Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- About rrovers
rrovers
Communicator
Member since:
09-04-2017
3 weeks ago
Community Statistics
| Posts | 79 |
| Solutions | 8 |
| Karma Given | 127 |
| Karma Received | 17 |
| Member Since | 09-04-2017 |
Activity Feed
- Karma Re: How to use fillnull for certain fields (and not for other ones) for richgalloway. 3 weeks ago
- Posted How to use fillnull for certain fields (and not for other ones) on Splunk Search. 3 weeks ago
- Posted Re: Having a base64 decoding problem in Splunk 9- How to decode Idap-events? on Splunk Search. 01-09-2024 10:42 PM
- Got Karma for Re: base64 decoding problem in Splunk 9?. 01-09-2024 09:38 AM
- Karma Re: how to change color for entire row for SanjayReddy. 12-20-2023 06:22 AM
- Karma Re: Difference betweenn field values in 2 events for ITWhisperer. 12-19-2023 12:34 AM
- Karma Re: Difference betweenn field values in 2 events for ITWhisperer. 12-19-2023 12:26 AM
- Karma Re: Separate multi-value field in individual fields for fz. 12-12-2023 04:20 AM
- Karma creating a scatterplot with time on the x-axis for pbrunel_splunk. 11-29-2023 05:24 AM
- Karma Setting tag permissions for jasongb. 11-26-2023 11:23 PM
- Karma How to make a tag public? for BT_Neophyte. 11-26-2023 11:20 PM
- Karma Re: How to make a tag public? for BT_Neophyte. 11-26-2023 11:20 PM
- Karma Re: How do you add dummy events to a search result? for rstitt. 11-15-2023 12:41 AM
- Karma Re: Using rex to extract one or two character digit from string for bmacias84. 11-12-2023 11:38 PM
- Karma Re: Using wild card in table column formating for bowesmana. 11-09-2023 01:16 AM
- Karma Re: How to enable a new tab opening from within a dashboard? for Michael. 11-07-2023 05:18 AM
- Karma Re: How to enable a new tab opening from within a dashboard? for scott_sackrider. 11-07-2023 05:18 AM
- Karma Re: How to use tokens in a dynamic saved search? for martin_mueller. 11-07-2023 02:43 AM
- Karma Re: How do I disable redirection warning? for elizabethl_splu. 11-06-2023 10:29 PM
- Posted Re: Want a Dashboard to display all exceptions occured in the last 30 days in a graphical way. on Splunk Search. 11-03-2023 12:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
My search ends with: | table Afdeling 20* Voorlaatste* Laatste* verschil It has several detail rows and 1 row with totals. I want to use fillnull for the totals for the 20* columns (2023-10, 2023-11 etc.) but not for Voorlaatste* Laatste* and verschil. I can't use | fillnull 20* value="0.0" because that adds a column "20*" and I don't want to use fillnull 2023-10 etc. Is there a way to do this?
... View more
01-09-2024
10:42 PM
Later we have used an app named decrypt2 and it worked for us with this syntax: | decrypt field=randomfield atob emit('randomfielddecrypt')
... View more
11-03-2023
12:16 AM
Do you mean this: index=dev | rex field=_raw "\b(?(java|javax).[\w.]+Exception)"
| timechart span=30d count by exception_type for graphics choose "Visualisations"
... View more
08-22-2023
08:22 AM
There is 1 token in it but that doesn't seem to be the problem. I solved it now by using a join in stead of index=1... OR index=2.. and that seems to work fine (I know, using a join is not advised). So index=1... join type=inner id [search index=2..] I don't know why the "OR" doesn't work. Maybe caused by a lot of events (2,7 mln for the first index). But that is also the case with other organisations that do give a result.
... View more
08-21-2023
01:07 AM
1 search in a dashboard ends with "waiting for data" for 3 of about 300 organisations. The organisation-name is part of the url. The search ends correctly for most of the organisations.
After refreshing the search (in the dashboard) or clicking on the magnifying glass the result of the search is shown. Job inspection gives no error.
Any idea why what can be the reason that the result is not shown in the dashboard directly?
... View more
Labels
- Labels:
-
data
08-07-2023
10:31 PM
@burwell, this was around the time we migrated to splunk 9 but I think this was still in splunk version 8.x.x.
... View more
06-13-2023
02:49 AM
Hi @kamlesh_vaghela, It's based on your example: dashboard: <dashboard version="1.1" script="convert_to_html.js">
<label>HTML from SPL</label>
<search>
<query>
| makeresults
| eval data="<b>Network Map One </b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br>"
, data1="<b>Network Map Two</b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br>"
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="tokHTML">$result.data1$</set>
</done>
</search>
<row>
<panel>
<html>
<div id="htmlPanelWithToken">
$tokHTML$
</div>
</html>
</panel>
</row>
</dashboard> jscript: require([
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
],
function ($, mvc,)
{ var mySearch = mvc.Components.get("mySearch");
var mySearchResults = mySearch.data("results");
mySearchResults.on("data", function () {
resultArray = mySearchResults.data().rows; var generateHTMLContent = "";
$("#htmlPanelWithToken").html(generateHTMLContent);
// Iterate Result set
$.each(resultArray, function (index, value)
//{ console.log(index, value)
console.log(index, value[0])
console.log(index, value[1])
console.log(index, value[2])
//Create proper HTML content from result
generateHTMLContent = "<table><tr><td>" + value[1] + "</td><td>" + value[2] + "</td></tr></table>";
// value[1] = data field
// value[2] = data1 field
console.log(generateHTMLContent);
})
$("#htmlPanelWithToken").html(generateHTMLContent);
});
});
... View more
06-13-2023
12:42 AM
maybe this wil help?: <form version="1.1">
<label>tmp-pr-tags</label>
<fieldset>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>Selecteer een PR_Tag:</label>
<choice value="*">PR_Tags...</choice>
<search>
<query>
<![CDATA[
index=main sourcetype=csv source=result_test.csv
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
]]>
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>PR_Tags</fieldForLabel>
<fieldForValue>PR_Tags</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<title>PR_Tags</title>
<table>
<search>
<query>
index=main sourcetype=csv source=result_test.csv
| where PR_Tags="$dropdown_tok$"
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
</query>
</search>
<option name="count">50</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
... View more
06-12-2023
11:50 PM
Hi @kamlesh_vaghela, Thanks for your answer. I copied the source to a dashboard, added the token: <div id="htmlPanelWithToken">
$tokHTML$
</div> and loaded the javascript but the result is not as I expected, namely: <b>Network Map Two</b><br></br>|-- Device 1: 10.100.100.4<br></br>|-- Device 2: 10.100.100.250<br></br>|-- Device 3: 10.100.3.42 (Mode: MASTER)<br></br> I expect something like: Network map 2 Device 1:... Device 2:... Is there something wrong in the code or are my expecations not right?
... View more
05-31-2023
04:43 AM
With https://community.splunk.com/t5/Dashboards-Visualizations/Render-HTML-code-from-search-result-in-Splunk-dashboard/m-p/221940 I managed to display the (html) content in 1 field in readable format.
This solution works fine for 1 field at a time (logically, because it's using a token). I want to display all the fields in a dashboard in that format. I can't find out how to do that.
Besides that it's hard to find usefull information to use javascript in combination with splunk but maybe that's because I'm relatively new in using javascript and probably using the wrong keywords. Anyone some suggestions?
... View more
Labels
- Labels:
-
dashboard
-
javascript
-
table
05-04-2023
02:50 AM
I had the same issue. It was caused by a long saved search name. After cloning it too a shorter one it worked well. Thanks to the contributors of https://community.splunk.com/t5/Reporting/When-I-clicked-quot-view-results-quot-on-alert-mail-quot-The/m-p/303643
... View more
04-25-2023
07:48 AM
I've made a dashboard which uses tokens to determine if all searches are ready (ready1, ready2 etc).
If all tokens are set a message is displayed that the dashboard is ready.
When I open the dashboard and choose a value from the picklist sometimes all the tokens are set and sometimes a few are not set. So for example action 1: open dashboard, choose value from picklist, value ready1 is set and for example ready8 is not. Action 2 open the same dashboard choose the same value from picklist. ready1 is not set, ready8 is set and ready10 is not set. So exactly the same action with different results.
Does anyone know a solution for this? Maybe something to do with caching?
... View more
Labels
- Labels:
-
dashboard
03-17-2023
01:51 AM
1 Karma
Answering my own question: Syntax is like this: | code field=randombase64field method=base64 action=decode destfield=test unfortunately it doesn't decode diacritics correctly. Does someone have a solution for that? Apps that worked fine in splunk 8 don't seem to work correct in splunk 9.
... View more
03-13-2023
05:19 AM
After installing splunk 9 we have a problem with decoding ldap-events. We tried several apps but none of them gave us correct results.
We wanted to use the app "Encode / Decode Data for Splunk" but we can't find any instructions of how to use it.
Does anyone have experience with base64 decoding in splunk 9?
... View more
Labels
- Labels:
-
other
02-06-2023
11:07 PM
My search:
| makeresults earliest=-2h
| timechart count as aantal span=1m
returns a list of zero's but for the last/current minute it returns "1". I only want zero's back to combine this search with a timechart.
After combining these searches (makeresults and timechart) there should be no message "no values found" anymore. What do I have to change to have only zero's as a result of my makeresults search?
... View more
Labels
- Labels:
-
timechart
01-05-2023
01:34 AM
I'm not sure if I understand your problem exactly. I think it's not possible to schedule a cron job only on working days. You could run a job on every first 3 days of the month and check in your search if this is a working day. | makeresults
| eval day=strftime(_time,"%a")
| eval aantal=if(day="Mon" OR day ="Tue" OR day="Wed" OR day="Thu" OR day="Fri","0","1")
| append
[ search index=_internal + your search criteria to find if the job has run
| stats count AS aantal]
| stats sum(aantal) In the alert you could set the option to send an email if number of events is 0. If this doesn't solve your problem please give some more details (I don't understand the function of your lookup file, is that just an overview or do you want to run from that lookup or something?, the latter is not possible I think).
... View more
01-03-2023
05:42 AM
Is it an option to make an alert that checks the _internal index at the alert time if the job has run. If result is 0 then send an email.
... View more
12-29-2022
02:36 AM
1 Karma
I don't know what's exactly in your index but this works: |makeresults
|eval end_date="10112022"
| eval created_date="12112022"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y")
| eval created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date If this doesn't solve your problem please give some more information
... View more
07-28-2022
02:35 AM
1 Karma
| makeresults
| eval ID="t1023"
| eval IDlen=len(ID)
| eval IDlen2=IDlen-2
| eval IDtest=substr(ID,IDlen2)
| table IDtest
... View more
07-28-2022
12:23 AM
You can use mvexpand to make multiple events from 1 and mvcombine to make 1 event from multiple. I've used makeresults to be able to check my dashboard. Not exactly what you want but hopefully it wil give you a hint how to solve this. <dashboard>
<label>Test filesize</label>
<fieldset>
<input type="dropdown" token="size_tk_from" searchWhenChanged="true">
<label>File Size from:</label>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">500M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
</input>
<input type="dropdown" token="size_tk_to" searchWhenChanged="true">
<label>File Size to:</label>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">500M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
<![CDATA[
| makeresults
| eval filesize="2G,500M,200M,50M,1G"
| eval filesize=replace(filesize,"50M","50000")
| eval filesize=replace(filesize,"200M","200000")
| eval filesize=replace(filesize,"500M","500000")
| eval filesize=replace(filesize,"1G","1000000")
| eval filesize=replace(filesize,"2G","2000000")
| makemv delim="," filesize
| mvexpand filesize
| where filesize>$size_tk_from$ AND filesize<$size_tk_to$
| table filesize
| sort filesize
| eval filesize=replace(filesize,"500000","500M")
| eval filesize=replace(filesize,"50000","50M")
| eval filesize=replace(filesize,"2000000","2G")
| eval filesize=replace(filesize,"200000","200M")
| eval filesize=replace(filesize,"1000000","1G")
| table filesize
]]>
</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</search>
</table>
</panel>
</row>
</dashboard>
... View more
07-27-2022
04:35 AM
maybe something like this? <dashboard>
<label>Test filesize</label>
<fieldset>
<input type="dropdown" token="size_tk_from" searchWhenChanged="true">
<label>File Size from:</label>
<choice value="*">ALL</choice>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">500M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="size_tk_to" searchWhenChanged="true">
<label>File Size to:</label>
<choice value="*">ALL</choice>
<choice value="50000">50M</choice>
<choice value="200000">200M</choice>
<choice value="500000">50M</choice>
<choice value="1000000">1G</choice>
<choice value="2000000">2G</choice>
<fieldForLabel>size</fieldForLabel>
<fieldForValue>size</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
<![CDATA[
index=tech_filesystem
| makemv delim="," filesize
| where filesize>$size_tk_from$ AND filesize<$size_tk_to$
| stats count by filesize
]]>
</query>
<earliest>rt-1m</earliest>
<latest>rt</latest>
</search>
</table>
</panel>
</row>
</dashboard>
... View more
07-27-2022
02:58 AM
Maybe I don't understand your question quit right but if you are looking for a list of files between 2 values you could make an extra token and use this search: index=tech_filesystem
| makemv delim="," filesize
| where filesize>$size_tok_from$ AND filesize<$size_tok_to$
| stats count by filesize
... View more
07-27-2022
01:57 AM
2 Karma
add NOT "INTERNAL_SERVER_ERROR" so: index=abc ns=blazegateway ERROR NOT "INTERNAL_SERVER_ERROR"
... View more
07-27-2022
01:27 AM
I think you need to make 2 tokens, size_tok_from and size_tok_to. In your search add where filesize>$size_tok_from$ AND filesize<$size_tok_to$
... View more
07-22-2022
04:58 AM
I found this source somewhere in the community and it works fine: I <row>
<panel>
<input type="link" token="refresh" id="color_button1">
<label></label>
<choice value="Yes">Ververs Overzicht</choice>
<change>
<condition value="Yes">
<set token="refresh_delay">1</set>
</condition>
</change>
</input>
</panel>
</row> The colors of the button are grey with a white background. I would like to change this to colors that are more remarkable, for example a green background. I've tried several things but without the desired result. Is it possible to change the colors of the button?
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma from
Karma given to
