Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About timgren
timgren
Path Finder
Member since:
10-19-2020
yesterday
Community Statistics
| Posts | 20 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 5 |
| Member Since | 10-19-2020 |
Activity Feed
- Posted Is it possible to create an html unorder (bullet) list for each row of a table output? on Splunk Search. yesterday
- Tagged Is it possible to create an html unorder (bullet) list for each row of a table output? on Splunk Search. yesterday
- Tagged Is it possible to create an html unorder (bullet) list for each row of a table output? on Splunk Search. yesterday
- Posted Javascript stopped working in 9.1.1 on Dashboards & Visualizations. 11-21-2024 02:29 PM
- Got Karma for Re: How to set a token when the field exists?. 09-22-2022 09:36 AM
- Karma Re: How to set a token when the field exists? for richgalloway. 09-22-2022 08:23 AM
- Posted Re: How to set a token when the field exists? on Splunk Search. 09-22-2022 08:22 AM
- Posted How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Tagged How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Tagged How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Tagged How to set a token when the field exists? on Splunk Search. 09-21-2022 10:49 AM
- Posted Re: How to sort contiguous _time into discreet sets on Splunk Search. 08-27-2022 07:51 AM
- Karma Re: How to sort contiguous _time into discreet sets for ITWhisperer. 08-27-2022 07:51 AM
- Posted How to sort contiguous _time into discreet sets? on Splunk Search. 08-27-2022 06:12 AM
- Tagged How to sort contiguous _time into discreet sets? on Splunk Search. 08-27-2022 06:12 AM
- Tagged How to sort contiguous _time into discreet sets? on Splunk Search. 08-27-2022 06:12 AM
- Posted How can I prevent lookup editor from converting greater-than, and less-than characters to escape chars? on All Apps and Add-ons. 04-27-2022 05:51 AM
- Tagged How can I prevent lookup editor from converting greater-than, and less-than characters to escape chars? on All Apps and Add-ons. 04-27-2022 05:51 AM
- Karma Re: Can search time limit be applied by index? for richgalloway. 03-25-2022 09:32 AM
- Posted Re: Set a dashboard token based on the requestors url? on All Apps and Add-ons. 03-25-2022 09:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
yesterday
Id like to create table of results, and convert each row into an unordered bullet list using html. Such as: | table result (which has n number of results) Then in the output, i want to show each in an unordered bullet list. <html> <ul> <li> row.result.1 <li> row.result.2 <li> row.result.3 etc... </ul> </html> Possible?
... View more
Labels
- Labels:
-
chart
11-21-2024
02:29 PM
Custom token script stopped working. Can anyone spot any obvious errors? It worked perfectly from version 6.x - 8.x I the error "A custom JavaScript error caused an issue loading your dashboard. See the developer console for more details." The console isnt very helpful. common.js:1702 Error: Script error for: util/console http://requirejs.org/docs/errors.html#scripterror at makeError (eval at e.exports (common.js:1:1), <anonymous>:166:17) at HTMLScriptElement.onScriptError (eval at e.exports (common.js:1:1), <anonymous>:1689:36)
// Tokenize.js
require(['jquery', 'underscore', 'splunkjs/mvc', 'util/console'], function($, _, mvc, console) {
function setToken(name, value) {
var defaultTokenModel = mvc.Components.get('default');
if (defaultTokenModel) {
defaultTokenModel.set(name, value);
}
var submittedTokenModel = mvc.Components.get('submitted');
if (submittedTokenModel) {
submittedTokenModel.set(name, value);
}
}
// Main
$('.dashboard-body').on('click', '[data-on-class],[data-off-class],[data-set-token],[data-unset-token],[data-token-json]', function(e) {
e.preventDefault();
console.log("Inside the click");
var target = $(e.currentTarget);
console.log("here");
console.log("target.data('on-class')=" + target.data('on-class'));
var cssOnClass= target.data('on-class');
var cssOffClass = target.data('off-class');
if (cssOnClass) {
$("." + cssOnClass).attr('class', cssOffClass);
target.attr('class', cssOnClass);
}
var setTokenName = target.data('set-token');
if (setTokenName) {
setToken(setTokenName, target.data('value'));
}
var unsetTokenName = target.data('unset-token');
if (unsetTokenName) {
var tokens = unsetTokenName.split(",");
var arrayLength = tokens.length;
for (var i = 0; i < arrayLength; i++) {
setToken(tokens[i], undefined);
//Do something
}
//setToken(unsetTokenName, undefined);
}
var tokenJson = target.data('token-json');
if (tokenJson) {
try {
if (_.isObject(tokenJson)) {
_(tokenJson).each(function(value, key) {
if (value == null) {
// Unset the token
setToken(key, undefined);
} else {
setToken(key, value);
}
});
}
} catch (e) {
console.warn('Cannot parse token JSON: ', e);
}
}
});
});
... View more
Labels
- Labels:
-
javascript
09-22-2022
08:22 AM
1 Karma
Not quite, but that led me to one that does. <eval token="MyCol">if(isnotnull($row.MyCol$),"UseValue=".$row.MyCol$,"")</eval> Thanks!
... View more
09-21-2022
10:49 AM
I'm looking for a way to set a token when the column exists (regardless of value). Tried these with no luck.
<eval token=if(isnotnull($row.MyCol$),useValue=$row.MyCol$,null())> <eval token=case($row.MyCol$ != "" , useValue=$row.MyCol$) Thoughts?
... View more
Labels
- Labels:
-
eval
08-27-2022
07:51 AM
Outstanding sir - thank you! I would have never come up with that.
... View more
08-27-2022
06:12 AM
I'm trying to collapse a of data into earliest/lastest by _time, with the time is contiguous. Such as: 2022-08-27 07:36:00 2022-08-27 07:37:00 2022-08-27 07:38:00 2022-08-27 07:39:00 2022-08-27 07:40:00 2022-08-27 07:44:00 2022-08-27 07:45:00 2022-08-27 07:46:00 2022-08-27 08:31:00 2022-08-27 08:32:00 2022-08-27 08:33:00 2022-08-27 08:34:00 2022-08-27 08:35:00 earliest: latest:
2022-08-27 07:36:00 2022-08-27 07:40:00 2022-08-27 07:44:00 2022-08-27 07:46:00 2022-08-27 08:31:00 2022-08-27 08:35:00
THoughts?
... View more
04-27-2022
05:51 AM
Lookup table fields that contain < or > symbols are getting escaped to &gt; and & lt; How can I prevent this from occurring? It only happens when manipulating the field value using lookup editor. For example: servicecode>="200" AND servicecode<400,1,0), failed=if(servicecode>400,1,0) gets rewritten as: &amp;gt;="200" AND servicecode&amp;lt;400,1,0), failed=if(servicecode&amp;gt;400,1,0)
... View more
- Tags:
- lookup
Labels
- Labels:
-
lookup
03-25-2022
09:31 AM
Outstanding! Thank you. I was unaware of window.location.href
... View more
03-25-2022
08:49 AM
In a large environment with search heads in multiple locations, I would like to create a single dashboard that switches search queries values based on the search head URL. This would allow us to have a single agnostic dashboard for multiple locations and/or environments. where the index values differ from one to the other. Such as: https://splunk.NorthAmerica.Mycompany.com https://splunk.EU.Mycompany.com etc. token value = $URL$ Where I can set the locale token as: Locale=case($URL$ LIKE %NorthAmerica%, "NorthAmerica", $URL$ LIKE %EU%,Europe) Is there any build-in splunk value that reads the requesting URL? If not, how to construct a js that leverages the URLSearchParams() method to set the token?
... View more
Labels
- Labels:
-
dashboard
01-17-2022
01:03 PM
Can a search time limit be applied differently by index rather than by role? Currently, we have a search roll limit of 6 weeks. However, this limit defeats the purpose of summary indexing which are often required to examine a much longer spread. Any thoughts or work-arounds?
... View more
Labels
- Labels:
-
search job inspector
07-08-2021
06:29 AM
Is it possible to setup a dashboard query that uses the main event index for "today", and summary index for all other times while still using the the default time_picker?
... View more
03-26-2021
06:03 PM
Excellent! Can this solution be applied to an auto-extraction or transformation method?
... View more
03-26-2021
03:13 PM
I'm trying to pull KV pairs from a event field, and having trouble. The issue is I don't know what the field names will be, nor how many. The parent field value also groups the KV pairs within braces, adding and additional layer of brain trauma. In testing, /([^{=,]+)=([^,}]+)/g does the job in regex101, but not splunk. Such as: | makeresults | eval msg.additionalValues="{field1=value1, field2=value2, field3=value3}" | rex field=msg.additionalValues "/([^{=,]+)=([^,}]+)/g" Results in: Error: "Error in 'rex' command: The regex '/([^{=,]+)=([^,}]+)/g' does not extract anything. It should specify at least one named group. Format: (?<name>...)." Since i have multiple named groups, how is this possible?
... View more
Labels
- Labels:
-
field extraction
-
transforms.conf
03-19-2021
03:57 AM
Well, Not really as that is an inline rex of known fields, not a transformation of subfields which can be a variety of names. But thanks. A transformation at time of ingestion is what I'm after.
... View more
03-18-2021
05:30 PM
I have a JSON log entry with key-value pairs within the field component. I'm trying to transform the field into sub-fields using the key-value pairs. Example: "msg":{"additionalValues":"{responseTime=137, synapseTag=None, serviceName=switching-integration, uri=com.bigcompany.switching, responseCode=200}", <more fields>,...} For Splunk, I can pull one field, referenced as "msg.additionalValues". But I can't seem to transform the KVP's within that field into sub-fields. (such as "msg.additionalvalues.responseTime", and msg.additionalvalues.synapseTag, etc ) Any ideas?
... View more
- Tags:
- regex
- transformation
Labels
- Labels:
-
field extraction
11-01-2020
05:25 AM
No. I want is to show search progress in the panel window -- instead of the default "waiting for data..." message that appears before the results are completed. just as it does in event search mode. (see OP pic)
... View more
11-01-2020
05:19 AM
1 Karma
Thanks - but this only works when the top panel and input panel is the first within the row. My challenge is that it's the 2nd or 3rd panel within the same row.
... View more
11-01-2020
05:15 AM
1 Karma
Is it possible to dynamically set a token name to show/hide panels, based on the value of the input? I have a dashboard with panels that are specific to certain applications, but irrelevant to others. I want to hide the irrelevant panels when they don't apply. Such as: <input type="text" searchWhenChanged="true" > <default>$service_name$</default> <change> <set token="view_$value$"></set> </change> </input> Results in: "Invalid token name: "viewxml_$value$"" Im trying to NOT hard-code service names, because there are many, with a <condition> if possible.
... View more
- Tags:
- token
Labels
- Labels:
-
token
10-24-2020
04:08 PM
1 Karma
In search mode, there is a progression object in the top left corner that shows: "#number of 24,040 events matched" until the search is complete. Example: I would like to use the same in a dashboard panel instead of "waiting for data..." OR at least as a token value that can be applied to the <title>.
... View more
- Tags:
- dashboard
10-24-2020
09:00 AM
1 Karma
I understand that Splunk CSS defaults any <input> class to reside at the top of any panel. I would like to override this setting, and put an input (such as radio, or checklist) at the bottom of the panel, under a results table. None of the css positioning alterations using panel ID work for <input> class, even with !important. Any ideas?
... View more
Labels
- Labels:
-
CSS
-
simple XML
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
