Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About markthompson
markthompson
Builder
Member since:
09-29-2014
06-05-2020
Community Statistics
| Posts | 243 |
| Solutions | 17 |
| Karma Given | 67 |
| Karma Received | 68 |
| Member Since | 09-29-2014 |
Activity Feed
- Got Karma for Re: Why am I getting error "The license signature is not a base64-encoded string" trying to add my license in Splunk 6.2?. 01-06-2025 02:27 AM
- Got Karma for How to round stats average to 2 decimal places?. 09-13-2023 03:01 PM
- Got Karma for Re: Can an input be enabled or disabled based on another input?. 03-10-2022 02:39 AM
- Got Karma for How to round stats average to 2 decimal places?. 12-23-2020 01:33 PM
- Got Karma for Re: How to make a drop-down form wider?. 06-05-2020 12:48 AM
- Karma Real time search, how to check if event doesn't exist and return something if it doesn't. for DavidHourani. 06-05-2020 12:47 AM
- Karma Re: Is there a URL Prefix variable in Simple XML? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: How can I search and return only the first occurrence of a string? for musskopf. 06-05-2020 12:47 AM
- Karma Can I create a new field for each value contained in an existing field? for mrfredman. 06-05-2020 12:47 AM
- Karma How to search count trends by displaying a 3 column table with source name, count (last 10 min) and count (now)? for vikas_gopal. 06-05-2020 12:47 AM
- Karma Output first event and last event. for ferza. 06-05-2020 12:47 AM
- Karma How to search Splunk indexes' event count for the last one hour including zero counts? for dhavamanis. 06-05-2020 12:47 AM
- Karma Date not parsed if the hour is 24 for reggie_123. 06-05-2020 12:47 AM
- Karma Splunk Time Based Retention for nspatel. 06-05-2020 12:47 AM
- Karma How to edit my inputlookup subsearch to return field values from the csv only if the values were not found? for TobiasBoone. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Karma Re: Where can I find a complete list of data source types that can be indexed in Splunk? for MarioM. 06-05-2020 12:47 AM
- Karma Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group? for 8i5. 06-05-2020 12:47 AM
- Karma Re: How do i file a Splunk Support Case/ contact Splunk Support? for vhallan_splunk. 06-05-2020 12:47 AM
- Karma Re: Using splunk to create and view table metadata for aweitzman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 4 | |||
| 2 |
05-23-2016
05:30 AM
1 Karma
Hi there - that CSS is fine given that you have applied the ID to the tag. If you have it anywhere else, then it would push it.
... View more
05-28-2015
04:46 AM
Hello,
Basically, we want to get the rid of the system fields except _time , but leave the ones it picks up from our event, for example, get rid of date_mday, date_month etc. And keep the custom ones. is there any easy way to do this?
... View more
05-22-2015
04:41 AM
Hello,
Please could anyone provide an insight into how to put custom drill down onto a Single Value that is Icon-Only. So you click, say the red X, and it takes you to a statistics dashboard (Already created), sets a token using GET and displays contents of that dashboard?
Preferably, it would be by clicking on the icon, alternatively, can anyone provide how to redirect a HTML button to a different view?
... View more
05-22-2015
03:16 AM
Found a simple solution to this, just add an eval.
eval Warning={your value} and put that on your graph, then set a series colour, do this as many times as you want.
... View more
05-19-2015
07:11 AM
1 Karma
You will find that rangemap uses the following fields:
none = black
low = green
guarded = blue
elevated = yellow
high = orange
severe = red
default
Hope this helps
... View more
05-19-2015
07:08 AM
I'm confused as to what the problem is here.
Your data, Splunk is picking up the created as being the timestamp. The only issue you might have could be timezones, for example, BST might be adding + 1 hour.
... View more
05-11-2015
05:58 AM
Use the filename arguement.
Syntax: <filename>
Description: Specify the name of a csv file to write the search results. This file should be located in $SPLUNK_HOME/var/run/splunk. If no filename specified, rewrites the contents of each result as a CSV row into the "_xml" field. Otherwise writes into a file (appends ".csv" to filename if filename has no existing extension).
... View more
05-11-2015
05:56 AM
1 Karma
@krish3 @paramagurukarthikeyan
Hello,
Yes you can use the report functionality using the Cog Icon -> Report, and select from the drop down.
Please report any user that infringes the rules so that @piebob 's team can take action against them.
Hope this helps.
... View more
04-28-2015
05:32 AM
Correct answer provided by @ngatchasandra
The selected capabilities may appear to be listed as not on a certain user, however, this is due to the imported capabilities not linking with the available, unselected capabilities.
Make sure you double check both lists.
Also - it may be because you're logged in as the same level, so it might stop you from adding permissions to your own group, I don't know if this is the actual case, but it could be. @ppablo_splunk - is this functionality you know?
... View more
04-08-2015
06:23 AM
Hi Norling,
Which answer are you trying to use? if you're using @stephanefotso 's answer, change eval time=strftime(_time, "%H") to eval time=strftime(_time, "%d/%m/%Y %H:%M:%S")
... View more
04-08-2015
06:16 AM
Hello,
We currently have a dashboard with a traffic light system running on the rangemap single icons. We want to change this to make it more easily visible by changing the color of the whole panel, not just the icon.
How would we do this?
... View more
04-08-2015
06:15 AM
@ppablo_splunk - Please convert this comment to answer and mark as answer. Thanks 🙂
... View more
04-08-2015
01:47 AM
Hi Norling,
Try this;
<searchString> "my base search" | stats count | table _time value | rangemap field=value none=0-99 low=100-199 guarded=200-299
elevated=300-399 high=400-499 severe=500-599 default=none</searchString>
<earliestTime>-15m</earliestTime>
<latestTime>now</latestTime>
<option name="classField">range</option>
<option name="field">value</option
... View more
04-08-2015
12:54 AM
@Norling80 - Have you changed the rangemap? Splunk uses the rangemap field as a judgement.
... View more
04-08-2015
12:45 AM
Hi Norling, give me a chance to get on my instance as we've done this before, I'll get back to you shortly
... View more
04-08-2015
12:38 AM
You've already said that when you did alt and clicked on it, splunk appended NOT - to your search, emulate that and put it in your original search
base search NOT - | ...
Let us know the outcome
... View more
04-08-2015
12:36 AM
1 Karma
Nice indepth answer provided here by @stephane_cyrille , +1
... View more
04-08-2015
12:27 AM
Correct answer by @stephanefotso
Alternatively, you could use the good ole' GUI and adjust the numbers on the Y axis. Click the Edit Panels and then Click the properties drop down -> Y Axis -> Min value and max value
... View more
04-08-2015
12:25 AM
Yep.
Change value to _time
... View more
04-07-2015
07:45 AM
As a shorter way, just include it in your original search index=casm_prod sourcetype=smtrace app=sencer
... View more
04-07-2015
07:43 AM
Also, be aware that you should use the table function inbetween, as it creates an output.
... View more
04-07-2015
07:43 AM
try putting it in brackets WHERE (app="sencer")
... View more
04-07-2015
07:41 AM
I use DistinctCount if I want to achieve a similar outcome.
... View more
04-07-2015
07:38 AM
I am not aware of one - if you can find one, please share.
You could always set up a test index and run it... But if not, your python script should do the trick
... View more
