, then i'll just use the REST input to modify the cron job
... View more
10-23-2020
09:31 AM
Has anyone been able to get this to work "Use a REST API to manually trigger DB inputs" to ,anually trigger DB Inputs with REST API and be able to track the state of its execution (in-process, completed successfully, failed, etc)? When i followed the instructions, it seem to lead to an output that matches to getting the settings for a specific db input. Does anyone know how to run a curl command to remotely trigger or fire a db connect input to run an pull data from sql server to indexer? (this would be the equivalent of modifying the cron job to run 1x through the UI BUT using curl)
... View more
Labels
- Labels:
-
administration
-
development
10-15-2020
04:51 AM
I'm guessing the answer is no. I've taken this with a different approach - using the DB Connect rest api. If anyone knows of a better way for this, please post. Greatly appreciated. | rest splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| table title, updated
| rename title as dbinput_name
| join type=left dbinput_name
[| rest splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| fields title
| map search="| rest splunk_server=localhost /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/$title$/index|eval dbinput_name = \"$title$\", index=value|table dbinput_name index" maxsearches=400]
| join type=left dbinput_name
[| rest splunk_server=va10dlvspl301 /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/
| fields title
| map search="| rest splunk_server=va10dlvspl301 /servicesNS/nobody/splunk_app_db_connect/properties/db_inputs/$title$/sourcetype|eval dbinput_name = \"$title$\", sourcetype=value|table dbinput_name sourcetype" maxsearches=400]
... View more
10-13-2020
03:23 PM
I know you can search for list of all db connect jobs and when they've ran historically within the internal logs, which gets you how long the query ran, # events and error count. Is there anyway to get which index, source and sourcetype it was written to without having to check on the DB Connection inputs ? For example, I'd like to know where it was written and if anything has changed since it ran? index=_internal sourcetype=dbx* status=* input_name
... View more
Labels
- Labels:
-
administration
10-11-2020
06:42 PM
Thanks !!! Greatly appreciated.
... View more
09-25-2020
04:41 PM
1 Karma
Its extensively long. most of them were ignorable based on other splunk answers. This one seems to have caught my attention. info : Your timerange was substituted based on your search string info : [subsearch]: Your timerange was substituted based on your search string warn : The limit has been reached for log messages in info.csv. 52 messages have not been written to info.csv. Refer to search.log for these messages or limits.conf to configure this limit. i used the solution from this one and it resolved my issue. I'm not seeing the error anymore in the past 5 scheduled searches - "Search process did not exit cleanly, exit_code=-1, description="exited with code -1"." https://community.splunk.com/t5/Splunk-Search/After-updating-an-app-why-am-I-getting-search-error-quot-The/m-p/239462 solution Add a limits $Splunk_home$/etc/app/{your_app}/local/limits.conf and add the stanza. [search_info] max_infocsv_messages =1000
... View more
09-25-2020
01:54 PM
how about something like this where you count up number of rows where your unique field occurs. In this example, i've made your unique field a combo of (servername, data1,data2, and data3) | makeresults
| eval servername="one",data1="10",data2="20",data3="30",_time="09-02-2020"
| append
[| makeresults
| eval servername="one",data1="10",data2="20",data3="30",_time="09-01-2020"]
| append
[| makeresults
| eval servername="one",data1="10",data2="20",data3="30",_time="08-31-2020"]
| append
[| makeresults
| eval servername="two",data1="1",data2="2",data3="3",_time="09-02-2020"]
| append
[| makeresults
| eval servername="three",data1="1",data2="20",data3="30",_time="09-02-2020"]
| table servername,data1,data2,data3,_time
| eval uniquefield = servername.data1.data2.data3
| eventstats count by uniquefield
| eval occurence = if(count=1, "single","multiple")
| fields - count, - uniquefield
... View more
09-25-2020
01:20 PM
1 Karma
When i run this query it seems to run just fine as an adhoc search but when i schedule it, it throws the following error [subsearch]: [subsearch]: [SERVER1] Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info. Here's the query. The issue is definitely not space on the drive, there's plenty of space. Also, if I hard code subsearch search index=idx2 earliest=-30d@d latest=now, the scheduled search will work fine but then i would have to add some additional lines of SPL to ensure we are using only the latest pull to avoid duplicate data which takes a little longer to run as well. index=myindex sourcetype="mysource1"
[| metadata index=myindex type=sourcetypes
| search sourcetype="mysource1"
| eval earliest=relative_time(lastTime,"-1h@h")
| table earliest]
| table id1 field1 field2 field3
| join type=left field3
[ search index=idx2
[| metadata index=idx2 type=sourcetypes
| search sourcetype="source2"
| eval earliest=relative_time(lastTime,"-1h@h")
| table earliest]
| rename id as field3
| table field3,f4,f5,f6,f7]
... View more
08-27-2020
06:14 AM
Initially posted this without the filter for distinct count and deleted because |stats values(*) as * would include internal fields that would inflate the number and make it look good so i deleted I reposted after figuring that out found it was better to remove as much noise as possible. bad typo on me this time around on my end
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-28-2025
04:54 AM
|
Karma given to
