Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About thomasroulet
thomasroulet
Path Finder
Member since:
04-09-2019
09-01-2021
Community Statistics
| Posts | 30 |
| Solutions | 6 |
| Karma Given | 10 |
| Karma Received | 16 |
| Member Since | 04-09-2019 |
Activity Feed
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 09-01-2021 02:21 AM
- Got Karma for Re: How to pass input variable to dbxquery. 09-16-2020 07:52 AM
- Karma Splunk is generating filenames that exceed 255 characters for rayskycubed. 06-05-2020 12:50 AM
- Karma Re: CSRF problem with a reverse proxy for plaxosi. 06-05-2020 12:50 AM
- Karma Re: Splunk cloud bump for jeffland. 06-05-2020 12:50 AM
- Karma Re: Splunk 8.0 upgrade has no web server running for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: field value is being extracted as fieldname in regex. 06-05-2020 12:50 AM
- Got Karma for Re: DB Connect 3.1.4 - Unable to write records - Error in handling indexed fields. 06-05-2020 12:50 AM
- Got Karma for Re: DB Connect 3.1.4 - Unable to write records - Error in handling indexed fields. 06-05-2020 12:50 AM
- Got Karma for Re: DB Connect 3.1.4 - Unable to write records - Error in handling indexed fields. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: How to customise value of _time from event data at index-time field extraction?. 06-05-2020 12:50 AM
- Got Karma for Re: Using javascript (Modal) for pop-up in dashboard. 06-05-2020 12:50 AM
- Got Karma for Re: Multivalue input choice box length css. 06-05-2020 12:50 AM
- Got Karma for Re: Issue with database table name with spaces in map dbxquery search. 06-05-2020 12:50 AM
- Karma Re: About rotate settings of internal log(splunkd etc...) for yutaka1005. 06-05-2020 12:49 AM
- Karma Re: tstats timechart for DEAD_BEEF. 06-05-2020 12:49 AM
- Got Karma for Re: unable_to_write_batch in db connect add-on. 06-05-2020 12:49 AM
Topics I've Started
05-13-2020
09:33 AM
i tried to uninstall, reinstall app
i tried to change the builde version
any other ideas ?
Thanks
Regards
... View more
05-13-2020
07:56 AM
With Private App Installation, continue button not working in other languages than en-GB or en-US for installation, update, delete.
fails with fr-FR and de_DE successful with en-GB and en-US
Regards
... View more
09-17-2019
01:40 AM
i think the css below is part of the problem, especially the margin-left.
Is the margin-left really necessary?
#comments .number_display_viz-wrap_main {
display:center;
background: url("/static/app/splunk_app/boxComments_1.png");
background-repeat: no-repeat;
margin-top:35px;
margin-left:21%;
}
you could try with this :
#comments .number_display_viz-wrap_main {
background-position:center 0px;
background: url("/static/app/splunk_app/boxComments_1.png");
background-repeat: no-repeat;
margin-top:35px;
}
... View more
09-17-2019
01:12 AM
with which browser do you get this result? and which version?
... View more
09-16-2019
07:35 AM
Hello,
a little bit ugly but it could work :
`your_SPL`
| map search="|makeresults 1 | map search=$search$"
your savedsearch has to have 2 arguments :
earliest
latest
==> example: index=_* earliest=$earliest$ latest=$latest$
... View more
09-16-2019
01:45 AM
Hello,
could you try the code below ? i change some css.
<panel id="panel1">
<viz id="comments" type="number_display_viz.number_display_viz">
<search>
<done>
<condition>
<set token="boxcomment">$result.count$</set>
</condition>
</done>
<query>index=_* | stats count by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="height">206</option>
<option name="number_display_viz.number_display_viz.bordercolor">#FFFFFF</option>
<option name="number_display_viz.number_display_viz.bordersize">2</option>
<option name="number_display_viz.number_display_viz.colorprimary">#000000</option>
<option name="number_display_viz.number_display_viz.colorprimarymode">auto</option>
<option name="number_display_viz.number_display_viz.colorsecondary">#000000</option>
<option name="number_display_viz.number_display_viz.colorsecondarymode">darker1</option>
<option name="number_display_viz.number_display_viz.max">100</option>
<option name="number_display_viz.number_display_viz.min">0</option>
<option name="number_display_viz.number_display_viz.nodatacolor">#0178c7</option>
<option name="number_display_viz.number_display_viz.padding">10</option>
<option name="number_display_viz.number_display_viz.pulserate">4</option>
<option name="number_display_viz.number_display_viz.shadowcolor">#F2F4F5</option>
<option name="number_display_viz.number_display_viz.shapebordercolor">#FFFFFF</option>
<option name="number_display_viz.number_display_viz.shapebordercolormode">static</option>
<option name="number_display_viz.number_display_viz.shapebordersize">1</option>
<option name="number_display_viz.number_display_viz.shapedropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.shapeshadow">yes</option>
<option name="number_display_viz.number_display_viz.shapetexture">solid</option>
<option name="number_display_viz.number_display_viz.sparkHeight">30</option>
<option name="number_display_viz.number_display_viz.sparkWidth">90</option>
<option name="number_display_viz.number_display_viz.sparkalign">5</option>
<option name="number_display_viz.number_display_viz.sparkalignv">70</option>
<option name="number_display_viz.number_display_viz.sparkcolorfill">#009DD9</option>
<option name="number_display_viz.number_display_viz.sparkcolorline">#0178c7</option>
<option name="number_display_viz.number_display_viz.sparkcolormodefill">auto</option>
<option name="number_display_viz.number_display_viz.sparkcolormodeline">auto</option>
<option name="number_display_viz.number_display_viz.sparkmin">0</option>
<option name="number_display_viz.number_display_viz.sparknulls">gaps</option>
<option name="number_display_viz.number_display_viz.sparkorder">bg</option>
<option name="number_display_viz.number_display_viz.sparkstyle">area</option>
<option name="number_display_viz.number_display_viz.spinnerspeedmax">20</option>
<option name="number_display_viz.number_display_viz.spinnerspeedmin">1</option>
<option name="number_display_viz.number_display_viz.style">nil</option>
<option name="number_display_viz.number_display_viz.subtitlealign">center</option>
<option name="number_display_viz.number_display_viz.subtitlealignv">80</option>
<option name="number_display_viz.number_display_viz.subtitlecolor">#919191</option>
<option name="number_display_viz.number_display_viz.subtitlecolormode">static</option>
<option name="number_display_viz.number_display_viz.subtitledrop">no</option>
<option name="number_display_viz.number_display_viz.subtitledropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.subtitlefont">number_display_viz-font4</option>
<option name="number_display_viz.number_display_viz.subtitlesize">30</option>
<option name="number_display_viz.number_display_viz.subtitletext">10 points per day</option>
<option name="number_display_viz.number_display_viz.textalign">center</option>
<option name="number_display_viz.number_display_viz.textalignv">9</option>
<option name="number_display_viz.number_display_viz.textcolor">#000000</option>
<option name="number_display_viz.number_display_viz.textdrop">yes</option>
<option name="number_display_viz.number_display_viz.textdropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.textduration">300</option>
<option name="number_display_viz.number_display_viz.textfont">number_display_viz-font1</option>
<option name="number_display_viz.number_display_viz.textmode">static</option>
<option name="number_display_viz.number_display_viz.textprecision">1</option>
<option name="number_display_viz.number_display_viz.textsize">100</option>
<option name="number_display_viz.number_display_viz.textunitposition">after</option>
<option name="number_display_viz.number_display_viz.textunitsize">30</option>
<option name="number_display_viz.number_display_viz.thickness">50</option>
<option name="number_display_viz.number_display_viz.thresholdcol1">#ebb839</option>
<option name="number_display_viz.number_display_viz.thresholdcol2">#d16f18</option>
<option name="number_display_viz.number_display_viz.thresholdcol3">#b22b32</option>
<option name="number_display_viz.number_display_viz.thresholdcol4">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdcol5">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdcol6">#ffffff</option>
<option name="number_display_viz.number_display_viz.thresholdsize">20</option>
<option name="number_display_viz.number_display_viz.thresholdval2">70</option>
<option name="number_display_viz.number_display_viz.thresholdval3">90</option>
<option name="number_display_viz.number_display_viz.titlealign">center</option>
<option name="number_display_viz.number_display_viz.titlealignv">70</option>
<option name="number_display_viz.number_display_viz.titlecolor">#2c2d65</option>
<option name="number_display_viz.number_display_viz.titlecolormode">static</option>
<option name="number_display_viz.number_display_viz.titledrop">yes</option>
<option name="number_display_viz.number_display_viz.titledropcolor">#ffffff</option>
<option name="number_display_viz.number_display_viz.titlesize">30</option>
<option name="number_display_viz.number_display_viz.titletext">Box Comments</option>
<option name="refresh.display">none</option>
</viz>
</panel>
<panel>
<html>
<style>
#comments .number_display_viz-wrap_main {
display:center;
background: url("/static/app/splunk_app/boxComments_1.png");
background-repeat: no-repeat;
margin-top:35px;
margin-left:21%;
}
#comments .number_display_viz-wrap_main:hover:after{
display:block;
background-color: #333;
border-radius: 3px;
font-size: 11px;
color: #eee;
z-index: 3;
padding:5px;
margin-right:5px;
animation: moveup 0.3s linear;
}
#comments .number_display_viz-wrap_item:nth-child(1) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 1";
}
#comments .number_display_viz-wrap_item:nth-child(2) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 2";
}
#comments .number_display_viz-wrap_item:nth-child(3) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 3";
}
#comments .number_display_viz-wrap_item:nth-child(4) .number_display_viz-wrap_main:hover:after {
content:"Content tooltip 4";
}
@keyframes moveup {
0% {
//for rotating effect rotate is set 25deg at beggining
transform: translateY(10px) rotate(25deg);
opacity: 0;
}
100% {
transform: translateY(0) rotate(0deg);
opacity: 1;
}
}
</style>
</html>
</panel>
... View more
09-05-2019
06:01 AM
@michaelrosello
did you solve your problem of extraction.
Did the answers help ? if this is the case, don't forget to accept an answer and vote.
... View more
09-05-2019
04:58 AM
glad to have helped.
Don't forget to vote the answer. I updated it
... View more
09-04-2019
11:59 PM
1 Karma
Ok, escape the backslashes in the query
| fields EMPID
| map search="| dbxquery query=\"select \\\"Employer Name\\\" PR, \\\"Employee Number\\\" EMPID FROM BIA_BA_EUL.\\\"View Employee Helpdesk\\\" WHERE \\\"Employee Number\\\" in ($EMPID$)\" connection=\"EMP-PR\""
... View more
09-04-2019
11:39 PM
OK one more try escape the backslashes in the query :
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select \\\"Employer Name\\\" PR, \\\"Employee Number\\\" EMPID FROM BIA_BA_EUL.\\\"View Employee Helpdesk\\\" WHERE \\\"Employee Number\\\" in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
09-04-2019
07:40 AM
Do not surround the field name or table name with double quotes but with backticks
| fields EMPID
| map search="| dbxquery query=\"select `Employer Name` PR, `Employee Number` EMPID FROM BIA_BA_EUL.`View Employee Helpdesk` WHERE `Employee Number` in ($EMPID$)\" connection=\"EMP-PR\""
... View more
09-03-2019
11:43 PM
Ok it is not a good idea to use blanks in a table name or a field...
I updated my first answer with a response to this issue.
You will not surround the field name or table name with double quotes but with backticks
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select `Employer Name` PR, `Employee Number` EMPID FROM BIA_BA_EUL.`View Employee Helpdesk` WHERE `Employee Number` in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
09-03-2019
02:55 AM
you can use Search macros.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Usesearchmacros
... View more
09-02-2019
04:58 AM
I have nothing better to offer than the first answer I made :
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select \"Employer Name\" PR, \"Employee Number\" EMPID FROM BIA_BA_EUL.\"View Employee Helpdesk\" WHERE \"Employee Number\" in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
09-02-2019
01:44 AM
The "append" command will not replace $EMPID$ with the values of $EMPID$
With the "append" command, "...".EMPID."..." will replace EMPID with the values but will be interpreted by one value in a string : "EMPID1, EMPID2, EMPID3" and not 3 values.
The map command will do this replacement and will be interpreted as 3 values.
... View more
08-29-2019
09:05 AM
I made some tests with :
Splunk 7.2.6,
DBConnect 3.1.3,
mysql-connector-java-5.1.48 driver,
Mysql 5.1,
the following dataset in mysql in a table t_champs:
id,id_suiviflux,nom_champs,valeur_champs
"1","1","champ1","valeur 1"
"2","1","champ2","valeur - 2"
"3","1","champ3","valeur'3"
"4","2","champ1","valeur ""21"
"5","2","champ2","valeur22"""
"6","2","champ3","valeur23"
"7","1","champ6","valeur6"
"8","2","champ4","valeur24"
"9","1","champ4","valeur4"
"10","1","champ5","valeur5"
the following command :
| makeresults
| eval _raw="id
1
10
"
| multikv forceheader=1
| stats values(id) as id
| eval id = mvjoin(id, ",")
| map search="| dbxquery query=\"select * from t_champs where id in ($id$)\" connection=\"EMP-PR\""
The results are correct :
id id_suiviflux nom_champs valeur_champs
1 1 champ1 valeur 1
10 1 champ5 valeur5
So it seems that is not a splunk or db connect issue, maybe the connector or/and the SQL Interpretor in natezza.
Could you try to create the same dataset in Netezza, apply the command and post your results ?
... View more
08-29-2019
04:37 AM
1 Karma
Hello,
if you are using a splunk version> = 7 and <= 7.1 (I only tested on version 7.0.1, a Splunk Web UI update has been updated to version 7.1)
you could try to add this part of css:
#instance_id .select2-search-choice {
max-width: none !important;
}
... View more
08-26-2019
11:36 PM
Hello,
What versions of Spunk, Splunk DB Connect, and Database Drivers are you using?
What database are you trying to query?
... View more
08-26-2019
02:58 AM
1 Karma
Hello,
map command is limited by default for 10 searches.
after map command, the results (in your case) are the results of the SQL command,
so if you want to obtain EMPID and PR, you have to select this fields in your SQL command
if EMPID is extracted through rex it would be like this :
| rex field=_raw "(?<EMPID>[0-9]{12})"
You have to check the regexp.
Finally, your request may be look like this (for netezza)
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select \\\"Employer Name\\\" PR, \\\"Employee Number\\\" EMPID FROM BIA_BA_EUL.\\\"View Employee Helpdesk\\\" WHERE \\\"Employee Number\\\" in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
edit :
For some databases
splunk_server=ass index="ass_main" host=*pr
| rex field=_raw "(?<EMPID>[0-9]{12})"
| dedup EMPID
| fields EMPID
| stats values(EMPID) as EMPID
| eval EMPID = "'".mvjoin(EMPID, "','")."'"
| map search="| dbxquery query=\"select `Employer Name` PR, `Employee Number` EMPID FROM BIA_BA_EUL.`View Employee Helpdesk` WHERE `Employee Number` in ($EMPID$)\" connection=\"EMP-PR\""
| fields EMPID,PR
... View more
08-22-2019
04:45 AM
1 Karma
Hello,
a little mistake on line 14 in app.js :
Replace
], function(_, Backbone, mvc, ModalView) {
by
], function(_, Backbone, mvc, tableview, ModalView) {
after this correction, don't forget to use the _bump to reload changes from static files : http://$SPLUNK_URI$/en-US/_bump
You will be able to view some change on click, but you will have to continue to adapt the script and css to obtain a better result.
... View more
08-19-2019
02:23 AM
5 Karma
Hello,
because the date 2012-02-03 20:11:56
is too far in the past (more than 7 years) you have to add a parameter in your props.conf
MAX_DAYS_AGO = 3650
you have to adjust the value of the parameter.
Default: 2000 (5.48 years).
edit:
you may have to edit the frozenTimePeriodInSecs parameter in your indexes.conf
The default value is 188697600 (6 years).
... View more
07-23-2019
05:20 AM
Hello,
update your transforms.conf
[xml-extr11]
REGEX = <([^>]+)>(?|(?=<!\[CDATA\[.*\]\]>)(?|<!\[CDATA\[(?|(.*))\]\]>)|(?|([^<]*)))<\/\1>
FORMAT = $1::$2
MV_ADD = true
REPEAT_MATCH = true
it will extract the desired fields.
I corrected my previous REGEX
... View more
07-23-2019
12:52 AM
in transforms.conf
[testxml]
SOURCE_KEY = _raw
REGEX = <([^>]+)>(?|(?=<!\[CDATA\[.*\]\]>)(?|<!\[CDATA\[(?|(.*))\]\]>)|(?|(.*)))<\/\1>
FORMAT = $1::$2
at search time assuming the data is in _raw:
| extract testxml
at index time :
in props.conf
[yoursourcetype]
TRANSFORMS-testxml = testxml
... View more
07-23-2019
12:22 AM
you wan't to extract at index time or at search time ?
Could you post a complete event for example ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-01-2021
06:36 AM
|
