About renjith_nair

renjith_nair

There are multiple methods to achieve this. However, lets first try it in a simpler way index=mday source="service_status.ps1" sourcetype=service_status os_service="App_Service" host=*papp01 |stats latest(status) AS status by host |eventstats values(status) as _status |eval OverallStatus=if(mvcount(_status) < 2 OR isnull(mvfind(_status,"Running")),"Down","Good") Steps - count the status values - If the count is less than 2 : meaning only one of the status from Running/Stopped is present - OR Running status is not available, we are setting the overall status as down. In this way, we can handle multiple situations where one of the server is down or both are reporting down or even both are reporting Running (active & passive) Demonstrated with a dummy search |makeresults|eval host="HostA",status="Running" |append[|makeresults|eval host="HostB",status="Stopped"] |stats latest(status) as status by host |eventstats values(status) as _status |eval OverallStatus=if(mvcount(_status) < 2 OR isnull(mvfind(_status,"Running")),"Down","Good") Try changing the status of HostA or HostB and see the results.

renjith_nair

Ok, lets check if the results are available by just removing below from the dashboard depends="$hide_this_always$" We need to confirm the sid is available since its part of the download path. So either in the title of the panel or somewhere just display the token. If the result is available and sid is present, try using the URL directly in the browser to make sure that the result is fetched. Here is a sample dashboard created using the same logic and it works <dashboard version="1.1" theme="light"> <label>Download</label> <row>  <panel depends="$hide_always$"> <title>$sid$</title> <table> <search> <query>index=_*|stats count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="date">strftime(now(), "%d-%m-%Y %H:%M:%S")</eval> <set token="sid">$job.sid$</set> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel>  <title>Job Id is : $sid$, Time is : $date$</title> <html> <a href="/api/search/jobs/$sid$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=test_$date$.csv&outputMode=csv" class="button js-button">Download</a> <style> .button { background-color: steelblue; border-radius: 5px; color: white; padding: .5em; text-decoration: none; } .button:focus, .button:hover { background-color: #2A4E6C; color: White; } </style> </html> </panel> </row> </dashboard>

renjith_nair

@Splunkerninja, this is clearly not due to the row separation but the formation of the URL for getting the search results. So if the current dashboard is working for you with the search result URL, just make the first change by closing the </row> after the table panel and open another <row> element before the html element. This will ensure that the existing dashboard is working as expected. As a second step, change the visibility of the row where table is listed and set a "depends" clause with non existing token.

renjith_nair

Its a very generic questions 🙂 You have a plenty of possibilities in network area Authentication Firewalls Proxy WAF Perimeter securities Loadbalancing and so on Have a look at https://www.splunk.com/en_us/blog/learn/network-security.html and https://www.splunk.com/en_us/blog/learn/network-monitoring.html and probably you should get something to start with

renjith_nair

renjith_nair

@vananhnguyen For that we need to know what value comes to map it with a color. We can transpose the result and set the result as column values and set the colors. Please check the following run anywhere example. makeresults is just used to create a set of dummy data { "visualizations": { "viz_PKMJkTej": { "type": "splunk.column", "options": { "y": "> primary | frameBySeriesNames('count','Critical','Failure','Info','Success')", "seriesColorsByField": { "Critical": "#dc4e41", "Failure": "#f8be34", "Success": "#53a051", "Info": "#0051B5" }, "x": "> primary | seriesByName('count')", "y2": "> primary | frameBySeriesNames('Critical','Failure','Info','Success')" }, "dataSources": { "primary": "ds_Lmyq9G4p" } } }, "dataSources": { "ds_Lmyq9G4p": { "type": "ds.search", "options": { "query": "| makeresults count=100 \n| eval value=random() \n| eval status=case(value%2==0,\"Success\",value%3==0,\"Failure\",value%4==0,\"Warning\",value%5==0,\"Critical\",1==1,\"Info\") \n| stats count by status \n| transpose header_field=status column_name=count" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_PKMJkTej", "type": "block", "position": { "x": 0, "y": 0, "w": 1010, "h": 300 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "", "title": "Static Colors" }

renjith_nair

@pevniacik , makeresults are for me to create dummy events. It does not matter which search or values you use. What we need to look is whether the logic works for you. In this case, does the logic provided in the sample works for you with the checkbox and text input? If not, based on the sample dashboard what changes you foresee?

renjith_nair

So you want to use a checkbox and not a multiselect. Both are different in splunk context. Here is the updated one. You can leave the checkbox and just filter in the text box or you can select the check box and the filter <form version="1.1" theme="light"> <label>CheckBox_Text</label> <fieldset submitButton="false"> <input type="checkbox" token="exclude" searchWhenChanged="true" id="checkbox"> <label>Select to exclude</label> <fieldForLabel>Project</fieldForLabel> <fieldForValue>Project</fieldForValue> <search> <query>|makeresults count=5|streamstats count |eval Project="Project".count|eval Record="Some records "|eval Record=if(count%2==0,Record,Record."Error")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> ,</delimiter> <prefix>AND NOT Project IN (</prefix> <suffix>)</suffix> <default>""</default> </input> <input type="text" token="text_filter" searchWhenChanged="true"> <label>Text to Filter</label> <default>*</default> </input> </fieldset> <row> <panel> <table> <search> <query>|makeresults count=5|streamstats count |eval Project="Project".count|eval Record="Some records "|eval Record=if(count%2==0,Record,Record."Error") |where NOT like (Record,"%$text_filter$%") $exclude$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

renjith_nair

@vananhnguyen , Here is a run anywhere example. Are you looking for something like this ? You can change the value in the dropdown and the colors will be reset { "visualizations": { "viz_NJsTjQl4": { "type": "splunk.singlevalue", "options": { "majorColor": "> majorValue | matchValue(majorColorEditorConfig)" }, "dataSources": { "primary": "ds_275I8YNY" }, "context": { "majorColorEditorConfig": [ { "match": "Running", "value": "#118832" }, { "match": "Stopped", "value": "#d41f1f" } ] } } }, "dataSources": { "ds_275I8YNY": { "type": "ds.search", "options": { "query": "| makeresults\n| eval value=\"$status$\"" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_BHJAbWl2": { "options": { "items": [ { "label": "Running", "value": "Running" }, { "label": "Stopped", "value": "Stopped" } ], "token": "status", "selectFirstSearchResult": true }, "title": "Status", "type": "input.dropdown" } }, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_NJsTjQl4", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_BHJAbWl2" ] }, "description": "", "title": "single_panel_studio" } Reference : https://docs.splunk.com/Documentation/Splunk/9.2.1/DashStudio/visualEditDynamic

renjith_nair

@Splunkerninja , Can we add another row only for the html panel and hide the result row/panel with a "depends" token? Something like <row> <panel depends="$hide_this_always$"> <table> <search> <done> <eval token="date">strftime(now(), "%d-%m-%Y")</eval> <set token="sid">$job.sid$</set> </done> <query>index=test</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> <html> <a href="/api/search/jobs/$sid$/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=test_$date$.csv&outputMode=csv" class="button js-button">Download</a> <style> .button { background-color: steelblue; border-radius: 5px; color: white; padding: .5em; text-decoration: none; } .button:focus, .button:hover { background-color: #2A4E6C; color: White; } </style> </html> </row>

renjith_nair

You can make use of the KV store to store information and retrieve https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/ https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/ https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/ Splunk JS can be then used to control the button actions and processing the record. There were some dev materials available explaining the overall process but looks like its removed. There are some third party documentation available in public for splunk KVStore CRUD

renjith_nair

@pevniacik , Are you looking for something like this ? Test by selecting few projects and add a text "Error" to the text box to filter <form version="1.1" theme="light"> <label>MultiSelect_Text</label> <fieldset submitButton="false"> <input type="multiselect" token="Project"> <label>Project</label> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <fieldForLabel>Project</fieldForLabel> <fieldForValue>Project</fieldForValue> <search> <query>|makeresults count=5|streamstats count |eval Project="Project".count|eval Record="Some records "|eval Record=if(count%2==0,Record,Record."Error")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="text" token="text_filter" searchWhenChanged="true"> <label>Text to Filter</label> <default>*</default> </input> </fieldset> <row> <panel> <table> <search> <query>|makeresults count=5|streamstats count |eval Project="Project".count|eval Record="Some records "|eval Record=if(count%2==0,Record,Record."Error") |where Project in ($Project$) AND NOT like (Record,"%$text_filter$%")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

renjith_nair

@ravir_jbp , Did you try fillnull https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull OR replace in case its a literal value NULL https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace

renjith_nair

Try changing the applicationName to APPLICATION_NAME in the prefix <input type="dropdown" token="BankApp" searchWhenChanged="true"> <label>ApplicationName</label> <choice value="*">All</choice> <search> <query> | inputlookup BankIntegration.csv | dedup APPLICATION_NAME | sort APPLICATION_NAME | table APPLICATION_NAME </query> </search> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>APPLICATION_NAME</fieldForValue> <default>*</default> <prefix>APPLICATION_NAME="</prefix> <suffix>"</suffix> </input> in the second look up, you are trying to filter with applicationName="" where as the lookup file seems to have APPLICATION_NAME as header

renjith_nair

@karthi2809 Try this example. Changes : While setting the token on the change event, you should use the values . PS : Added a token to the Interface text to demonstrate the changes. <form version="1.1" theme="light"> <label>Depends_Rejects</label> <fieldset submitButton="false"></fieldset> <row> <panel id="panel_layout"> <input id="input_link_split_by" type="link" token="tokSplit" searchWhenChanged="true"> <label></label> <choice value="Finance">OVERVIEW</choice> <choice value="BankIntegrations">BANKS</choice> <default>OVERVIEW</default> <initialValue>OVERVIEW</initialValue> <change> <condition value="Finance"> <set token="Finance">$value$</set> <unset token="BankIntegrations"></unset> </condition> <condition value="BankIntegrations"> <set token="BankIntegrations">$value$</set> <unset token="Finance"></unset> </condition> </change> </input> </panel> </row> <row> <panel> <input type="time" token="time" searchWhenChanged="true"> <label>Time Interval</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="env" searchWhenChanged="true"> <label>Environment</label> <choice value="*">ALL</choice> <choice value="DEV">DEV</choice> <choice value="TEST">TEST</choice> <choice value="PRD">PRD</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$"> <label>ApplicationName</label> <choice value="*">ALL</choice> <choice value="p-wd-finance-api">p-wd-finance-api</choice> <default>"p-wd-finance-api</default> <initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>ApplicationName</fieldForValue> </input> <input type="text" token="InterfaceName" searchWhenChanged="true" depends="$Finance$" rejects="$BankIntegrations$"> <label>InterfaceName</label> <default>$tokSplit$</default> <initialValue></initialValue> </input> <input type="dropdown" token="applicationName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$"> <label>ApplicationName</label> <choice value="p-wd-finance-api">p-wd-finance-api</choice> <default>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</default> <initialValue>p-oracle-fin-processor","p-oracle-fin-processor-2","p-wd-finance-api</initialValue> <fieldForLabel>ApplicationName</fieldForLabel> <fieldForValue>ApplicationName</fieldForValue> </input> <input type="text" token="InterfaceName" searchWhenChanged="true" depends="$BankIntegrations$" rejects="$Finance$"> <label>InterfaceName</label> <default>$tokSplit$</default> <initialValue></initialValue> </input> </panel> </row> </form> Hope it helps!

renjith_nair

@selvam_sekar Are you trying to achieve something similar? Here is a run anywhere example . Number input is only to change the value in the A box for demonstration { "visualizations": { "viz_mP9NTc6l": { "type": "splunk.singlevalue", "options": { "trendColor": "#171d21", "backgroundColor": "#dc4e41" }, "dataSources": { "primary": "ds_uCpsCnrn" } }, "viz_5qfKAE2H": { "type": "splunk.singlevalue", "options": { "backgroundColor": "#b6c75a" }, "dataSources": { "primary": "ds_s5yiPOpw_ds_uCpsCnrn" } }, "viz_lwpeyQcS": { "type": "splunk.singlevalue", "options": { "backgroundColor": "#62b3b2" }, "dataSources": { "primary": "ds_6iVMrVEi_ds_s5yiPOpw_ds_uCpsCnrn" } }, "viz_P6dRCwGc": { "type": "abslayout.line" }, "viz_jTW6Jy5J": { "type": "abslayout.line" } }, "dataSources": { "ds_uCpsCnrn": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults count=$number$\n| stats count" }, "name": "A" }, "ds_s5yiPOpw_ds_uCpsCnrn": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults count=5\n| stats count" }, "name": "B" }, "ds_6iVMrVEi_ds_s5yiPOpw_ds_uCpsCnrn": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults\r\n| eval variance=$A:result.count$ - $B:result.count$\r\n| table variance" }, "name": "Variant" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_vWVKiJlJ": { "options": { "defaultValue": 10, "token": "number" }, "title": "Number Input Title", "type": "input.number" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_mP9NTc6l", "type": "block", "position": { "x": 410, "y": 170, "w": 150, "h": 100 } }, { "item": "viz_5qfKAE2H", "type": "block", "position": { "x": 680, "y": 170, "w": 150, "h": 100 } }, { "item": "viz_lwpeyQcS", "type": "block", "position": { "x": 520, "y": 370, "w": 150, "h": 100 } }, { "item": "viz_P6dRCwGc", "type": "line", "position": { "from": { "x": 483, "y": 274 }, "to": { "item": "viz_lwpeyQcS", "port": "n" } } }, { "item": "viz_jTW6Jy5J", "type": "line", "position": { "from": { "x": 756, "y": 272 }, "to": { "item": "viz_lwpeyQcS", "port": "n" } } } ], "globalInputs": [ "input_global_trp", "input_vWVKiJlJ" ] }, "description": "", "title": "Variance_Test" }

renjith_nair

It could be in the default location as well Try the command and should give you some pointers splunk btool web list --debug|findstr cert Or in details splunk btool web list settings

renjith_nair · ‎03-01-2024

Can you try changing the condition value to tok1* instead of tok1 ? Here is a run anywhere example for reference <form version="1.1" theme="light"> <label>Tokens</label> <fieldset submitButton="false"> <input type="dropdown" token="project" searchWhenChanged="true"> <label>Project</label> <choice value="tok1*">Token1</choice> <choice value="tok2*">Token2</choice> <change> <condition value="tok1*"> <set token="x-key">Key1</set> </condition> <condition value="tok2*"> <set token="x-key">Key2</set> </condition> </change> </input> <input type="multiselect" token="Record"> <label>Record</label> <delimiter> ,</delimiter> <fieldForLabel>Record</fieldForLabel> <fieldForValue>Record</fieldForValue> <search> <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|search project=$project$ AND x-key=$x-key$</query> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> </input> </fieldset> <row> <panel> <title>Project = $project$ , Key = $x-key$, Record = $Record$</title> <table> <title>Results</title> <search> <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|where Record in ($Record$)</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>

renjith_nair · ‎03-01-2024

@Ayushi-Sriva , You can use the dynamic formatting, please refer here https://docs.splunk.com/Documentation/Splunk/9.2.0/DashStudio/chartsSV#Add_emphasis_to_a_returned_value_using_dynamic_formatting Please find a run anywhere example You can change the status in the drop down and will be reflected in the search by using token. Based on the status, the color changes { "visualizations": { "viz_NJsTjQl4": { "type": "splunk.singlevalue", "options": { "majorColor": "> majorValue | matchValue(majorColorEditorConfig)" }, "dataSources": { "primary": "ds_275I8YNY" }, "context": { "majorColorEditorConfig": [ { "match": "Running", "value": "#118832" }, { "match": "Stopped", "value": "#d41f1f" } ] } } }, "dataSources": { "ds_275I8YNY": { "type": "ds.search", "options": { "query": "| makeresults\n| eval value=\"$status$\"" }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_BHJAbWl2": { "options": { "items": [ { "label": "Running", "value": "Running" }, { "label": "Stopped", "value": "Stopped" } ], "token": "status", "selectFirstSearchResult": true }, "title": "Status", "type": "input.dropdown" } }, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_NJsTjQl4", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_BHJAbWl2" ] }, "description": "", "title": "single_panel_studio" }

renjith_nair · ‎02-27-2024

Here is a run anywhere example. One of the columns is defined as _hidden so that it wont be displayed in the table. _fields are considered to be internal fields and there is an option to hide them. The second panel displays the value of the taken while clicking on each row { "visualizations": { "viz_oIMuXymL": { "type": "splunk.table", "dataSources": { "primary": "ds_yjf97sDt" }, "options": { "showInternalFields": false }, "eventHandlers": [ { "type": "drilldown.setToken", "options": { "tokens": [ { "token": "HiddenValue", "key": "row._hidden.value" } ] } } ], "title": "" }, "viz_gyqHTdIv": { "type": "splunk.markdown", "options": { "markdown": "**Value of Clicked row : $HiddenValue$**", "backgroundColor": "#ffffff", "fontFamily": "Times New Roman", "fontSize": "extraLarge" } } }, "dataSources": { "ds_yjf97sDt": { "type": "ds.search", "options": { "query": "| makeresults count=5\n| streamstats count\n| eval value=\"Value\".count\n| eval _hidden=\"Hidden\".count\n| fields - count", "queryParameters": { "earliest": "-24h@h", "latest": "now" } }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": {}, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_oIMuXymL", "type": "block", "position": { "x": 0, "y": 0, "w": 1440, "h": 400 } }, { "item": "viz_gyqHTdIv", "type": "block", "position": { "x": 0, "y": 400, "w": 1440, "h": 400 } } ], "globalInputs": [] }, "description": "", "title": "drilldown_studio" }

renjith_nair · ‎02-26-2024

From the syntax `Exempted_Dark_Devices`, it's a macro. Look in the macro definitions and you should be able to find the expansion of this macro https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros

renjith_nair · ‎02-24-2024

@Abhigyan_2907 , Assuming that by PCF , you meant Pivotal Cloud Foundry Without looking at the sample logs, it's difficult to formulate a search to get the logs. There are different log types for applications and based on your requirement , you could search the respective types. Have a look at this https://docs.cloudfoundry.org/devguide/deploy-apps/streaming-logs.html

renjith_nair · ‎02-23-2024

@Cheng2Ready , Please try this run anywhere example <form version="1.1" theme="light"> <label>DropDown</label> <fieldset submitButton="false"> <input type="dropdown" token="sources" searchWhenChanged="true"> <label>Sources</label> <choice value="A">A</choice> <choice value="B">B</choice> <choice value="C">C</choice> <choice value="D">D</choice> <default>A</default> <initialValue>A</initialValue> <change> <condition value="A"> <set token="searchA">true</set> <unset token="searchB"></unset> <unset token="searchC"></unset> <unset token="searchD"></unset> </condition> <condition value="B"> <set token="searchB">true</set> <unset token="searchA"></unset> <unset token="searchC"></unset> <unset token="searchD"></unset> </condition> <condition value="C"> <set token="searchC">true</set> <unset token="searchA"></unset> <unset token="searchB"></unset> <unset token="searchD"></unset> </condition> <condition value="D"> <set token="searchD">true</set> <unset token="searchA"></unset> <unset token="searchB"></unset> <unset token="searchC"></unset> </condition> </change> </input> </fieldset> <row> <panel depends="$searchA$"> <title>Panel1</title> <table> <title>Search A</title> <search> <query>| makeresults count=5| streamstats count|eval search="SEARCH A REsults - " + count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$searchA$"> <title>Panel2</title> <html> <a href="https://community.splunk.com/t5/Splunk-Answers/ct-p/en-us-splunk-answers">Splunk Answers</a> </html> </panel> </row> <row> <panel depends="$searchB$"> <title>Panel3</title> <table> <title>Search B</title> <search> <query>| makeresults count=5| streamstats count|eval search="SEARCH B REsults - " + count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$searchC$"> <title>Panel4</title> <table> <title>Search C</title> <search> <query>| makeresults count=5| streamstats count|eval search="SEARCH C REsults - " + count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$searchD$"> <title>Panel5</title> <table> <title>Search D</title> <search> <query>| makeresults count=5| streamstats count|eval search="SEARCH D REsults - " + count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

renjith_nair · ‎02-20-2024

Please have a look at https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Configurethepeerindexes

renjith_nair · ‎02-20-2024

inputs.conf is configured on the machine from where the data is forwarded. So it could be on UF,HF,Indexer or even on Search Head if the logs are being forwarded Sourcetype can be applied on the general section which will be considered if individual sections are not specified Please have a look at this https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Wheretofindtheconfigurationfiles more detailed information And also here to have an understanding about the data processing https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590781#M103485 The source is the name of the file, stream, or other input from which a particular event originates. The sourcetype determines how Splunk software processes the incoming data stream into individual events according to the nature of the data. In short , /var/log/apache.log is a source and how the source file should be parsed is defined by the sourcetype access_combined

Posts	2467
Solutions	637
Karma Given	55
Karma Received	926
Member Since	‎01-08-2015

Online Status	Offline
Date Last Visited	yesterday

Why all indexes are not available to select from "...

What are the reasons for buckets with name duplica...

Re: service status of a service including Disaster...

Re: How to add download button while hiding the re...

Re: How to add download button while hiding the re...

Re: Projects

Re: Search for ip in lookup based on system alias ...

Re: Configure static color by value in splunk dash...

Re: how to add a textbox value to a multiselect in...

Re: how to add a textbox value to a multiselect in...

Re: Configure static color by value in splunk dash...

Re: How to add download button while hiding the re...

Re: How to Create a custom Configuration Table in ...

Re: how to add a textbox value to a multiselect in...

Re: Need to replace null values to space or some o...

Re: How to get token values from dropdown to splun...

Re: How to use depend and reject use on input type...

Re: how to fix the "Please set up valid data sour...

Re: Ceritifcate says it is expired but I cannot fi...

Re: How to replace query input variables with vari...

Re: how we can colour the text as green for status...

Re: How to drilldown in Dashboard Studio using the...

Re: How to find a seach file

Re: Search query to fetch PCF application instance...

Re: How to dynamically show/hide a dashboard panel...

Re: How to create an index for use in a cluster en...

Re: inputs configuration and location.