About D2SI

D2SI · ‎10-21-2020

Thanks a lot!

D2SI · ‎10-21-2020

Hello there! Is there a known method (a function, a command, built-in or custom, a search trick) to convert the earliest_time and latest_time notation to epoch for instance? For instance, I need to convert this: earliest_time -15m@m latest_time -5m@m into an epoch timestamp so I can calculate the interval between them. As the notation is flexible, I want to check if there is something available already rather than try to build a dirty search that would try to cover every variation of the notation. Thanks in advance for any hint!

D2SI · ‎09-07-2020

Awesome, thanks @niketn 🙏 !!

D2SI · ‎09-07-2020

Nice workaround indeed 😂

D2SI · ‎09-07-2020

Thanks a lot for the suggestion @thambisetty! It's a good idea! I am sorry I might have been unclear in my post, the link input is kind of a button for the text box to validate what is typed in it, so I am trying to keep it close to the textbox and center both elements as a whole. I got this: I am trying to have this: And so far I was just to able to center it a little with margin-left, but it fails apart with any resolution or screen change. <form> <label>Center Inputs Mix</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input id="textbox_2" type="text" token="text_2_tok"> <label></label> <default>Test2</default> </input> <input id="link_button_2" type="link" token="link_2_tok"> <label></label> <choice value="true">✔️</choice> </input> </panel> <panel> <input id="textbox_1" type="text" token="text_1_tok"> <label></label> <default>Test1</default> </input> <input id="link_button_1" type="link" token="link_1_tok"> <label></label> <choice value="true">✔️</choice> </input> </panel> </row> <row> <panel> <html> <style> #link_button_1 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"], #link_button_2 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ width: 23% !important; } #link_button_1 button, #link_button_2 button{ border-color: #C3CBD4 !important; background: #F7F8FA !important; } </style> </html> </panel> </row> </form>

D2SI · ‎09-07-2020

Did not realized that! Thanks a lot!

D2SI · ‎09-07-2020

Hello there! I am struggling to reduce the top margin on a panel with a text input and a link input using CSS. I want to reduce top-margin and still have both elements aligned horizontally: What I wish: If I use 'display: flex', the top margin applies but the button moves under the textbox: display : flex; margin-top: 0vw !important; Without 'display: flex' elements remain aligned but the top margin just does not apply: margin-top: 0vw !important; I have tried several display / flex options without luck so far. My test dashboard: <form> <label>Panel Height</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input id="textbox_1" type="text" token="text_1_tok"> <label></label> <default>Test1</default> </input> <input id="link_button_1" type="link" token="link_1_tok"> <label></label> <choice value="true">A</choice> </input> </panel> </row> <row> <panel> <html> <style> #link_button_1 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"], #link_button_2 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ width: 23% !important; } #link_button_1 button, #link_button_2 button{ margin-right: 10px; } #textbox_1, #textbox_2{ margin-left: 8vw; } #link_button_1, #link_button_2, #textbox_1, #textbox_2{ margin-top: 0vw !important; } </style> </html> </panel> </row> </form> Anyone has a clue?

D2SI · ‎09-07-2020

Hello here! Would there be a simple way to center a mix of text and link inputs? I have tried margin left so far and it is not so bad, but there might be a proper way to do this. <dashboard> <label>Center Inputs Mix</label> <row> <panel> <input id="textbox_1" type="text" token="text_1_tok"> <label></label> <default>Test1</default> </input> <input id="link_button_1" type="link" token="link_1_tok"> <label></label> <choice value="true">A</choice> </input> </panel> <panel> <input id="textbox_2" type="text" token="text_2_tok"> <label></label> <default>Test2</default> </input> <input id="link_button_2" type="link" token="link_2_tok"> <label></label> <choice value="true">A</choice> </input> </panel> </row> <row> <panel> <html> <style> #link_button_1 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"], #link_button_2 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ width: 23% !important; } #link_button_1 button, #link_button_2 button{ margin-right: 10px; } #textbox_1, #textbox_2{ margin-left: 8vw; } </style> </html> </panel> </row> </dashboard> Thanks in advance for any suggestion!

D2SI · ‎09-07-2020

Hello there! I am working on a App I am willing to publish on Splunkbase. I do like the dark mode one click feature so I try to adapt CSS colors based on currently applied theme, so that users will be able to pick dark theme without having light colors left on the dashboard. It is working fine so far using a background rest search that checks for dashboard's theme and tokens. However, I do use emojis in my dashboards and I have discovered that it makes the dark mode switch fail: It might be a core issue so I guess I will have to live with it but I am posting there just in case anyone figured this out, maybe there is a way to escape / protect emoji or the like. <dashboard theme="dark"> <label>Emoji Dark Mode</label> <row> <panel> <html> </html> </panel> </row> </dashboard> PS: Code renderer also seems to dislike emojis but there is one one emoji within html : <html> 😐 </html>

D2SI · ‎09-07-2020

Hello there, Is there a way to adjust input link element width using CSS? I mean, I was able to reduce link button width using "div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]": But I would like to also adjust the size of the element itself: The goal is to ease centering depending on browser resolution: My test dashboard: <dashboard> <label>Input Link Width</label> <row> <panel> <input type="text" token="text_1_tok"> <label></label> <default>Test1</default> </input> <input id="link_button_1" type="link" token="link_1_tok"> <label></label> <choice value="true">OK</choice> </input> </panel> <panel> <input type="text" token="text_2_tok"> <label></label> <default>Test2</default> </input> <input id="link_button_2" type="link" token="link_2_tok"> <label></label> <choice value="true">OK</choice> </input> </panel> </row> <row> <panel> <html> <style> #link_button_1 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"], #link_button_2 div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{ width: 23% !important; } </style> </html> </panel> </row> </dashboard>

D2SI · ‎09-07-2020

**bleep**, that is a lot of help there! Thanks a lot ! 🙏

D2SI · ‎09-05-2020

Thanks to @niketn I can now click on a table row, and get the whole row highlighted as needed. I am know trying to keep the row highlighted even after panel has been reloaded. Step 1: When clicking on a row, the selected row is highlighted (Working OK) Step 2: Click on a button that reload the panel (OK) Step 3: Selected row remains highlighted even if the panel is reloaded (No clue how for now) Here is a working example (except step 3): Dashboard: <dashboard script="table_highlight_row_on_cell_click.js,tokenlinks.js"> <label>Table Clicked Row Highlight</label> <init> <set token="update_list_tok">true</set> <unset token="update_table_tok"></unset> </init> <row> <panel> <html> <style> #highlight table tr.highlighted{ border-style: solid !important; border-color: skyblue !important; background: orange !important; } #highlight table tr.highlighted td{ background: orange !important; border: none !important; -webkit-box-shadow: none !important; box-shadow: none !important; } </style> </html> <table id="highlight"> <search> <query>index=_internal sourcetype=splunkd | eval dummy="$update_list_tok$" | fields - dummy | stats count by log_level</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="tokValue2">$click.value2$</set> </drilldown> </table> </panel> </row> <row> <panel> <html> <a data-set-token="update_table_tok" data-value="true">Click me</a> </html> </panel> </row> <row> <panel depends="$null_tok$"> <table> <search> <query>| makeresults | eval dummy="$update_table_tok$" | fields - dummy</query> <earliest>0</earliest> <latest></latest> <done> <eval token="update_list_tok">random()</eval> </done> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard> Here is table_highlight_row_on_cell_click.js: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Color Clicked Row of table with id #highlight $(document).on("click","#highlight",function(){ // Apply class of the cells to the parent row in order to color the whole row $("#highlight table").find('td.highlighted').each(function() { $("#highlight table tr").removeClass("highlighted"); $(this).parents('tr').addClass(this.className); }); }); }) And tokenlinks.js (from Simple Dashboards Examples: require(['jquery', 'underscore', 'splunkjs/mvc', 'util/console'], function($, _, mvc, console) { function setToken(name, value) { console.log('Setting Token %o=%o', name, value); var defaultTokenModel = mvc.Components.get('default'); if (defaultTokenModel) { defaultTokenModel.set(name, value); } var submittedTokenModel = mvc.Components.get('submitted'); if (submittedTokenModel) { submittedTokenModel.set(name, value); } } $('.dashboard-body').on('click', '[data-set-token],[data-unset-token],[data-token-json]', function(e) { e.preventDefault(); var target = $(e.currentTarget); var setTokenName = target.data('set-token'); if (setTokenName) { setToken(setTokenName, target.data('value')); } var unsetTokenName = target.data('unset-token'); if (unsetTokenName) { setToken(unsetTokenName, undefined); } var tokenJson = target.data('token-json'); if (tokenJson) { try { if (_.isObject(tokenJson)) { _(tokenJson).each(function(value, key) { if (value == null) { // Unset the token setToken(key, undefined); } else { setToken(key, value); } }); } } catch (e) { console.warn('Cannot parse token JSON: ', e); } } }); }); Any idea is welcome! 🙏

D2SI · ‎09-05-2020

Wow! Thanks a lot!

D2SI · ‎09-04-2020

Hello there! I am trying to highlight a table row whenever clicked: This is the JavaScript I use to highlight a row based on a cell string value: require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for status field return _(["host"]).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = cell.value; // Apply interpretation for status field // Since we have picked only one row for applying range Class, following if is not required. if (cell.field === "host") { //Add range class based on cell values. if (value == "test") { $td.addClass("range-cell").addClass("range-green"); } } // Update the cell content with string value $td.text(value).addClass('string'); } }); mvc.Components.get('highlight').getVisualization(function(tableView) { tableView.on('rendered', function() { // Add a delay to ensure Custom Render applies to row without getting overridden with built in reder. setTimeout(function(){ // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); },100); }); // Add custom cell renderer, the table will re-render automatically. tableView.addCellRenderer(new CustomRangeRenderer()); }); }); It works with this dashboard: <dashboard script="script.js"> <label>test</label> <row> <panel> <table id="highlight"> <search> <query>| makeresults | eval host="test" | append [| makeresults | eval host="hello"] | table host</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="clicked_row_tok">$click.value$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>$def$</title> <html> <style> #highlight tr.range-green td { background-color: #F2B827 !important; } </style> </html> </panel> </row> </dashboard> But instead of highlighting a row based on a value, I would like to highlight the clicked row (token $clicked_row_tok$) So I guess I have to implement something like this: // Access the "default" token model var defaultTokenModel = mvc.Components.get("default"); defaultTokenModel.on("change:clicked_row_tok", function(newTokenName, clicked_row_tok, options) { ... } }); To be able to do this: if (cell.field == clicked_row_tok) { But I am struggling mixing them both so I am here for help 🙏

D2SI · ‎02-21-2020

Hello @tvergov , I guess you meant how it has been resolved using SQS instead of CloudWatch Events rule + Kinesis Firehose + HEC. Well on the AWS side we now have one 'awsconfig' SNS Topic with 2 SQS Queues subscriptions, 'aws_config' & 'aws_config_notification'. In the AWS add-on, we still have our Config SQS-Based S3 input linked to our aws_config SQS that is supposed to gather data in both aws:config & aws:config:notification sourcetypes but only feed aws:config sourcetype. We have added a Custom SQS input linked to our aws_config_notification SQS and have assigned it to the aws:config:notification sourcetype.

D2SI · ‎02-21-2020

Now In 7.3.4, we still have the "Parsing error : No data" error. We now have more detailed errors in splunkd logs : 02-21-2020 10:35:22.634 +0000 ERROR HttpInputDataHandler - Failed processing http input, token name=, channel=, source_IP=1.2.3.4, reply=5, events_processed=0, http_input_body_size=0 It still being generated for multiple HEC inputs, which are working (data being ingested, no invalid token or other significant errors). And we still do not understand why it is being generated 😕

D2SI · ‎02-18-2020

Hello! First of all thanks a lot for the App as it was really useful for us in various ways! I am using the popover js in some of our dashboards. It was working nice but since we have upgraded to 7.3.4 it sadly does not "popover" anymore. I have tried from the App to be sure as well as from various Web browsers. I would be glad to help but I just can't do js 😞 require(["jquery", "splunkjs/ready!", "bootstrap.popover", "bootstrap.tooltip" ], function( $, Ready) { $("[data-popover]").attr("data-toggle", "popover").popover() $("[data-tooltip]").attr("data-toggle", "tooltip").tooltip() }) //# sourceURL=ex36-tooltips-and-popovers.js If anyone as a hint on what is wrong here it would be great!

D2SI · ‎02-06-2020

It resolved our issue as well, thanks!!

D2SI · ‎02-04-2020

D2SI · ‎01-22-2020

Thanks @Paul1896 ! I had not checked that way. There is no invalid request. But there are some 'parser errors'. The cool thing is that you can browse 'parser errors' by token. But like I said in the comment above, it matches plenty tokens not just one or two. Plus these tokens are OK, I mean there is data indexed through them, not no data at all. So I am wondering what are these 'parser errors' ? I mean, from the logs, it does not seem to be timestamp issues.

D2SI · ‎01-22-2020

Hi @srinikrishna, same here, upgraded from 7.0.x from 7.2.8, then started noticing the errors. I have activated DEBUG and I believe these errors match this kind of messages indicating that no data was processed: 01-21-2020 21:35:51.653 +0000 DEBUG HttpInputDataHandler - handled token: <token>, channel: <channel>, source IP: <ip>, reply: 9, processed: 0, http input body size: 679733 But I can see these processed: 0 messages for plenty of tokens, most of them working fine and indexing data so I am confused how to interpret this.

D2SI · ‎01-21-2020

Hello @thevena : Is the data is being indexed in the default main index or a dedicated one ? It is a dedicated one, is searchable by default for the considered role ? App is using Data Model and kind of assume it is being accelerated. Is it the case ? I suggest opening the search of any panel of the App. You should see something like "| tstats ... summariesonly=true", try to replace true by false and launch the search again. If data appears, it is because Data Model has not been accelerated. Data Model can be accelerated from Settings > Data Models > Edit Acceleration > Accelerate / Summary Range.

D2SI · ‎01-17-2020

Thanks for suggestion @to4kawa ! Anyhow I am trying to get rid of timestamp issues, and as sedcmd is applied after timestamp assignment I believe I would still get timestamp issues logged just as using transforms nullqueue.

D2SI · ‎01-12-2020

Dear team, Thanks for the Add-on, it works great. I just have plenty of this timestamp issue : 01-12-2020 22:45:55.239 +0000 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (500) characters of event. Defaulting to timestamp of previous event (Sun Jan 12 22:40:00 2020). Context: source=dynatrace_timeseries_metrics://Dynatrace_Timeseries_Metrics|host=heavy-forwarder|dynatrace:metrics| I believe it is due to this message in sourcetype dynatrace:metrics which has no timestamp : {"dynatrace_server":"https://rioxxxxx.live.dynatrace.com"} Would you know if there is a way to get rid of it ? I mean I can send to nullqueue but I would still got all these timestamp issues I am trying to clean up. Thanks anyhow

D2SI · ‎01-11-2020

Thank both of you for your suggested solutions! @adonio Good idea, thank you, I will test this with eval in the props.conf! @jarizeloyola Thanks! I am using ingest_eval for another source which timestamp can only be found in the filename, and it works great! However, I see splunkd timestamp errors for that source, so I have to check if inges_eval works in a way there will still have timestamp issues generated even if OK, or if it is something else!

Posts	78
Solutions	1
Karma Given	29
Karma Received	12
Member Since	‎05-18-2018

Online Status	Offline
Date Last Visited	‎10-21-2020 05:05 AM

Convert earliest_time latest_time notation to epoc...

Adjust top margin on a panel with different inputs...

Center a mix of text and link inputs using CSS

Why does dark theme switch fail when using emojis ...

Adjust width of input element via CSS

Highlight clicked row from a table and keep the ro...

Highlight clicked row from a table using javascrip...

Tooltips and Popovers js not working in 7.3

Event without timestamp

Attachment must be ether alert_link or message

Re: Convert earliest_time latest_time notation to ...

Convert earliest_time latest_time notation to epoc...

Re: Center a mix of text and link inputs using CSS

Re: Dark theme swith fails when using emojis in th...

Re: Center a mix of text and link inputs using CSS

Re: Adjust top margin on a panel with different in...

Adjust top margin on a panel with different inputs...

Center a mix of text and link inputs using CSS

Why does dark theme switch fail when using emojis ...

Adjust width of input element via CSS

Re: Highlight clicked row from a table and keep th...

Highlight clicked row from a table and keep the ro...

Re: Highlight clicked row from a table using javas...

Highlight clicked row from a table using javascrip...

Re: Splunk Add-on for Amazon Web Services: Cannot ...

Re: HttpInputDataHandler - Parsing error : No data

Tooltips and Popovers js not working in 7.3

Re: Splunk Add-on for Amazon Web Services: Why are...

Re: How to dynamically append the content of multi...

Re: HttpInputDataHandler - Parsing error : No data

Re: HttpInputDataHandler - Parsing error : No data

Re: Is ModSecurity AddOn for Splunk compatible wit...

Re: Event without timestamp

Event without timestamp

Re: Custom timestamp detection for a sourcetype wi...