About sanjai

sanjai

Thanks for the reply @deepakc , but that didn't work for me🙂

sanjai

Hello everyone, I'm currently working on a Dashboard to visualize Database latency across various machines, and I'm encountering an issue with the Line Chart's SPL (Search Processing Language). The SPL requirement is to retrieve all values of the field ms_per_block grouped by ds_file_path and machine. Here's my SPL: index=development sourcetype=custom_function user_action=database_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | search ds_file_path="\\\\swmfs\\orca_db_january_2024\\type\\rwo.ds" | chart values(ms_per_block) by ds_file_path machine My result: My goal is to have the output where each ds_file_path value is listed in individual rows along with the corresponding machine and ms_per_block values in separate rows. I've tried using the table command: | table ds_file_path, machine, ms_per_block But this doesn't give me the desired output. The machine name is under a field, whereas I need the machine name to be a separate field, each containing its respective ms_per_block value. I feel like I'm missing something here. Any guidance on how to achieve this would be greatly appreciated. Thanks in advance!

sanjai

Thanks @ITWhisperer , it worked

sanjai

Hi @ITWhisperer Thanks for reply , I understand , But correct me if i'm wrong 1.If i have a seperate hidden panel that gives my token value (avg_processing_time_per_block ) 2.Then how can i assign the token $avg_processing_time_per_block$ value to overlay Fields like these? <option name="charting.chart.overlayFields">$avg_processing_time_per_block$ </option> or <option name="charting.chart.overlayFields">avg_processing_time_per_block </option> if i gives these a token then line chart have a single line named avg_processing_time_per_block but the requirement is the avg_processing_time_per_block has dynamic value My need is to how to assign the avg_processing_time_per_block value as token in charting.chart.overlayFields thanks,

sanjai

Hi Splunkers, I am working on creating a column line chart dashboard that shows database lattency . I'm encountering a issue where I'm trying to pass a token value to overlay options for line chart representation over a column chart. Here are things currently i have, My Chart and My SPL query: SPL: index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine | appendcols [search index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | stats max(block_count) as total_blocks by ds_file_path] I need to assign the overlay field value(avg_processing_time_per_block )from the line in SPL: | chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine The reason I'm attempting to assign it as a token is that the avg_processing_time_per_block has dynamic values (sometimes it may be 10 or 12 machines data ).instead of rwmini and rwws01. Column has total_blocks value Or is there any ways to achieve this requirement? Your thoughts on these are highly appreciated. Thank you in advance. Sanjai

sanjai

Hi @mdunnavant , I noticed you were working on passing a token to chart overlay. I'm encountering a similar issue where I'm trying to pass a token value to overlay options for line chart representation over a column chart. If you've managed to achieve this, could you please share how you made it overlay with a token value? Your insights would be greatly appreciated. My Chart and My SPL query: SPL: index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine | appendcols [search index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | stats max(block_count) as total_blocks by ds_file_path] I need to assign the overlay field value from the line in SPL: | chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine The reason I'm attempting to assign it as a token is that the avg_processing_time_per_block has dynamic values (sometimes it may be 10 or 12).instead of rwmini and rwws01. Thanks In advance,

sanjai · ‎03-27-2024

Thank you @bowesmana . I'm also considering implementing the select value in JavaScript 🙂. Appreciate your time.

sanjai · ‎03-26-2024

Hi @bowesmana , The allowCustomValues attribute indeed works well, but my requirement is slightly different. I have a text input box inside an HTML tag that receives cron input from the user, and this input is then processed with a JavaScript file. Here, I'm attempting to implement a dropdown where the user can either select from predefined cron expressions or enter their own. Here's the content of my HTML tag: <html> <div> <input type="text" id="cron_input" placeholder="Enter cron expression (optional)" name="cron_command" /> </div> <div> <p/> <button id="save_cron_input" class="btn-primary">Save</button> </div> </html> Is it possible to include a dropdown with allowCustomValue inside the HTML tag (as depicted in the image below)? I aim to provide some default cron expressions to the user. The main goal of this configuration is to gather input (cron expressions) from the user. Additionally, I've included some basic cron expressions in the dropdown so the user can either select from them or enter their own. Thank you for your assistance!

sanjai · ‎03-19-2024

Yes, I'm customizing the login screen for Splunk Enterprise, not for Splunk Cloud. I'm ignoring these failures. Thanks. @richgalloway

sanjai · ‎03-19-2024

@bowesmana thanks . its helpful

sanjai · ‎03-18-2024

Hi Splunkers, I'm currently working on customizing the Splunk login screen to change the logo, background, footer, etc. I referred to the Splunk documentation (https://docs.splunk.com/Documentation/Splunk/9.1.3/AdvancedDev/CustomizeLogin) and successfully completed the customization. Now, the Splunk login screen displays my logo, background image, and footer content. However, I encountered an issue when running Splunk App Inspect on the custom-login app I created. The Splunk App Inspect tool reported 8 failures: The web.conf file contains a [settings] stanza, which is not permitted. Only [endpoint:] and [expose:] stanzas are allowed in web.conf. Line Number: 1 The 'local' directory exists, which is not allowed. All configuration should be in the 'default' directory. The 'local.meta' file exists, which is not permitted. All metadata permissions should be set in 'default.meta'. No README file was found, which should include version support, system requirements, installation, configuration, troubleshooting, and running of the app, or a link to online documentation. I'm wondering if the [endpoint:*] and [expose:*] stanzas in web.conf are necessary for customizing the login screen. Are these stanzas required for login screen changes? All other issues have been fixed. (for production environment) Below is the corrected version of the custom_login app structure based on the Splunk App Inspect recommendations: ``` custom_login |-- default | |-- app.conf | |-- web.conf | |-- restmap.conf | |-- savedsearches.conf | |-- ui_prefs.conf | |-- README | |-- data |-- metadata | |-- default.meta |-- static | |-- appIcon.png | |-- appIcon_2x.png | |-- appIconAlt.png | |-- appIconAlt_2x.png | |-- background.png | |-- fav_logo.png |-- bin | |-- readme.txt |-- appserver | |-- static | |-- background.png | |-- fav_logo.png ``` Here are the contents of the configuration files: **app.conf** ``` [launcher] author = NAME description = <<<<<XXXXXXXXYYYYYY>>>>>>. version = Custom login 1.0 [install] is_configured = 0 [ui] is_visible = 1 label = Custom app login [triggers] reload.web = web.conf reload.restmap = restmap.conf reload.ui_prefs = ui_prefs.conf ``` **restmap.conf** ``` # restmap.conf for custom_login [endpoint:login_background] # REST endpoint for login background image configurations match = /custom_login ``` **ui_prefs.conf** ``` [settings] loginBackgroundImageOption = custom loginCustomBackgroundImage = custom_login:appserver/static/background.png login_content = This is a server managed by my team. For any inquiries, please reach out to us at YYYY.com loginCustomLogo = custom_login:appserver/static/fav_logo.png loginFooterOption = custom loginFooterText = © 2024 XXXXXXX ``` **web.conf** ``` [endpoint:login] [expose:login_background] pattern = /custom_login methods = GET ``` I am currently working in a development environment. Any advice on how to proceed with these changes would be appreciated. Thanks in advance.

sanjai · ‎03-07-2024

i'm having a thought , that a text input box which has a dropdown and also able to enter text input with a single token, i am not sure this will works , needed guidance Thanks in Advance. Sanjai S

Posts	12
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎12-14-2023

Online Status	Online
Date Last Visited	7 hours ago

Need Guidance on Formatting SPL Output for Individ...

Passing Token values to Overlay field in the line ...

Splunk app inpsect - Customizing splunk login scre...

is it possible to create a text input with some pr...

Re: Need Guidance on Formatting SPL Output for Ind...

Need Guidance on Formatting SPL Output for Individ...

Re: Passing Token values to Overlay field in the l...

Re: Passing Token values to Overlay field in the l...

Passing Token values to Overlay field in the line ...

Re: Passing token to chart overlay

Re: is it possible to create a text input with som...

Re: is it possible to create a text input with som...

Re: Splunk app inpsect - Customizing splunk login ...

Re: is it possible to create a text input with som...

Splunk app inpsect - Customizing splunk login scre...

is it possible to create a text input with some pr...