About marksheinbaum

marksheinbaum · ‎03-06-2024

Thanks for the solution. However, there is an additional case to be handled. Your solution handles the 1 day timeframe. However, we also want to see totals for timeframes > 1 day by day, i.e., license usage by environment by day. Is there a way to make the display of the stats dashboard conditional depending on the selected time frame?

marksheinbaum · ‎03-06-2024

I am running the following query for a single 24 hour period. I was expecting a single summary row result. Not sure why the result is split across 2 rows. Here's the query: index=federated:license_master_internal source=*license_usage.log type=Usage pool=engineering_pool | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | where like(h, "%metfarm%" ) OR like(h, "%scale%") |eval h=rtrim(h,".eng.ssnsgs.net") |eval env=split(h,"-") |eval env=mvindex(env,1) |eval env=if (like(env,"metfarm%"),"metfarm",env) |eval env=if (like(env,"sysperf%"),"95x",env) |eval env=if(like(env,"gs02"),"tscale",env) | timechart span=1d sum(b) as b by env | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] |addtotals

marksheinbaum · ‎05-28-2023

I accepted the solution. However, I'm surprised that the cloning process does not generate that automatically.

marksheinbaum · ‎05-24-2023

Here's how the visualization and corresponding data source are defined. I don't see a "default" in the code. "visualizations": { "viz_chart_1": { "type": "splunk.line", "dataSources": { "primary": "ds_search_1" }, "showProgressBar": true, "title": "nodesim instances ram usage (ps)", "options": { "yAxisAbbreviation": "auto", "y2AxisAbbreviation": "off", "showRoundedY2AxisLabels": false, "legendTruncation": "ellipsisEnd", "showY2MajorGridLines": true, "yAxisMajorTickInterval": 1, "yAxisTitleText": "Megabytes", "nullValueDisplay": "connect", "dataValuesDisplay": "off", "legendDisplay": "bottom" }, "context": {} }, "dataSources": { "ds_search_1": { "type": "ds.search", "options": { "query": "index=os (sourcetype=ps OR sourcetype=vmstat) (host=scale-sysperf-95x-install-18* ) (COMMAND=CURRENT* OR COMMAND=nodesim)\n| rename memTotalMB as physicalMB\n| appendpipe [ where sourcetype==\"vmstat\" | rename memUsedMB as physicalMB | eval App=\"Physical-Used\" | fields physicalMB]\n| stats count sum(RSZ_KB) as RSZ_KB_sum max(physicalMB) as physicalMB by _time host COMMAND\n| timechart span=1m avg(eval(if(isnull(physicalMB),RSZ_KB_sum/1000,physicalMB))) as AppRSZ_MB by host", "queryParameters": { "earliest": 0, "latest": "" } } },

marksheinbaum · ‎05-24-2023

Here's the code from the converted and unmodified dashboard. It's not clear to me exactly what to change per your advise. Can you please clarify? Thanks. "inputs": { "input_1": { "type": "input.timerange", "title": "Select a time:", "options": { "token": "global_time", "defaultValue": "-60m@m,now" } },

marksheinbaum · ‎05-24-2023

I'm experimenting with converting a classic dashboard to dashboard studio. The classic dashboard has a time picker used to establish a date range for searches in the panels. When I cloned the dashboard to dashboard studio, the time picker is no longer used. All the searches, are searching from the earliest date stored in Splunk which is several years worth of data. Can someone explain what is happening and how to fix. This should be a relatively simple thing to do.

marksheinbaum · ‎02-01-2023

I'm seeing similar messages in my local Splunk install which is version 9.0.3. Additionally, the Splunk UI message looks like: Missing or malformed messages.conf stanza for MOD_INPUT:INIT_FAILURE__modinput_eventgen_the app "SA-Eventgen"_Introspecting scheme=modinput_eventgen: script running failed (exited with code 1).2/1/2023, 12:58:23 PM

marksheinbaum · ‎08-22-2022

I answered this previously. Using the splunk cmd with the script and path works fine. Running the script automatically by configuring the input.conf file in ../etc/apps/SplunkUniversalForwarder/local/ results in the error 08-22-2022 16:14:15.264 +0000 ERROR ExecProcessor [3793782 ExecProcessor] - message from "python3.7 /opt/splunk/sjcinf8469vmw15/splunkforwarder-8.2.3/splunkforwarder/bin/scripts/scrapeGmrPage.py" /bin/sh: python3.7: command not found

marksheinbaum · ‎08-17-2022

Is there a way to simulate that, i.e., hack. Say set up symlinks to python in Splunk's bin and lib directories?

marksheinbaum · ‎08-17-2022

The script runs fine when I run as you suggested. ./splunk cmd ~/sjcinf8469vmw15/splunkforwarder/bin/scripts/scrapeGmrPage.py BTW, I do not see any python interpreters in the splunk bin directory. Not sure if that is relevant: pwd /opt/splunk/sjcinf8469vmw15/splunkforwarder/bin ls 2to3-3.7 copyright.txt genRootCA.sh openssl pip3 prigreypng priweavepng slim wheel btool easy_install genSignedServerCert.sh pid_check.sh pip3.7 pripalpng pydoc3 splunk btprobe easy_install-2.7 genWebCert.sh pip pip3.7x pripamtopng pydoc3.7 splunkd bzip2 easy_install-3.7 idle3 pip2 prichunkpng pripnglsch scripts splunkmon classify fill_test idle3.7 pip2.7 priforgepng pripngtopam setSplunkEnv srm

marksheinbaum · ‎08-17-2022

I wrote a screen scraping script on a server running Splunk Forwarder version 8.2.3. The script is in a file and runs find from the linux command line. It was developed with Python 3.6. I added the script to our Universal Forwarder local inputs.conf and I can see the script is scheduled successfully. However, it consistently fails with a message in the splunkd.log. I have no idea why the message references python3.7. It is not installed anywhere on the system 3.6 is installed in /usr/bin/python3.6. I tried changing the server.conf properties in local by adding "python.version = python3" in the [general] section and restarting, but to no avail. Please advise what else I might try. Thanks. in advance. 08-18-2022 00:19:45.525 +0000 ERROR ExecProcessor [3423479 ExecProcessor] - message from "python3.7 /opt/splunk/sjcinf8469vmw15/splunkforwarder-8.2.3/splunkforwarder/bin/scripts/scrapeGmrPage.py" /bin/sh: python3.7: command not found

marksheinbaum · ‎01-12-2022

I understand your point. However, the curl command with the edited dashboard XML allows some automation. Since I can download the XML using scp from the dashboard directory, edit the dashboard's XML, and run the .../pdfgen/render, I suppose I have a hack work around.

marksheinbaum · ‎01-12-2022

I've been able to run a dashboard from the command line by 1. copy and pasting simple xml into a file 2. updating tokens with desired values 3. running the pdf render command from curl, e.g., curl -sku guest:pwd "https://splunkhost:8089/services/pdfgen/render" --data-urlencode "input-dashboard-xml=$(cat sample-dashboard.xml)" -d namespace=search -d paper-size=a4-landscape > mydash.pdf Is there a way to use python/rest to do the same? I tried some of the endpoints and it creates the dashboard xml with extra scaffolding. Seems to be intended for adding and updating dashboards rather than running the dashboard itself.

marksheinbaum · ‎12-02-2021

Thanks for that bit of insight. I didn't know you could do that...

marksheinbaum · ‎12-02-2021

I have a dashboard using simple xml. The dashboard has 5 rows, each row of which contains 2 panels. The first panel is a small table and the second panel is a timechart. I would like the small table to be 20% of the width, and the timechart to be 80% of the width. I've tried to create a java script file so that the dashboard will run the java script automatically. The java script only works for the first 2 rows. Here's the js file. Any help appreciated. require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) { // Grab the DOM for the panel dashboard row var panelRow = $('.dashboard-row').first(); // Get the dashboard cells (which are the parent elements of the actual panels and define the panel size) var panelCells = $(panelRow).children('.dashboard-cell'); // Adjust the cells' width $(panelCells[0]).css('width', '20%'); $(panelCells[1]).css('width', '80%'); panelRow = $('.dashboard-row').next(); panelCells = $(panelRow).children('.dashboard-cell'); $(panelCells[0]).css('width', '20%'); $(panelCells[1]).css('width', '80%'); panelRow = $('.dashboard-row').next(); panelCells = $(panelRow).children('.dashboard-cell'); $(panelCells[2]).css('width', '20%'); $(panelCells[3]).css('width', '80%'); $(window).trigger('resize'); });

marksheinbaum · ‎03-20-2018

I created an mqtt input for our hivemq server. However, it fails to connect. The splunkd.log contains entries like these. I am able to connect using mqttspy to the same hivemq instance, and verified connectivity from the Splunk server to the VM running hivemq. Also verified the port number. Any help appreciated. 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" Stanza mqtt://95x_mqtt : Error connecting : Connection lost (32109) - java.io.EOFException 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" at org.eclipse.paho.client.mqttv3.internal.CommsReceiver.run(CommsReceiver.java:138) 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" at java.lang.Thread.run(Thread.java:745) 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" Caused by: java.io.EOFException 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" at java.io.DataInputStream.readByte(DataInputStream.java:267) 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" at org.eclipse.paho.client.mqttv3.internal.wire.MqttInputStream.readMqttWireMessage(MqttInputStream.java:56) 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" at org.eclipse.paho.client.mqttv3.internal.CommsReceiver.run(CommsReceiver.java:100) 03-19-2018 22:42:18.541 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" ... 1 more

Posts	16
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎07-18-2014

Online Status	Offline
Date Last Visited	‎03-11-2024 04:32 PM

timechart stats creates extra row

Why is Classic Time picker not cloned in dashboard...

How to run a python script from a universal forwar...

How to run a dashboard from command line?

unable to modify size of more than 2 rows in dashb...

Why am I unable to connect to hivemq using mqtt mo...

Re: timechart stats creates extra row

timechart stats creates extra row

Re: Why is Classic Time picker not cloned in dashb...

Re: Classic Time picker not cloned in dashboard st...

Re: Classic Time picker not cloned in dashboard st...

Why is Classic Time picker not cloned in dashboard...

Re: splunk.LicenseRestriction: [HTTP 402] Current ...

Re: running a python script from a universal forwa...

Re: Run Python scripts with universal forwarder to...

Re: running a python script from a universal forwa...

How to run a python script from a universal forwar...

Re: How to run a dashboard from command line?

How to run a dashboard from command line?

Re: unable to modify size of more than 2 rows in d...

unable to modify size of more than 2 rows in dashb...

Why am I unable to connect to hivemq using mqtt mo...