Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lassel
lassel
Communicator
Member since:
03-11-2015
06-05-2020
Community Statistics
| Posts | 48 |
| Solutions | 4 |
| Karma Given | 13 |
| Karma Received | 12 |
| Member Since | 03-11-2015 |
Activity Feed
- Got Karma for Re: How to update input text fields when tokens are changed?. 02-11-2023 03:05 PM
- Got Karma for Re: How to update input text fields when tokens are changed?. 06-20-2022 07:50 AM
- Got Karma for Re: How to update input text fields when tokens are changed?. 06-05-2020 12:48 AM
- Got Karma for Re: How to update input text fields when tokens are changed?. 06-05-2020 12:48 AM
- Got Karma for Re: How to update input text fields when tokens are changed?. 06-05-2020 12:48 AM
- Karma Re: Get current username from SplunkJS for Flynt. 06-05-2020 12:47 AM
- Karma Re: access to _audit index vs using history command for MuS. 06-05-2020 12:47 AM
- Karma Re: Why am I unable to extract 2 fields from source at index-time with my current configuration and regex? for aweitzman. 06-05-2020 12:47 AM
- Karma Re: Debugging dashboard queries for vganjare. 06-05-2020 12:47 AM
- Karma Re: Debugging dashboard queries for jeffland. 06-05-2020 12:47 AM
- Karma Re: Debugging dashboard queries for Runals. 06-05-2020 12:47 AM
- Karma Re: Report on splunk searches in session for David. 06-05-2020 12:47 AM
- Karma Re: Where to install Seach Activity app? for chimell. 06-05-2020 12:47 AM
- Karma Re: Where to install Seach Activity app? for David. 06-05-2020 12:47 AM
- Karma Re: Where to install Seach Activity app? for David. 06-05-2020 12:47 AM
- Karma Re: How to swap out the underlying search in a dashboard for a table drilldown using Simple XML? for jeffland. 06-05-2020 12:47 AM
- Got Karma for Get current username from SplunkJS. 06-05-2020 12:47 AM
- Got Karma for Get current username from SplunkJS. 06-05-2020 12:47 AM
- Got Karma for Get current username from SplunkJS. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I unable to extract 2 fields from source at index-time with my current configuration and regex?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
10-11-2016
08:52 AM
5 Karma
Ah. You need to set the default value to the token.
E.g. <default>$banknr$</default>
<input type="text" token="banknr" searchWhenChanged="true">
<label>Banknr (fem cifre!)</label>
<default>$banknr$</default>
</input>
<input type="text" token="userid" searchWhenChanged="true">
<label>Brugernr</label>
<default>$userid$</default>
</input>
... View more
10-11-2016
08:36 AM
I have a dashboard with three inputs: traceid, banknr, userid
I made a search for traceid with a drilldown that sets banknr and userid.
What I see: Tokens gets updated in the HTML panel
What I expect: Tokens gets updated in both the HTML panel AND in the input text fields.
How can I update the text fields, when their tokens change?
I am on Splunk 6.2
<form>
<fieldset submitButton="false">
<input type="text" token="banknr" searchWhenChanged="true">
<label>Banknr</label>
</input>
<input type="text" token="userid" searchWhenChanged="true">
<label>Brugernr</label>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>Output $banknr$ $userid$ $traceid$</h1>
</html>
</panel>
</row>
<row>
<panel>
<input type="text" token="traceid">
<label>TraceId</label>
</input>
<table>
<title>Find bruger for traceid</title>
<search>
<query>traceid=$traceid$ log_type=REST | fields banknr, userid | dedup banknr, userid | table banknr, userid</query>
</search>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="drilldown">row</option>
<drilldown>
<set token="banknr">$row.banknr$</set>
<set token="userid">$row.userid$</set>
</drilldown>
</table>
</panel>
</row>
</form>
... View more
01-21-2016
07:55 AM
Oh! Great. I had no idea you could do that!
... View more
01-21-2016
07:49 AM
Did you notice that I use simple XML?
But I need to convert my dashboard to html to do it?
It seems like a complex task for a simple goal..
... View more
11-18-2015
12:44 AM
Here's a complete working dashboard, with drilldown.
<dashboard>
<label>View all logs</label>
<row>
<panel>
<table>
<search>
<query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">100</option>
<option name="table.sortColumn">index</option>
<drilldown>
<link>/app/search/search?q=index=$row.index$ sourcetype=$row.sourcetype$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Drilldown only uses index and source for drilldown.
It is easy to add sourcetype too, but if it contains a windows path, it will require some work, escaping backslashes. So I left it out for clarity.
... View more
11-12-2015
04:06 AM
Hi,
I want to do this, but I'd prefer to do it in Simple XML. Is it possible?
http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/TableChartDrilldown#Swap_out_the_underlying_search
I have a table in a dashboard, that shows available log files to the users.
When I drill down, I want to use the values from the row that was clicked, but I don't want the search from the table to go into the drilldown search. That would make the user search in the summary index - and that doesn't make sense, since the index is part of the row clicked!
<dashboard>
<label>View all logs</label>
<row>
<panel>
<table>
<search>
<query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">100</option>
<option name="table.sortColumn">index</option>
</table>
</panel>
</row>
</dashboard>
Once I get it right, I'll change the dashboard to be powered by a summary index. That just makes it even more important that the drilldown search does not contain the table search.
... View more
09-08-2015
12:48 AM
We are using SCOM to monitor all systems.
We would like to give Splunk users access to send an alert to the monitoring system, based on a search.
So it is not bulk import of events into SCOM, just single alerts.
What is the best strategy for getting an alert into SCOM?
I looked at the syslog integration with a python script.
Is there a better/easier way?
... View more
06-25-2015
04:43 AM
A summary index is a better solution. I must have skipped over it - so many concepts to learn 🙂
I have to add that to preserve extracted fields in my query I had to apply a hack that I found in another answer:
| rename _raw as orig_raw
http://answers.splunk.com/answers/22431/adding-host-field-when-summary-indexing.html
... View more
06-22-2015
04:57 AM
I have a heavy and complex search that runs as a scheduled search and saves its results in a lookup table.
The kvstore has a field called _time that is configured for time based lookups.
Now, I want to make a dashboard that searches my inputlookup.
So I add a panel with a search:
| inputlookup mylookup
But to my disappointment, I learned that searches that only hit a lookup doesn't support time pickers directly.
I tried this and a few other suggestions from answers.splunk.com, but I can't find answers that don't hard code the time range
| inputlookup mylookup earliest=$time.earliest$ latest=$time.latest$
How can I modify my search, so the _time field gets matched to the time picker on my page?
... View more
06-18-2015
04:11 AM
In the end I merged my two apps into one that all users can access. Then I locked down the views that only power-users can see.
default.meta:
[views/secretdashboard]
access = read : [ power ], write : [ power ]
... View more
06-16-2015
06:50 AM
i'd still like an answer to this question ...
... View more
06-16-2015
01:48 AM
I am not sure what an app space is? Is it just a new app?
I make a separate app for the lookups, I'll just get another app that I cannot hide.
... View more
06-15-2015
09:14 AM
I have an app that only powerusers should be able to access.
In that app, I maintain some kvlookups that regular users should be able to use for lookups.
This is from my transforms.conf:
[]
access = read : [ * ], write : [ power, admin ]
[transforms/index_lookup]
access = read : [ * ], write : [ admin, power ]
export = system
My problem is that if I lock down the [] block so read:[power], the regular users can no longer see the lookup table.
How can I hide the app and expose the lookup table?
... View more
06-03-2015
06:15 AM
I would also really really like to know, how I can make the user experience of my dashboard, more like the full search page.
... View more
06-03-2015
06:07 AM
I have the following (simplified) dynamic dashboard.
You can see the query beeing performed in html.
I want the sourcetype selection is optional on this dashboard. But as it is the $sourcetype$ token is not resolved until I make a selection in the sourcetype. Setting a default sourcetype to empty doesn't work, because that will make an invalid search and also because the empty selection stays when I select an index.
How can I make the search run, even if no selection is made to sourcetype?
How can I clear the (invalid) sourcetype selections, when I select an index?
Index
index=* | dedup index
0
index
index
true
| search index=
false
*
Sourcetype
<query>$index$ | dedup sourcetype</query>
0
sourcetype
sourcetype
(
sourcetype="
"
OR
)
Search
Time
@d
now
$index$ $sourcetype$ $search$
<query>$index$ $sourcetype$ $search$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
... View more
05-26-2015
04:36 AM
And perhaps a way to expand the wildcards in indexes.
... View more
05-26-2015
04:33 AM
I was able to work around my problem using a scheduled search as you suggest.
This is my working code snippets from my app, for anyone who comes here after me 🙂
savedsearched.conf
[build_audit_search_history]
cron_schedule = * * * * *
dispatch.earliest_time = -1m@m
dispatch.latest_time = now
enableSched = 1
search = index=_audit \
| where search not null \
| rex field=search "^'search (?<search_string>.)'$" \
| where search_string not null \
| where user != "admin" \
| rex field=search_string max_match=10 "index=([\"'])?(?<index>\S+)([\"'])?" \
| rex field=index ".?(?<asteriks>[]).?" \
| eval wildcards=if (isnull(asteriks),"Y","N") \
| fields _time, user, search_string, index, wildcards \
| outputlookup append=true createinapp=true audit_search_history
transforms.conf
[audit_search_history]
enforceTypes = true
external_type = kvstore
collection = audit_search_history
fields_list = _time, user, search_string, index, wildcards
time_field = _time
field._time = time
field.user = string
field.search_string = string
field.index = string
field.index = wildcards
collections.conf
[audit_search_history]
... View more
05-26-2015
04:28 AM
I have the same question. I would be interested to know if the past two years has brought around a way to improve this answer?
A way to get the same information without using a rest call that only the admin can do.
... View more
05-21-2015
07:51 AM
I am working on a dashboard that displays previous queries in splunk.
I can find the previous queries using the history command or by searching _audit.
Using history:
experiments tells me that the |history command, only displays history relative to the current app.
Is there a workaround for that?
Using _audit:
I get in to trouble with Ops, who claim that normal users can't get access to the _audit index.
What would be the worst thing that could happen, if we gave regular users access to _audit?
... View more
05-19-2015
01:51 AM
I am working on a dashboard with dynamic input fields.
It would be very useful to see the actual query that Splunk is running, based on my input fields.
Is it possible to display the query?
... View more
05-12-2015
12:07 AM
1 Karma
Got this answer from Splunk support:
With regards to your index=* question, the answer is currently "no"
With our current set of roles and capabilities, we do not have a method by which to restrict the use of wild-cards in search strings.
Currently, the best practice here is to define roles that restrict access to only the necessary indexes and educate your users on Search & Reporting best practices so that they build efficient search queries.
... View more
05-01-2015
01:02 AM
Can somebody confirm if what I want is impossible?
I conclude that it is impossible using "Restrict search terms", but is there another way?
... View more
04-27-2015
02:06 AM
From the administration page:
Search restrictions
Restrict the scope of searches run by this role. Search results for this role will only show events that also match this search string.
Can include source, host, index (can be set below), eventtype, sourcetype, search fields, , and OR and AND. Example: "`host=web OR source=/var/log/*`"
It seems like it is impossible to limit user queries that way I want to. Naming the precise search terms is very hard and impossible to administrate when I add new indexes. Besides. Given enough valid queries, the user can still run the wildcard queries, that I wish to limit.
Is there any other way to limit queries?
... View more
04-27-2015
01:12 AM
Doing that gives me an error on every search like this:
Error in 'SearchParser': Missing a search command before '^'. Error at position '46' of search query 'litsearch ( index=splunktest abc ) ( ( index=[^*]+'.
... View more
