Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ranjyotiprakash
ranjyotiprakash
Communicator
Member since:
03-29-2012
06-05-2020
Community Statistics
| Posts | 69 |
| Solutions | 5 |
| Karma Given | 20 |
| Karma Received | 18 |
| Member Since | 03-29-2012 |
Activity Feed
- Got Karma for How to limit my search to return only the top 10 results based on the following search queries ?. 09-23-2021 06:18 AM
- Karma Re: Merging Results from 3 Searches for eelisio2. 06-05-2020 12:46 AM
- Karma Re: Error in splunk 5.0 installation for amrit. 06-05-2020 12:46 AM
- Karma Re: Splunk Advanced Xml Editor for MHibbin. 06-05-2020 12:46 AM
- Karma Re: If multiple hosts, in different time zones, are sending logs to Splunk . In that case how to configure Timezone props.conf for the hosts individually. for Drainy. 06-05-2020 12:46 AM
- Karma Re: Splunk Install Error on Windows for Drainy. 06-05-2020 12:46 AM
- Karma Re: Is it possible to log the local time on the incoming logs ? for Ayn. 06-05-2020 12:46 AM
- Karma Re: Is it possible to log the local time on the incoming logs ? for Ayn. 06-05-2020 12:46 AM
- Karma Re: How to replace label "_time" with "time" coming in timecharts ? for Drainy. 06-05-2020 12:46 AM
- Karma Re: How do I make a multi-dimension timechart? for Jason. 06-05-2020 12:46 AM
- Karma Re: Table data sort behaviour for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Second dropdown is not getting populated ?? for sideview. 06-05-2020 12:46 AM
- Karma Re: Second dropdown is not getting populated ?? for sideview. 06-05-2020 12:46 AM
- Karma Re: Is it possible to change username of Splunk account ? for oprokhorenko_sp. 06-05-2020 12:46 AM
- Karma Re: Is it possible to change username of Splunk account ? for Drainy. 06-05-2020 12:46 AM
- Got Karma for Re: Search split value with spaces. 06-05-2020 12:46 AM
- Got Karma for If multiple hosts, in different time zones, are sending logs to Splunk . In that case how to configure Timezone props.conf for the hosts individually.. 06-05-2020 12:46 AM
- Got Karma for Re: capital letter, small letter (combine). 06-05-2020 12:46 AM
- Got Karma for Re: capital letter, small letter (combine). 06-05-2020 12:46 AM
- Got Karma for Re: capital letter, small letter (combine). 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 3 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-05-2015
12:36 AM
I have my own app which was compatible with Splunk 5 which has a view which shows the ip-location on the Google maps, which was working properly earlier.
With Splunk 6 this app was working after making the changes in geoip.conf of maps app mentioned in following question :
http://answers.splunk.com/answers/135685
But, now on Splunk 6.2.1 (build 245427), Google maps is working properly on Ubuntu without making any change. But, On windows it always returns following error :
PARSER: Applying intentions failed Error in 'script': Getinfo probe failed for external search command 'geoip'
or
Error in 'script': Getinfo probe failed for external search command 'geoip'
with following traceback
When I tried doing the same search search from Google Maps view, the behavior is very random. Sometimes it shows the location on the map, sometimes not, and sometimes it failes with following error :
Error in 'script': Getinfo probe failed for external search command 'geoip'.
Please check the attached screenshot
Thanks.
... View more
07-09-2013
11:47 PM
4 Karma
use eval function to either change your result to uppercase or Lowercase. Try the following search query :
sourcetype="splunk_page_search" | eval keyword=lower(keyword) | top limit=10 keyword
or
sourcetype="splunk_page_search" | eval keyword=upper(keyword) | top limit=10 keyword
I am not sure whether this will work or not. But you can try.
Go through the following splunk Documentation link text
... View more
07-09-2013
11:38 PM
1 Karma
you should move your savedsearches to
/opt/splunk/etc/apps/your_app_name/default/savedsearches.conf
and restart splunk. That's it. And go through the following splunk doc :
link text
... View more
07-09-2013
11:29 PM
you have two options :
1 .either perform field extraction using configurations in inputs.conf, props.conf, transforms.conf link text
or option 2. do field extraction directly in search command using rex link text
if using rex command, you can use something like this :
..... | rex field = _raw ".*\s+msg:\s+(?<field1>\S+)\s+((?<field2>\S+))-(?<field3>.*)" | table field1, field2, field3
or
..... | rex field = _raw ".*\s+msg:\s+(?<field1>\S+)\s+((?<field2>\S+))-(?<field3>.*)" | your search query
... View more
07-09-2013
11:10 PM
Use the following command to get a list which contains pages and max likes as columns :
.... | chart max(likes) AS Likes by page
Have a look at following Splunk Documentation :
link text
... View more
07-09-2013
05:31 AM
2 Karma
you can use the following command rex command to extract the elapsed field :
.... | rex field=_raw ".*\s+elapsed\s+:\s+(?<elapsed>\d+)\s"
and then use timechart, table, stats etc commands based upon your requirement.
... View more
07-09-2013
05:03 AM
Check the updated answer.
... View more
07-04-2013
10:59 PM
Please refer to Lister Modules Documentation and see the examples listed:
link text
Hi sunrise,
Have a look at below code example that I have used one of my views - which is having a select box, which have the unit_name values as select options.
enter code here
<module name="SearchSelectLister" layoutPanel="mainSearchControls" autoRun="True">
<param name="searchWhenChanged">True</param>
<param name="settingToCreate">unit_name_setting</param>
<param name="label">Unit Name :</param>
<param name="savedSearch">search_unit_name</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">unit_name</param>
<param name="value">unit_name</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">unit_name_setting</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="unit_name">
<param name="value">$target$</param>
</param>
</param>
</param>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">sourcetype="audit" Transaction_Type ="LOGIN"|where unit_name = "$unit_name$"|timechart count BY admin_Name </param>
...
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
...
</module>
</module>
</module>
If you can elaborate your situation, how are you trying use the module. or you can paste your code segment.
Thanks
... View more
03-12-2013
10:07 PM
Thanks a lot Stephen 🙂 +2
... View more
12-21-2012
03:03 AM
hi smolcj,
the search you mentioned in the comment doesn't work at all.
Thanks for reply
... View more
12-21-2012
02:47 AM
It's doing the change but changes the time and date format. But, I want to know why by default it is coming as _time on all the charts. But, when I create a report from the splunkweb UI it's coming as time ?
Thanks !
... View more
12-21-2012
02:22 AM
Hi Drainy,
Piping "rename _time As time" changes the time format and then it's coming as unix Time
like 1355423400 in the chart.
Thanks
... View more
12-21-2012
02:03 AM
1 Karma
I have used timecharts in splunk app. But, in all the time-charts, When mouseover the time-chart, the info it is showing in the black box comes with "_time" label for time. I want to know how to replace the _time with time label.
enter code here
<view template="dashboard.html" stylesheet="dashboard.css">
Overall Summary
*
False
1
dashboard
True
uname_setting
Unit Name :
test search
unit_name
unit_name
uname_setting
stringreplace
$target$
Last 60 minutes
True
sourcetype="access" | TR_unitname |where unit_name = "$unit_name$"| eval bandwidth=round(bytes_sent/1024,2)| timechart sum(bandwidth) | rename sum(bandwidth) AS "Bandwidth Consumed (in KB)"
Traffic Over Time
line
zero
Time
Bandwidth(in KB)
bottom
100%
360px
flashtimeline
true
<module name="HiddenSearch" layoutPanel="panel_row2_col2" autoRun="True">
<param name="search">sourcetype="firewall" Attack_Description!="NULL" |`WF_unitname`| where unit_name = "$unit_name$" | timechart count by Attack_Description</param>
<module name="JobProgressIndicator"/>
<module name="HiddenChartFormatter">
<param name="chartTitle">Attacks Over Time</param>
<param name="chart">column</param>
<param name="chart.stackMode">stacked</param>
<param name="primaryAxisTitle.text">Time</param>
<param name="secondaryAxisTitle.text">Count of Attacks</param>
<param name="legend.placement">bottom</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">360px</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
<param name="popup">true</param>
</module>
</module>
</module>
</module>
</module>
I don't know how this _time is coming. I want to replace this _time with time.
Thanks !
... View more
11-30-2012
04:50 AM
Thanks for your reply.
Is their any way so that I can change the author name of my uploaded app ? Actually, I want to show an author name different from my username.
... View more
11-30-2012
04:09 AM
3 Karma
Hi,
Is it possible to change Splunkbase username ? If yes, then how to do this .
Thanks !
... View more
- Tags:
- splunkbase
- username
10-10-2012
11:34 PM
Second option worked as I wanted. Thanks for such a quick reply, Iguinn.
... View more
10-10-2012
11:27 PM
Thanks for your reply !! I was thinking too hard for this. That's worked out very well.
... View more
10-10-2012
11:12 PM
1 Karma
I am running two different searches to get the total number of successful Logins and Unsuccessful Logins. The searches are :
sourcetype="audit" Transaction_Type = LOGIN | rex field=_raw ".*\s(?<unit_name>\S+)\sAUDIT.*$" | stats count BY unit_name |rename count AS "Successful Logins"
result is
Unit_name Successful Logins
unit1 10
unit2 20
sourcetype="audit" Transaction_Type ="UNSUCCESSFUL_LOGIN" | rex field=_raw ".*\s(?<unit_name>\S+)\sAUDIT.*$" | stats count BY unit_name |rename count AS "UnSuccessful Logins"
Unit_name UnSuccessful Logins
unit1 10
unit2 20
But, I want show the both the successful and Unsuccessful Logins in the same chart.Like,
Unit_name Successful Logins Unsuccessful Logins
unit1 10 10
Unit2 20 20
How to do this. I tried using append. Please help !
Thanks !
... View more
09-17-2012
06:40 AM
Hi tjensen,
You can refer to following documentation to configure timestamp recognition :
Configure Timestamp Recognition
Thanks !!
... View more
09-14-2012
06:43 AM
1 Karma
Hi rakesh_498115,
use " float : left ; " in your CSS file !!
for example,
to make the time-range picker and drop-down in the same line you cab use if they are in mainSearchControls layout panel then ,
.mainSearchControls .SearchSelectLister,
.mainSearchControls .TimeRangePicker {
float: left;
}
will do what you want.
Cheers,
... View more
09-11-2012
05:44 AM
Thanks a lot !!!
... View more
09-11-2012
02:22 AM
Thanks for your reply Mhibbin !
I have tried editing the CSS but, I am unable to arrange the dropdowns and Time range picker in the same line. Can you please guide me further on this ..Thanks !!!
... View more
09-10-2012
11:13 PM
How can we change the position of the different elements like dropdowns, textboxes and time-range Picker in a view ?
I have a view in my custom application and I want to have the dropdowns, text boxes and time-range picker in the same line as they are consuming a lot of spaces.
How can we do that ?
Thanks
... View more
09-09-2012
09:45 PM
Thanks a lot !!!!
... View more
