About _dave_b

_dave_b · ‎12-30-2016

Hello, I previously posted a question* about Real Time searches, and, thanks to the answers, I was able to achieve what I wanted with my dashboard. However, Real Time searches are expensive. Is there any way to continuously get the current (server) time and use it to perform calculations without performing a Real Time search? * - Question located at http://answers.splunk.com/answers/484057/continuous-display-of-time-since-event.html Thanks for your help!

_dave_b · ‎12-29-2016

Thanks for your answer! I was not aware of the refresh feature before, but now that I am, I am wondering about how it works. Thanks for pointing out the other options that help answer my further questions.

_dave_b · ‎12-29-2016

Thanks! Based off your suggestion, I looked up on how to refresh my dashboard panel, and it now automatically refreshes every 3 seconds or so. Ideally, it would refresh every 1 second, but 3 seconds is good enough for now.

_dave_b · ‎12-29-2016

Hello, I have made a dashboard that searches for an event, displays the time-stamp of that event, and the time elapsed since that event (by calculating the difference in epoch times between the event and the current time). My problem is that the elapsed time stays static, when it needs to be calculated and displayed continuously in real time. Can anyone offer any ideas or examples of how to achieve this? Thanks!

_dave_b · ‎03-24-2016

The problem is the result object isn't de-referencing the ReportDate value as expected. That result object seems key for accessing values from the search.

_dave_b · ‎03-24-2016

I get Today's Date is $result.ReportDate$

_dave_b · ‎03-24-2016

Hello. I'm trying to construct a footer containing my app's version in a dashboard. The footer resides in a different panel. I can find the version from a search, but I haven't found a way to pass that value into the lower panel. It seems like this can be done by using tokens , but my research hasn't revealed a way to do this specifically. Conceptually, I want the dashboard code to work like this: Panel1: <query>| rest /servicesNS/nobody/system/apps/local/ | search title="MyApp" | table title version</query> Panel2: < html >< center >< h8 >< img src="/static/app/MyApp/appLogo.png" / > MyApp version $version$< /h8 >< /center >< /html > Any helpful pointers or references would be greatly appreciated! Thanks

_dave_b · ‎03-23-2016

Ok! Thanks to your help, I am now able to pull the Version number straight from the app.conf file. Now my quandry is how do I move that number from the Splunk results table that it's in into a line of html on my dashboard?

_dave_b · ‎03-22-2016

Thanks MuS. That helps by pointing me towards REST, but I don't see a section in the REST API Reference Manual that shows me how to access the contents of app.conf

_dave_b · ‎03-21-2016

Hello. Is there a way to set a global environment variable in Splunk so that it can be shared and used multiple times between scripts? Specifically, I want to set the version number in my app.conf to a value, then re-use that value later on in the dashboard/XML page for the app. So my app.conf would look like [launcher] version=[VERSION_NUM] And the footer of my dashboard.js/xml would look like < Dave B's App Version > < [VERSION_NUM] > And VERSION_NUM gets defined in some other, external config file So basically I want to be able to set VERSION_NUM once, and use it repeatedly and consistently. A little preliminary research reveals that maybe it can be done with REST. Is there a faster way? Thanks!

_dave_b · ‎02-10-2016

I added a line that looks like this: < view name="mydashboard" default='true' /> This gets me closer, but only as far as showing the list of dashboards. It seems like Splunk doesn't recognize "mydashboard" as a view, like it does with "search" or "dashboards". I don't want the user to see the list, I want the user to see the dashboard instantly. I don't want them to go through the trouble of choosing the dashboard.

_dave_b · ‎02-10-2016

Ah, those are the docs that confuse me. They list some example xml like < nav > < collection label="Ponies" > < view name="mydashboard" /> < collection > Yet, in my Splunk-generated xml files, there is no mention of any collection tags. So I am confused. What is this collection tag for and what does it do?

_dave_b · ‎02-10-2016

Hello, I want to tweak my app so that a dashboard view from the file "MyDashboard.xml" is the default view, and the user won't have to click on "Dashboards->MyDashboard" menu items. I searched the docs, but they weren't totally clear to me on how to do this. Thanks for any words of wisdom you can provide!

_dave_b · ‎02-03-2016

Hello, I'm packaging an app for install on another server. I've got it tarred and zipped. The final step on the Windows packaging instructions says it's now ready for upload to Splunkbase. I don't want to upload it to Splunkbase, I want to keep some privacy and transfer it via my intranet. Will it still install properly if I do this? Does it need Splunkbase to install properly? Thanks for your help.

_dave_b · ‎02-02-2016

Hey skoelpin, my sourcetype issue appears to have been solved! I'm a little tenuous on putting this issue to rest, because I've tried several different methods, but the last thing I tried was setting it via Splunkweb. I also changed the inputs and props.conf files in $SPLUNK_HOME/etc/system. They didn't seem to take effect at first, but maybe there was a delayed reaction.

_dave_b · ‎02-02-2016

I'm still having the same problems. Different sourcetypes are being included in the events, so that's at least some progress, but the fields still aren't being extracted. I guess I will try using a different command, like report or transform...

_dave_b · ‎02-01-2016

I restarted the Splunk service, _bumped my version number, my indexer is the same machine my forwarder. My props.conf looks like [source::c:\\Program Files\\OS_Log\\*\\OS_LogType-TS*.txt] [OS_LogType-TS] EXTRACT-deviceIdAndCorrelationId = \[\S+\-(?P[0-9A-Ha-h]{8})\/(?P[\S]{32})\] and my inputs.conf looks like `[source::c:\\Program Files\\OS_Logs\\*\\BES12_BSCP-TS*.txt] disabled = false host = $decideOnStartup sourcetype = BES12_BSCP-TS` And I thought the deviceIdAndCorrelationId field should show up in the web interface under extracted fields for my app, but it isn't there.

_dave_b · ‎02-01-2016

What about when the sourcetype is named OS_LogType-TS1, or OS_LogType-TS2? I changed the inputs.conf in my app's local directory to look like what you said it should look like, but I am still getting no results. My sourcetypes keep changing with numbers appended to their names. I briefly had some success, but that was by changing the the props.conf file in the system directory. But since I plan on exporting this, app I need to keep all of my custom conf files in local, so that change couldn't apply.

_dave_b · ‎02-01-2016

According to the docs for props.conf , sourcetype can be used as a spec for a stanza, so that's what I did, in hopes that the sourcetype would be more closely associated with my custom field extractions.

_dave_b · ‎01-29-2016

Thanks. It still doesn't work, though 😞

_dave_b · ‎01-29-2016

That's a good idea. I've tried that, so my inputs.conf now looks like [monitor://c:\Program Files\Blackberry\BES\Logs\*\BES12_BSCP-TS*.txt]

_dave_b · ‎01-29-2016

Thanks for your reply. I just did a global search checked the sourcetype . The sourcetype specified in the search has changed. Originally it was 'sourcetype-ts', Splunk appended 'too_small', so now it's being reported as 'sourcetype-too_small'. Why does Splunk do this and how can I get around it? A little searching tells me Splunk does this to CSV files when it gets confused by them, but my log files aren't CSV, they just plain text, formatted with date-time stamps. I edited props.conf in the $SPLUNK_HOME\etc\system\local to like this: [source::c:\Program Files\OS\Logs\*\LogType-TS*.txt] sourcetype=OS_LogType-TS where the first * wildcard is there to consume a YYYYMMDD value and the second * wildcard consumes anything that may get appended by Splunk, like too-small . I was hoping that all the sourcetypes with 'too-small' appended to the name would be read

_dave_b · ‎01-28-2016

Hey there, I made an app. It worked good and extracted data exactly the way I wanted it to. I am now trying to duplicate the app, using the same custom field extractions, but some key fields aren't being extracted, despite using the exact same regex as before! The permissions are global for all objects in the app. Anybody have any ideas why my fields won't get extracted? Thanks

_dave_b · ‎01-20-2016

Hi folks, The simplexml examples provided great help when I was creating a dashboard with icons. Now, I want to do something a little different - add a fourth icon for a fourth range. I've downloaded my fourth icon, but how do I tell Splunk I want to use it? I see in the table_icons_inline.js file where the 'alert-circle' , 'alert' , and 'check' icons are assigned, but I don't see where Splunk knows how to retrieve those icons from the filesystem and associate them with those names. If I knew how it did that, then I could use my fourth icon in the the .js file. Can anyone help? Thanks!!

_dave_b · ‎12-30-2015

Hello esteemed Splunkers, I am trying to create a new app with dashboard visualizations. Previously, I created my own dashboard in the simplexmlexamples app, using table_icons_inline.js , and it works and looks great. However, I wanted to branch out and run the dashboards in an app of my own. So I did everything over again, thinking I would get the same results. But I don't, and I don't see why. Here's what I did: -copied table_icons_inline.js and table_decorations.css into [ My app's directory ]\appserver\static , just like I did when making the dashboard within the context of the simplexmlexamples app. -copied the relevant xml into my new dashboard, especially the important table id="" assignment _bump ed the version number I don't see the alert icons anywhere in my new dashboard. Is there anything else I should have done? Thanks for your attention to my question

Posts	75
Solutions	2
Karma Given	27
Karma Received	10
Member Since	‎10-28-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Display Real Time Calculations Without a Search

Continuous Display of Time Since Event

How to pass search result from one Panel to a diff...

Global Environment Vars Shared Between Scripts?

How do I set my app's start view to be the dashboa...

If I package an app to transfer to another server,...

Fields that were once extracted aren't being extra...

Simple XML Dashboard Examples: How to add a new ic...

Can't see Dashboard Visualizations in New App

Why isn't ancient entry ignored despite `ignoreOld...

Display Real Time Calculations Without a Search

Re: Continuous Display of Time Since Event

Re: Continuous Display of Time Since Event

Continuous Display of Time Since Event

Re: How to pass search result from one Panel to a ...

Re: How to pass search result from one Panel to a ...

How to pass search result from one Panel to a diff...

Re: Global Environment Vars Shared Between Scripts...

Re: Global Environment Vars Shared Between Scripts...

Global Environment Vars Shared Between Scripts?

Re: How do I set my app's start view to be the das...

Re: How do I set my app's start view to be the das...

How do I set my app's start view to be the dashboa...

If I package an app to transfer to another server,...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Re: Fields that were once extracted aren't being e...

Fields that were once extracted aren't being extra...

Simple XML Dashboard Examples: How to add a new ic...

Can't see Dashboard Visualizations in New App