About davecroto

davecroto · ‎12-09-2021

I am following the docs and when it asks for logging level it only allows you to choose 1 level. What if I wanted multiple levels? It only seems to allow one to be selected. Select a new logging level from the drop-down menu. Change logging level On Splunk Web, go to the Splunk Add-on for Cisco Meraki, either by clicking the name of this add-on on the left navigation banner or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Cisco Meraki. Click the Configuration tab. Click the Logging tab. Select a new logging level from the drop-down menu. Click Save to save your configurations.

davecroto · ‎12-10-2014

In /apps/search/appserver/static/single.css: Do this: .single-value .single-result { color: #FF0000; font-size: 50px !important; vertical-align: -4px; margin: 0px 6px; } Then in your xml. Do this: <dashboard stylesheet="single.css"> <label>Single Value Dasboard</label> ...... </dashboard>

davecroto · ‎12-10-2014

Try this...from dashboard to form <form> <label>Single Value Dasboard</label> <fieldset submitButtom="false"> <html> <style type="text/css"> .single-value .single-result { font-size: 50px; } </style> </html> </fieldset> <row> <panel> <single> <title>TotalCount</title> <searchString>index=_internal | eval cur=if(_time > relative_time(now(),"-15m"),1,0) | stats count by cur | sort -cur</searchString> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> <option name="field">count</option> <option name="afterLabel">Messages Processed in Last 24 hours</option> <option name="drilldown">none</option> <option name="linkView">search</option> </single> </panel> </row> </form>

davecroto · ‎12-10-2014

This may work to <form> <label>Single Value Dasboard</label> <fieldset submitButtom="false"> <html> <style type="text/css"> .single-value .single-result { font-size: 50px; } </style> </html> </fieldset> <row> <panel> <single> <title>TotalCount</title> <searchString>index=_internal | eval cur=if(_time > relative_time(now(),"-15m"),1,0) | stats count by cur | sort -cur</searchString> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> <option name="field">count</option> </single> </panel> </row> </form>

davecroto · ‎12-10-2014

Perfect! Thanks!

davecroto · ‎12-10-2014

Try: .single-value .single-result { color: #FF0000; font-size: 50px !important; vertical-align: -4px; margin: 0px 6px; } Restart Splunk Web

davecroto · ‎12-10-2014

Added !important, like below. Be careful, make sure the semicolon ";" is after the word !important. .single-value .single-result { font-size: 15px !important; font-weight: bold; word-wrap: break-word; Then restart Splunk Web.

davecroto · ‎12-10-2014

Every time I try and create a new .CSS file called foobar.css and place it in $SPLUNKHOME/etc/apps/my new app/appserver/static Here is the only thing I have in foobar.css: .single-value .single-result { font-size: 15px; font-weight: bold; word-wrap: break-word; And then: Here is my XML....Notice the foobar.css referenced as the stylesheet <dashboard stylesheet="foobar.css"> <label>test</label> <row> <panel> <single> <searchString>index=_internal |head 2 |stats dc(sourcetype)</searchString> <earliestTime/> <latestTime/> <option name="drilldown">none</option> </single> </panel> </row> </dashboard> When I go to firebug it is crossed out and I am back to the default 24px size not 15px

davecroto · ‎12-13-2013

I got this to work via somesoni2

davecroto · ‎12-13-2013

I got this to work by changing the CSS as somesoni suggests.

davecroto · ‎12-06-2013

unfortunately no dice

davecroto · ‎12-06-2013

Is there a way to use the old single value: Instead of: In simple or advanced (still in 5.0.x)

davecroto · ‎11-01-2013

sorry: REGEX=$(\w+),(\w+),(\w+)$\s+VALUE\s+$(\d+),(\d+),(\d+)$

davecroto · ‎11-01-2013

Thanks Ayn regardless of the multiple regex I've tried and work, (rubular) including yours (real world is a bit more sophisticated) the test data is being cleaned and re=indexed. I understand your pain about the images of .conf files, Apologies: props: [brenttoo] TRANSFORMS-make_fields_two = make_fields_two transforms.conf [make_fields_two] REGEX=((\w+),(\w+),(\w+))\s+VALUE\s+((\d+),(\d+),(\d+)) FORMAT = $1::$4 $2::$5 $3::$6 Still does not want to work. I would like to get this small example working and then decide if index time is right for this use case.

davecroto · ‎10-31-2013

Can I get an assist for this? My fields are not showing up. Trying a simple extraction / field mapping with transforms.conf. Here is a sample event: Thu Oct 31 17:04:56 EDT 2013 bla bla bla (IV_ADM_ID,TOT_ORD_TCK_QTY,AS_ORD_IV_LNAM) VALUE (4,5,6) I want the fields: IV_ADM_ID=4 TOT_ORD_TCK_QTY=5 AS_ORD_IV_LNAM=6 transforms.conf: props.conf: brenttoo is my sourcetype

davecroto · ‎09-04-2013

Sorry Jon, This did not work The sample log does not always have a %M for example: August 13, 2013, Hour 1 foobar:A general I will be opening a case.

davecroto · ‎08-31-2013

Thanks Tgow, but I tried it in both.

davecroto · ‎08-31-2013

sedcmd in props.conf here is an example: [your sourcetype] sedcmd-extractfilename = s\/^[a-zA-Z0-9][ ]+ \/\/g This of course if your regex is working properly.

davecroto · ‎08-30-2013

added SHOULD_LINEMERGE = false and it split it up, but still not the right timestamp

davecroto · ‎08-30-2013

I have a non - standard, Adobe / Omniture log standard timestamp that I want to extract. The value after the word Hour is the actual hour of the day in military time so 0 is between 12 and 1am...and so on and so forth til hour 23. Don't care about minutes or seconds. Error logs are not spitting out any useful info, but it is not pulling out the timestamp. Example 1: "August 13, 2013", Hour 0 foobar:A 1 Example 2: "August 13, 2013", Hour 1 300:A general here is my complete datetime.xml <![CDATA[\"(\w+)\s+(\d{1,2})\,\s+(\d{4})\,\s+Hour\s+(\d{1,2})\"\,\s+]> Why is this not working? I hard coded the actual Month "August" to test make sure it was not my regex, but timestamp is still wrong. Here is my props.conf: [timestamp] NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD = 2 DATETIME_CONFIG = /etc/system/local/datetime.xml TIME_FORMAT = %B %d, %Y, Hour %H doesn't like the hour either.

davecroto · ‎08-13-2013

Can you post your search?

davecroto · ‎08-13-2013

Also, this type of log format is not the same in all rows Not sure what you mean here. Do you mean the (abcd,efgh) is not always in the same column?

davecroto · ‎08-12-2013

http://apps.splunk.com/app/1355

davecroto · ‎08-12-2013

First add an entry in $SPLUNK_HOME/etc/systems/local/transforms.conf: [alookupexample] filename=mycsvfile.csv Then either restart splund or do a | extract reload=t then run a search like the one below: somesearch | lookup alookupexample <oneofthefieldsyouextractedviagui> OUTPUT <oneofthefieldsinthelookup)in_the_lookup> oneofthefieldsyouextractedviagui above needs to be the first column of the csv lookup make sure you are looking at all the interesting fields on the right (blue) of the screen After you've confirmed that that works put in the correct stanza inside of the props.conf file.

davecroto · ‎08-09-2013

http://splunk-base.splunk.com/answers/13009/can-i-format-a-table-in-reverse-field-headings-by-row-not-by-columns

Posts	91
Solutions	8
Karma Given	2
Karma Received	30
Member Since	‎10-20-2010

Online Status	Offline
Date Last Visited	‎05-04-2022 12:51 PM

Splunk Add-on for Cisco Meraki How Do I Get Multi...

In Splunk 6.1.X How Do I Change The Font Size of a...

Retro Old Single Value module

Field Mapping with Transforms

datetime.xml problem with a word "hour"

Breadcrumbs only takes static values.

DBConnect, DBx, Database Connect JDBC.log errors.

what is DBCount vs Buckets.

UNC failed to follow files in a directory

simpleresultstable with a column of HyperLinks

Splunk Add-on for Cisco Meraki How Do I Get Multi...

Re: Font Size in Splunk 6.1.x

Re: Not able to override default font size of sing...

Re: Not able to override default font size of sing...

Re: Not able to override default font size of sing...

Re: Not able to override default font size of sing...

Re: In Splunk 6.1.X How Do I Change The Font Size ...

In Splunk 6.1.X How Do I Change The Font Size of a...

Re: Retro Old Single Value module

Re: Retro Old Single Value module

Re: Retro Old Single Value module

Retro Old Single Value module

Re: Field Mapping with Transforms

Re: Field Mapping with Transforms

Field Mapping with Transforms

Re: datetime.xml problem with a word "hour"

Re: datetime.xml problem with a word "hour"

Re: Can I use SED in configuration files?

Re: datetime.xml problem with a word "hour"

datetime.xml problem with a word "hour"

Re: Help on top10 search with variations

Re: Field extraction in cab

Re: Support for Security Center

Re: Using extracted fields in automatic lookups

Re: Turning a table [Transpose]