Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jlemley
jlemley
Path Finder
Member since:
06-04-2018
08-23-2021
Community Statistics
| Posts | 13 |
| Solutions | 2 |
| Karma Given | 10 |
| Karma Received | 5 |
| Member Since | 06-04-2018 |
Activity Feed
- Got Karma for Re: Timezone conversion function.. 05-05-2022 10:51 AM
- Got Karma for Re: Splunk DB Connect 2: How to use dbxquery to take a time field from an external db table and use that as _time for a. 12-10-2021 04:35 AM
- Got Karma for Re: Splunk DB Connect 2: How to use dbxquery to take a time field from an external db table and use that as _time for a. 06-29-2021 06:24 PM
- Karma Re: How do you pass multiple value tokens from a form input textbox to the search query? for vnravikumar. 09-28-2020 03:08 PM
- Posted Re: How to find the missing number sequence from a table? on Splunk Search. 09-22-2020 06:53 AM
- Karma Re: How to find the missing number sequence from a table? for FloSwiip. 09-22-2020 06:24 AM
- Posted Re: Splunk DB Connect 2: How to use dbxquery to take a time field from an external db table and use that as _time for a on All Apps and Add-ons. 07-29-2020 03:52 PM
- Karma Re: Can you help me with my Splunk Insights for Infrastructure 1.2 Install Problem? for pwu_splunk. 06-05-2020 12:50 AM
- Got Karma for Can you help me with my Splunk Insights for Infrastructure 1.2 Install Problem?. 06-05-2020 12:50 AM
- Karma Re: Converting relative time into epoch for the time range picker for niketn. 06-05-2020 12:49 AM
- Got Karma for Re: Can I use REST API without curl?. 06-05-2020 12:49 AM
- Karma Re: How can I limit the results of a stats values() function? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: How to set up a heavy forwarder to forward data to Splunk Cloud? for ptsystemssuppor. 06-05-2020 12:48 AM
- Karma Re: Include results of another search in the body of an alert? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Timezone conversion function. for EvilPuppetMaste. 06-05-2020 12:47 AM
- Karma Re: Limit choices in default TIMEPICKER for jhubbard74. 06-05-2020 12:47 AM
- Karma Re: Limit choices in default TIMEPICKER for runner724. 06-05-2020 12:47 AM
- Posted Re: Bypassing lookup 1000 limit on Splunk Search. 07-30-2019 06:10 AM
- Posted Re: Unable to draw timechart on Splunk Search. 07-19-2019 04:13 PM
- Posted Re: Can I use REST API without curl? on Getting Data In. 07-19-2019 04:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
09-22-2020
06:53 AM
This is an old topic, but I took the answer posted by @FloSwiip combined with https://community.splunk.com/t5/Splunk-Search/search-to-find-gaps-in-data/td-p/68644 and came up with this: | makeresults
| fields - _time
| eval IDS="-7,-4,3,4,6,7,13"
| makemv IDS delim=","
| mvexpand IDS
| sort 0 IDS
| streamstats current=f last(IDS) as last_id
| eval gap=IDS-last_id
| where gap>1
| eval allIDs=mvrange(last_id,IDS)
| mvexpand allIDs
| eval is_found=if(match(allIDs,last_id),1,0)
| where is_found=0
| table allIDs Data generation is up through mvexpand - you can take the rest after that to apply to your own data. This works with a much larger data set that would otherwise run into memory limits when using mvexpand on "allIDs".
... View more
07-29-2020
03:52 PM
2 Karma
I know this is a little older, but still relevant today. We developed an updated solution similar to @jtrujillo: | dbxquery
[| makeresults
| addinfo
| eval earliest=strftime(info_min_time,"%Y-%m-%d"), latest=strftime(info_max_time,"%Y-%m-%d")
| eval query="SELECT * FROM MY_TABLE
WHERE DATE_COL >= '".earliest."' AND DATE_COL < '".latest."'"
| return query] connection="dbconn" I hope it helps someone.
... View more
07-30-2019
06:10 AM
This is one of my favorite topics: Joining two data sets with the stats command.
A very quick and dirty way to do this with your data could be to try something like this:
index=vulnerability OR index=assets
| stats first(*) as * by vendor, product, version
This will pull your two data sources together, grouped (or joined) by the vendor, product, and version.
More information can be found here:
https://answers.splunk.com/answers/145077/how-to-perform-join-with-stats.html
There's also a great .conf18 presentation on this topic:
https://conf.splunk.com/watch/conf-online.html?search=join#/
... View more
07-19-2019
04:13 PM
Timechart requires _time in order to function, but your "stats" commands don't pass _time through. Assuming your saved search includes _time, try this:
| savedsearch "r1"
| bin _time span=1d
| top 10 event by host, _time
| sort-count
| eventstats sum(count) as TotalNumber
| eval PercentOfTotal = round(100 * count / TotalNumber,2). "%"
| stats list(entity) as "Entity" list(count) as "Count", sum(count) as "Total" by event, _time
| sort-Total
| addinfo
| eval rank=1
| accum rank
| sort +num(rank)
| head (rank <=10)
| fields rank, host,event, Entity, Count,Total
| eval Entity=mvindex(Entity,0,9)
| eval Count=mvindex(Count,0,9)
| eval Percent=mvindex(Percent,0,9)
| timechart span=1d useother=f count by host
If your saved search has a different time field, then you may need to convert that to _time using strptime.
... View more
07-19-2019
04:06 PM
1 Karma
Theoretically, you could generate a URL like this and run it in your browser - Splunk will prompt you to log in:
https://xx.xx.xx.xx:xxxxx/services/search/jobs/export?output_mode=json&search=search%20index=xxx%20earliest=-15m%20latest=now%20%22xyz123%22|%20table%20c1,%20c2
Here is a jQuery AJAX example of how you can do API calls, although it's not recommended to do it this way because of the security concerns with passing a username and password through a browser. If you can generate your security token from a cURL call first, then pass that to the js script, that would be better. But for the sake of completeness:
First, get the auth token:
var settings = {
"url": "https://xx.xx.xx.xx:xxxxx/services/auth/login",
"method": "POST",
"headers": {
"Content-Type": "application/x-www-form-urlencoded"
},
"data": {
"username": "myuser",
"password": "mypw"
}
}
$.ajax(settings).done(function (response) {
var thisIsMyAuthToken = response; // this part needs refined to grab the sessionKey component
});
Then do the search request:
var settings = {
"url": "https://xx.xx.xx.xx:xxxxx/services/search/jobs/export?output_mode=json&search=search%20index=xxx%20earliest=-15m%20latest=now%20%22xyz123%22|%20table%20c1,%20c2,
"method": "GET",
"headers": {
"Authorization": "Splunk " + thisIsMyAuthToken,
"Content-Type": "application/x-www-form-urlencoded"
}
}
$.ajax(settings).done(function (response) {
console.log(response);
});
This test was generated in Postman, which I highly recommend for any API testing.
... View more
05-11-2019
05:57 AM
Try using America/New_York for the origin timezone. This should automatically convert between EDT and EST.
... View more
04-24-2019
12:57 PM
1 Karma
This is a perfect solution. I modified it slightly for my use case, which is to ensure that the user's timezone matches the timezone of the source data. So the from_tz is done this way:
from_tz=strftime(now(),"%Z")
... View more
03-11-2019
07:15 AM
I just tested this morning, and it still does not check the boxes. I did a console log output and confirmed that the token is being read and placed into an array, and that the "rk" element is being found, but the "set" and "render" do not seem to be doing what is expected. Thanks for trying!
... View more
03-07-2019
06:00 PM
Thanks for the reply! This works in the console in Splunk 7.2, but not when I implement it in a JavaScript file. I forgot to mention that my production environment is running 6.5.9, and it does not even work in the console in that version.
... View more
02-26-2019
11:53 AM
In the below run-anywhere dashboard. I have a search that produces a multivalue result called "products". The search will determine which products to select in the checkbox input, which then affects another search (not shown here - use your imagination).
If I change the | stats values(product) as products to | stats values(first) as products , then the single checkbox will be checked. But with multiple values, nothing is checked. I have a text field with the label set to the form.products token so that it's possible to see that the multivalue is being converted into a comma-delimited string. What format does this need to be in for the checkbox input to accept multiple values?
<form>
<label>Test_Checkbox_Tokens</label>
<search id="base">
<query>| makeresults | eval product="Product_1,Product_2" | makemv product delim=","| stats values(product) as products
</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="form.products">$result.products$</set>
</done>
</search>
<fieldset submitButton="false">
<input type="checkbox" token="products">
<label>Products</label>
<choice value="Product_1">Product 1</choice>
<choice value="Product_2">Product 2</choice>
<choice value="Product_3">Product 3</choice>
<delimiter> </delimiter>
</input>
<input type="text" token="field1">
<label>Selected Products: $form.products$</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base"></search>
</table>
</panel>
</row>
</form>
... View more
02-25-2019
02:42 PM
After much research and trial & error, I believe the answer to this question is: Because the elements have not finished loading when this JavaScript code is run.
I tried several ways to work around this, including:
$(document).ready(function(){
$(document).bind("PageReady", function() {
And a few others.
But none of these methods ran after the Water Gauge element was created - likely because the visualization itself is built with JavaScript. I ended up wrapping the whole thing in a "setTimeout" block with a wait of 10s. This is a terrible hack, but it's the only way I could figure out to run the script after the water gauge was done loading.
I also attempted to use the native MVC click method instead of jQuery, but could not get the click event to fire. However, I did work around the hardcoded "options" variable, and now read it no matter where the Water Gauge lives in Splunk. Here is the code I finally ended up using:
setTimeout(function(){
var components = [
"splunkjs/ready!",
"splunkjs/mvc/simplexml/ready!",
"jquery",
'splunkjs/mvc/utils'
];
require(components, function(
mvc,
ignored,
$,
utils
) {
$('.splunk-water-gauge').unbind();
$('.splunk-water-gauge').click(function(el) {
var re=/([\$].+?[\$])/g
var url;
var tokens = mvc.Components.get("submitted");
parent_el = $(this).parents('div[class^="dashboard-element viz"]')[0].id;
if (typeof(parent_el) == 'undefined') {
return false;
}
viz_details = mvc.Components.getInstance(parent_el);
var optionsArray = viz_details.options.reportContent;
getOptionsKeys = Object.keys(optionsArray);
getOptionsKeys.forEach(function(item) {
if(item.indexOf("drilldown") != -1) {
url=optionsArray[item];
}
});
if(typeof(url) == 'undefined') {
return false;
}
var tokensArray=url.match(re);
$(tokensArray).each(function(i,token) {
clean_token=token.replace(/\$?/g,"");
var tokenValue = tokens.get(clean_token);
url=url.replace(token,tokenValue);
});
utils.redirect(url, false, "_blank");
});
});
}, 5000);
Edited to add token handling.
... View more
02-15-2019
09:18 AM
As a followup to "Water Gauge visualization Drilldown??"
Why would this code not apply the click event to my dashboard when it loads? If I run the JavaScript directly in the browser console, the click event is attached, and all is well.
The idea behind the JavaScript is that it will automatically apply a click event to every Water Gauge visualization on the dashboard as long as a drilldown option is added. My theory is that the jQuery that looks for the visualizations is firing too early (before the DOM is loaded), but I don't know of another way to grab the elements without hardcoding, as outlined in the above referenced question.
Dashboard:
<dashboard script="water_gauge_drilldown.js">
<label>water gauge test</label>
<row>
<panel>
<viz type="TA-ctl_splunk_it_one_viz.water_gauge">
<search>
<query>| makeresults | eval hi=55 | fields hi</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="TA-ctl_splunk_it_one_viz.water_gauge.drilldown">http://google.com</option>
</viz>
</panel>
</row>
</dashboard>
Note the required "drilldown" option entry in the Water Gauge XML to define the URL:
<option name="<viz_app>.water_gauge.drilldown">url_to_destination</option>
If the option is not found, the JavaScript will just return false and no action will be taken. Notice that this option is customized to my environment and may throw an error if it is not updated to match your environment.
JavaScript:
var components = [
"splunkjs/ready!",
"splunkjs/mvc/simplexml/ready!",
"jquery"
];
require(components, function(
mvc,
ignored,
$
) {
$('.splunk-water-gauge').click(function(el) {
parent_el = $(this).parents('div[class^="dashboard-element viz"]')[0].id;
viz_details = mvc.Components.getInstance(parent_el);
if (typeof(parent_el) == 'undefined') {
return false;
}
var url = viz_details.options.reportContent["display.visualizations.custom.TA-ctl_splunk_it_one_viz.water_gauge.drilldown"];
if(typeof(url) == 'undefined') {
return false;
}
window.open(url,'_blank');
});
});
... View more
10-05-2018
03:14 PM
1 Karma
Working with the .deb install file for Insights for Infrastructure 1.2 on Ubuntu 16.4 (splunk_insights_infrastructure-7.2.0-1d083d1668bd-linux-2.6-amd64.deb).
Installing this package caused the files to be installed in the root of /opt instead of /opt/splunk. This is causing the following errors to occur during the install:
grep: /opt/splunk/etc/splunk.version: No such file or directory
Couldn't read VERSION from $SPLUNK_HOME/etc/splunk.version, something is wrong.
grep: /opt/splunk/etc/splunk.version: No such file or directory
Couldn't read BUILD from $SPLUNK_HOME/etc/splunk.version, something is wrong.
/var/lib/dpkg/info/splunk.postinst: line 101: /opt/splunk/etc/splunk-launch.conf: No such file or directory
touch: cannot touch '/opt/splunk/ftr': No such file or directory
/var/lib/dpkg/info/splunk.postinst: line 112: /opt/splunk/ftr: No such file or directory
cp: cannot stat '/opt/splunk/etc/regid.2001-12.com.splunk-UniversalForwarder.swidtag': No such file or directory
/var/lib/dpkg/info/splunk.postinst: line 154: /opt/splunk/ftr: No such file or directory
chown: cannot access '/opt/splunk': No such file or directory
After moving the files to the /opt/splunk directory and rerunning the installation, the files in that location were updated with the "splunk" username, and I was able to get it running.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-23-2021
09:40 AM
|
Karma from
Karma given to
