Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About shandr
shandr
Path Finder
Member since:
09-11-2019
04-16-2025
Community Statistics
| Posts | 32 |
| Solutions | 4 |
| Karma Given | 91 |
| Karma Received | 4 |
| Member Since | 09-11-2019 |
Activity Feed
- Karma Can't activate summary indexing for scheduled alert Splunk 8.0.0 for falcalde. 04-15-2025 09:50 PM
- Karma Re: I can't change "action.summary_index" to enable summary indexing in alert. for yutaka1005. 04-15-2025 09:49 PM
- Karma Re: Why are there many duplicate events in the indexer cluster? for vasanthmss. 03-27-2025 10:52 PM
- Posted Re: What is the best way to set up ouptuts.conf in a clustered environment? on Splunk Enterprise. 03-24-2025 09:24 PM
- Karma Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer. for yannK. 03-24-2025 08:22 PM
- Karma Re: How to dedup multivalued fields? for bowesmana. 02-13-2025 04:02 PM
- Karma Re: Why am I getting error "Data channel is missing" using HTTP Event Collector with Splunk Light? for gblock_splunk. 10-28-2024 04:35 PM
- Karma Re: How to count the number of times a special character is used in a string or field for ITWhisperer. 10-20-2024 09:49 PM
- Karma Re: Splunk local account login to splunkweb when SAML authentication is enabled? for suarezry. 10-03-2024 06:02 PM
- Karma Re: How do I combine mv fields into a new field? for mcantaloube. 09-17-2024 11:27 PM
- Karma Re: Getting a comma separate string from values function within stats command for raoul. 09-12-2024 11:52 PM
- Karma Re: How to color a table column based on values selected from radio buttons for danspav. 09-05-2024 07:48 PM
- Karma Re: tstat hourly time span without snapping to hour, relative to start of absolute time range instead for scelikok. 08-28-2024 07:42 PM
- Karma Re: How to make multivalue fields parse in props.conf and transforms.conf? for reswob4. 08-25-2024 07:37 PM
- Karma Re: The Client forwarder management not showing the clients for mykol_j. 07-28-2024 10:54 PM
- Karma Re: How do you add a new Search Head to Splunk Monitoring Console? for isoutamo. 07-25-2024 10:28 PM
- Karma Re: How to create multiple source types from a single log file? for somesoni2. 07-10-2024 10:33 PM
- Karma Re: What steps must I complete to renew my developer license? for lfedak_splunk. 06-16-2024 05:03 PM
- Posted Re: How to get a developer license? on Installation. 06-16-2024 04:56 PM
- Got Karma for Re: How can I have a checkbox checked by default?. 06-05-2024 08:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-24-2025
09:24 PM
If you are seeing Invalid key in stanza (on start up) then check for typos [indexer_discovery:master] pass4SymmKey = ... Refer to https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#outputs.conf.spec
... View more
06-16-2024
04:56 PM
The page has moved. Recommend you google it. Today it's found here https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html?301=/dev-test&locale=en_us
... View more
05-15-2024
05:06 PM
Yep works. Set your id= <input type="link" token="unused" id="resized_input" searchWhenChanged="true"> Then style it <row depends="$HIDE_ALWAYS$"> <panel> <title>Hidden panel for a horizontal linked list</title> <html> <style> #resized_input { width: 350px; } </style> </html> </panel> </row>
... View more
02-07-2024
05:00 PM
Bumping this thread. I'd like a solution to this post too. Below is Simple XML code I have used. <table> <search></search> <format type="color" field="Health"> <colorPalette type="map">{"Critical":#6A5C9E, "Abnormal":#6A5C9E, "Normal":#65A637}</colorPalette> </format> </table> See output, image below. (Dashboard left, PDF right.) Splunk Cloud Version 9.0.2303.201 Experience: Classic Links to Splunk Cloud docs https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/DashboardPDFs
... View more
09-21-2023
11:17 PM
h/t Nick I have iterated on your idea. It stripped the decimals nicely but kept the dot when "6556.000" so I added \d. | rex field=alert_value "^(?<myfield>[\s\S]*\.\d[\s\S]*?)0*$" In my case, my field also contains integers: | rex field=alert_value "^(?<keep>[^\.]+)(?<keepdot>\.{0,1})(?<keepdotdecimal>\d*?)0*$"
| eval human_value = keep . if(len(keepdotdecimal)!=0, "." . keepdotdecimal, "") It caters for "6556" and "6,556"
... View more
02-08-2023
08:26 PM
This question is answered here. h/t @manu_giriyapp host=forms.host_tok
... View more
07-12-2022
06:57 PM
Depending on your version, https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/DashStudio/searchTokens#Example_of_setting_a_token_from_search_results "ds_m45g5mF6": {
"type": "ds.search",
"options": {
"query": "index=_internal \n| stats count by sourcetype",
"enableSmartSources": true
},
"name": "Activity by Sourcetype"
... View more
- Tags:
- n
05-23-2022
09:32 PM
Thanks for your tip how we can use /count. Try this technique if you want to extract the details of your Correlation Searches: https://community.splunk.com/t5/Splunk-IT-Service-Intelligence/What-is-the-correct-REST-endpoint-to-list-ITSI-correlation/m-p/599005#M2521
... View more
05-23-2022
09:27 PM
Hopefully my reply below is useful for anybody who also finds themselves reading this old post. The technique provided by @atsviatkou_splu is useful--and it has guided me how to get a complete result. However it was only returning a subset of my Correlation Searches. I now get them all with the SPL below. 1. Correlation Search count | rest splunk_server=local "/services/event_management_interface/correlation_search/count" report_as=text
| spath input=value
| fields count 2. Correlation Search details | rest splunk_server=local "/services/event_management_interface/correlation_search" report_as=text
| eval as_json=spath(value,"{}")
| fields as_json
| mvexpand as_json
| eval name=spath(as_json, "name")
| eval search=spath(as_json, "search")
| table name search
... View more
04-10-2022
07:56 PM
1 Karma
Hopefully you figured it out long ago. Below to help others who end up here. Use the Service KPI endpoint to retrieve the ad hoc search query. Field name is kpis.search. Example below. | rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/service report_as=text filter="{\"enabled\":1}" fields="_key,title,kpis._key,kpis.title,kpis.base_search_id,kpis.base_search,kpis.alert_period,kpis.unit,kpis.aggregate_statop,kpis.entity_statop,kpis.threshold_field,kpis.entity_breakdown_id_fields,kpis.is_entity_breakdown,kpis.search" API Reference https://docs.splunk.com/Documentation/ITSI/4.12.0/RESTAPI/ITSIRESTAPIschema#Service_KPI
... View more
02-28-2022
03:54 PM
Let's imagine your data looks something like this: | gentimes start="03/01/2020 0:00:00" end="03/02/2020" increment=15m | streamstats count as id | eval value = if(id<10, random() % 16, 0) | rename starttime as _time | table _time value Then add a running total with streamstats like this: | rename value as downtime_in_min | eval uptime_in_min = 15 - downtime_in_min | streamstats sum(downtime_in_min) as RUNNING_TOTAL_downtime_in_min, sum(uptime_in_min) as RUNNING_TOTAL_uptime_in_min | table _time downtime* uptime* RUNNING_TOTAL*
... View more
02-28-2022
02:35 PM
1 Karma
Check out this JSON dashboard code, which is populating a dropdown input from a search called search1: https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/inputs#Adding_and_configuring_inputs
... View more
08-18-2021
07:55 PM
I have used below syntax so a panel will stay hidden until 2 or more conditions have been met. Hopefully helps. <panel depends="$isLinux$$isHealthy$"> That panel only shows when both tokens have a <set> value. If any token is <unset> then that panel is hidden.
... View more
08-10-2021
05:37 PM
You can use match() to scan all of _raw on every event. If you look for "WARN" then it will find "WARNING". If I was doing this I would instead give my sourcetype/search a field called log_level (in case _raw is long). <dashboard> <label>test_conditional_color</label> <row> <panel> <html> <style> #tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableRowColorWithoutJS"> <title>We can color columnA based on whichever Log Level we see in columnB </title> <search> <query> index=_internal log_level!="INFO" | fields index sourcetype host _raw | streamstats count as id | table id a_new_field* * | eval hex_color = case(match(_raw,"ERROR"),"red", match(_raw,"INFO"),"green", true(),"amber") | foreach * hex_color [| eval "<<FIELD>>"='<<FIELD>>'."|".hex_color] | foreach * [| eval "<<FIELD>>"=split('<<FIELD>>',"|")] | fields index sourcetype host _raw </query> <earliest>-1h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="host"> <colorPalette type="expression">case (match(value,"red"),"#DC4E41", match(value,"green"),"#53a051", true(),"#f4a747")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more
08-04-2021
07:11 PM
1 Karma
Try below. Seems simpler. No need for OP's eval technique. Had to use initialValue and not default. <input type="checkbox" token="showhide_choice_tok" searchWhenChanged="true"> <label></label> <choice value="yes">I want panels</choice> <change> <condition value="yes"> <set token="show_panels_tok">show</set> </condition> <condition> <unset token="show_panels_tok"></unset> </condition> </change> <delimiter> </delimiter> <initialValue>yes</initialValue> </input>
... View more
06-29-2021
07:31 PM
Excuse my super late reply. Below may help those who arrive here after me. Be careful to check that your html is referencing your stanza name - not your app name. <splunk-search-dropdown name="action.[stanza_name].param.[param_name]"... Below is how to extend the "logger_app" example in docs to add a dropdown. User's choice is sent to script. logger.html <form class="form-horizontal form-complex"> <p>Write log entries for this action.</p> <splunk-search-dropdown name="action.logger.param.mychoice1" search=" | inputlookup alert_action_dropdown1.csv | stats c by foo1" value-field="foo1" label-field="foo1"/> </form> alert_actions.conf [logger] is_custom = 1 disabled = 0 label = Log alert action description = Custom action for logging fired alerts icon_path = logger_logo.png param.mychoice0=This param is hardcoded. Look, I can use a token: $result.host$ #param.mychoice1=This param comes in from your stanza in savedsearches.conf. #savedsearches.conf: action.logger.param.mychoice1=User picks from the UI. See logger.html Output in test_modalert.log then looks like: ...</search_name> <configuration> <stanza name="test_alert_action_logger_with_added_dropdown1"> <param name="mychoice0">This param is hardcoded. Look, I can use a token: </param> <param name="mychoice1">splunk2</param> </stanza> </configuration> <result>...
... View more
03-31-2021
03:28 PM
Does anybody know what my inputs.conf setting for filter_data must look like for a key-value like below? I cannot find any detailed documentation on filter_data. And see same error when I try to use URL encoding. [snow://pa_job_logs4_javascript] table = pa_job_logs filter_data = run_time>javascript:gs.getDurationDate('0 3:0:0')&sys_created_onONLast 3 months@javascript:gs.beginningOfLast3Months()@javascript:gs.endOfLast3Months() 2021-03-31 18:04:32,776 ERROR pid=22626 tid=MainThread file=snow.py:_check_filter_data:74 | Got unexpected value run_time>javascript:gs.getDurationDate('0 3:0:0')&sys_created_onONLast 3 months@javascript:gs.beginningOfLast3Months()@javascript:gs.endOfLast3Months() of 'filter_data' field for input 'pa_job_logs4_javascript'. Enter filter parameters in key1=value1&key2=value2 format. You can either change it in inputs.conf file or edit 'Filter parameters' on Inputs page. Above table filter seems to work with the REST API Explorer in Service Now, i.e. sysparm_query=run_time.... Is there some trick to simplify it? or a work-around? Splunk Add-on for ServiceNow version 4.0.0
... View more
Labels
- Labels:
-
configuration
03-18-2021
05:09 PM
Seems for Logical AND operation you must use ampersand ("&"). Not a comma (","). Check for your TA version. Refer to https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Configureinputs
... View more
01-06-2021
05:45 PM
Clever solution. Thank-you. Tiny bug on this line: | foreach * [| eval "<<FIELD>>"='<<FIELD>>'."|".log_level] Should be: | foreach * log_level [| eval "<<FIELD>>"='<<FIELD>>'."|".log_level] Or each field that is being processed after log_level field (alphanumerically) is being given log_level 2 times. And if you notice a field value is being given a comma (',') instead of a pipe ('|') then rename it before foreach. | rename latest_time as latest_time2
... View more
01-05-2021
09:45 PM
Sorry to bump old post. Solution suggested by @niketnlay has solved it. Splunk Enterprise 8.0.5. This is the key concept: <table><format><colorPalette type="expression"> I had no luck with simply putting a token into the code the UI is generating for us: <colorPalette type="list"><scale type="threshold"> Below example works. <table>
...
<format type="color" field="age_in_mins">
<colorPalette type="expression">if(value >=
$threshold_in_mins_tok$,"#DC4E41", "#53A051")</colorPalette>
<!--colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">$threshold_in_mins_tok2$</scale-->
</format>
</table>
... View more
08-31-2020
11:57 PM
New link is https://docs.splunk.com/Documentation/Splunk/8.0.5/Updating/Forwardermanagementcompatibility#List_of_incompatibilities
... View more
07-07-2020
04:56 PM
SAI 2.1.0+ has replaced collectors.conf with entity_classes.conf Refer to https://docs.splunk.com/Documentation/InfraApp/2.1.0/Install/NewEntitySchema For Windows [perfmon] see https://community.splunk.com/t5/forums/replypage/board-id/apps-add-ons-all/message-id/59094
... View more
07-07-2020
04:56 PM
SAI 2.1.0+ has replaced collectors.conf with entity_classes.conf Refer to https://docs.splunk.com/Documentation/InfraApp/2.1.0/Install/NewEntitySchema For Linux [os] see https://community.splunk.com/t5/forums/replypage/board-id/apps-add-ons-all/message-id/59094
... View more
06-22-2020
02:09 AM
In later versions, Splunk Enterprise,->Settings->Forwarding and receiving->Configure receiving. e.g. 7.3.5.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-16-2025
01:02 AM
|
