About poojak2579

poojak2579 · ‎05-14-2021

Hi Everyone, I am trying to add a banner in the splunk login page, though we can add it using html & css under login_content in web.conf file but we are trying to pass the banner message dynamically. Currently we are using lookup to store the banner message and update it uniformly in all the dashboards, is there any way we can use same lookup in the web.conf file. Thank you.

poojak2579 · ‎08-02-2020

Thank you so much for this solution. I addition to above my requirement is : How to remove the mouse hover of (Search, Inspect, Refresh, and Export) menu, so that it always displayed. Also I wish to move only Export Icon alone to the top-left

poojak2579 · ‎12-19-2018

Hi @Kenshiro70 Thank you.This code is working fine. This code hides the error icons for everyone. But pls let me know if you have any idea if we can hide these icon for basic users only and not for power users. or if we can differentiate between warning icons and red error icons and hide only warning icons. Power users wants to see those errors.

poojak2579 · ‎10-19-2018

Hi Adylent, Did you find the solution of this problem? If yes, please let me know.I am also dealing with the same problem

poojak2579 · ‎09-26-2018

Currently I am using this query to join first two sourcetypes but not sure how to join third one. index=xyz (sourcetype=sourcetype_1 ) OR (sourcetype=sourcetype_2 ) |rename mm AS MM |stats dc(sourcetype) as cnt values(ss) AS ss values(CC) AS CC by OO MM |where cnt=2 |mvexpand SS |mvexpand CC

poojak2579 · ‎09-26-2018

Thanks for the reply. I can not use join or append command because of maxout limit of 50000 records. I think I can only use OR but not sure how to join all 3 using OR.

poojak2579 · ‎09-25-2018

Thanks for the reply. But I cannot use JOIN due to its limitation since the data has millions of records. We can only use OR (sourcetype_1 OR sourcetype_2 OR sourcetype_3) Amt1 is coming from sourcetype_1 and Amt2 is coming from sourcetype_3 In the final result, I want to see the Amt1 and Amt2 at CC and ss level.

poojak2579 · ‎09-25-2018

It would be great if anyone could help me to join data from 3 source types: 1) sourcetype_1 has fields AA,MM,CC,Amt1 2) sourcetype_2 has fields AA,mm,ss 3) sourcetype_3 has fields SS,cc,Amt2 Step 1 - Join first and second source type where sourcetype_1.AA == sourcetype_2.AA && sourcetype_1.MM=sourcetype_2.mm Step 2 - Join result of step 2 and third source type where sourcetype_3.cc= step1.CC and sourcetype_3.SS = Step1.ss In my final result, I want to group by OO, CC and SS and show all the CC and SS where Amt2 is lesser than Amt Note - There is a many-to-many relationship between some of the required fields. Thanks in advance!

poojak2579 · ‎11-14-2017

Thanks for the reply. Yes, there is separate dashboard for drilldown. Earlier I was considering single query for all the scenarios but now to resolve this issue,I have created separate queries for each panel and have made Input element and Panel to depend upon the token.

poojak2579 · ‎11-13-2017

Thank you very much! It does work by making the panels and input element depend on the token. I didnt notice that we can hide input components also. I added "depends" attribute to the following elements:

poojak2579 · ‎11-12-2017

Thanks for the reply. Here is the sample tabular data for the three panels: Changes by User Asset Root User1 User2 A1 100 5 2 A2 20 4 6 A3 50 0 8 Changes by Severity Asset Severity1 Severity2 A1 200 100 A2 100 50 A3 300 100 Changes by ChangeType Asset Added Modified A1 150 150 A2 50 100 A3 200 200 I am passing three tokens Severity,User and ChangeType to the textboxes in the drilldown. Drilldown is a single panel dashboard that will show the same details based on what user clicks. Here is sample Drilldown Data: When first panel is clicked and user info is passed : Asset Severity ChangeType User A1 Severity1 Modified User1 A1 Severity2 Added User1 Drilldown when the chart in the second panel is clicked and severity is passed to the drilldown Asset Severity ChangeType User A1 Severity1 Modified Root A1 Severity1 Added A3 Severity1 Modified User1 As we can see in the sample data there are some records that dont have user name. We want to display all the records irrespective of user name when second panel is clicked and severity is passed but want to display records associated with a user when first panel is clicked and user is passed . Please let me know how I can work without creating textbox in the drilldown.

poojak2579 · ‎11-11-2017

Thanks for the reply There is a single panel in the drilldown dashboard that will show the details based on the input. First Chart in the main dashboard passes user name and asset name whereas second chart passes severity name and asset name to the drill down dashboard There are certain records that does not have user name but if we hide it, results will not come until it gets the input for user type. When second chart is clicked there will be no input for user name ,but we want to show all the records irrespective of user name. I tried by adding this statement also: |eval a = if(isnull(user),"*",user) |where user=a It does not work when user=* as * does not work with where clause. Please suggest if there is any other way to do this.

poojak2579 · ‎11-10-2017

I want to pass tokens to the drilldown dashboard depending upon the panel that user selects. Current Code <title>Changes by User</title> <chart> <search> <query>index=a |chart count over Asset by user usenull=false</query> <earliest>-90d</earliest> <latest>now</latest> </search> <drilldown> <link> <![CDATA[/app/search/b_clone?form.Asset=$click.value$&form.user=$click.name2$]]> </link> </drilldown> </chart> </panel> <panel> <title>Changes by Severity</title> <chart> <search> <query>index=a|chart count over Asset by SeverityName</query> <earliest>-90d</earliest> <latest>now</latest> </search> <link> <![CDATA[/app/search/b_clone?form.Asset=$click.value$&form.SeverityName=$click.name2$]]> </link> </drilldown> </chart> </panel> <panel> <title>Changes by Type</title> <chart> <search> <query>index=a|chart count over asset by changetype usenull=false</query> <earliest>-90d</earliest> <latest>now</latest> </search> <drilldown> <link> <![CDATA[/app/search/b_clone?&form.Asset=$click.value$&form.ChangeType=$click.name2$]]> </link> </drilldown> I can create a drilldown with static textboxes containing tokens of severityname, changetype and user but I want to create tokens depending upon the panel that user clicks. If the user clicks on the secondchart, the drilldown should have a textbox of severity name and asset only whereas if he clicks on the secondchart, the drilldown should have user and asset tokens only. Can we add a condition which creates token depending upon what panel is clicked? My second question is if can we use tokens in the drilldown without creating input text boxes?

poojak2579 · ‎09-13-2017

I tried accelerated Datamodel and summary index but it didn't work because of some limitations . https://answers.splunk.com/answers/556349/how-to-join-data-from-two-indexes.html https://answers.splunk.com/answers/569099/lookup-fields-not-updating-in-the-datamodel.html

poojak2579 · ‎09-12-2017

Let me make it more clear. There are vulnerabilities on the assets. ID is the Vulnerability Id and First_Found is the date when it was first found on the asset. Because of some reason there are multiple First_Found for the combination of Asset+Id. I want to take earliest First_Found and assign it to the combination of Asset+Id. I have scheduled a query to run everyday which will check Earliest First_Found in last one year and it takes long time to run. Is there any way we can assign min of First_Found to Asset+Id so that I don't have to run that query over and over again?

poojak2579 · ‎09-12-2017

Thanks for the reply. I am already using the first code but it is taking long time to run the query because I have to check million of records with a time range of more than 1 year. I want to normalize it, assign the min(First_Found) to all the combos at once and then use it everywhere. Please let me know if there is any other way to do it.

poojak2579 · ‎09-09-2017

I have a field which contains first_found_date and due to some reason it keeps on changing for some of the assets. Example: If an asset "A1" has 3 first_found_date over a period of time: 2017-06-20 22:30:30 2016-05-25 22:30:30 2017-01-25 22:30:30 I want to use earliest first_found(i.e 2016-05-25 22:30:30) in all my reports. If I use the following query to check the earliest first_found , it takes more than 1 hour to get the value because it has to go through all the records over the period of time. sourcetype=a |eval combo = Asset+"_"+ID |stats min(FIRST_FOUND) as earliest_ff by combo Is there any way we can correlate the asset with its earliest first_found_date without editing props.conf?

poojak2579 · ‎09-09-2017

Thanks for the answer. I will have to ask my administrator because I don't have right to enable or disable acceleration.

poojak2579 · ‎09-09-2017

I have a summary range of 1 month. I thought fields in the datamodel are dynamically populated. Does that mean we can not take benefits of accelerated data model if the lookup is updated every day? Can we schedule it to rebuld everyday after the lookup is updated?

poojak2579 · ‎09-09-2017

Thanks for replying. I thought the dynamic lookup attribute will pick up the value change because splunk automatically rebuild datamodels when it finds that those models are outdated. Is there any way I can rebuild the datamodel everyday after the lookup is updated?

poojak2579 · ‎09-09-2017

Thank you.

poojak2579 · ‎09-08-2017

I have built an accelerated datamodel with lookup fields. There is a report that is scheduled to run everyday to populate the lookup. The datamodel does not get updated when lookup file is updated. But if I disable acceleration, I can see the fields updated. Do I have to rebuild the datamodel every time lookup file is updated or it is rebuild automatically?

poojak2579 · ‎07-18-2017

Dont know why it is not working for me. I guess I have to use another approach than the summary indexing to make those queries faster that checks for earliest first found among million of records. Thanks everyone for your help.

poojak2579 · ‎07-18-2017

So you are getting events for yesterday and today only and not 30 days?

poojak2579 · ‎07-18-2017

Please ignore that. I am using summary for all my queries. Please ignore that mistake.

Posts	35
Solutions	0
Karma Given	7
Karma Received	0
Member Since	‎04-22-2015

Online Status	Offline
Date Last Visited	‎05-20-2021 07:11 PM

Login page Banner Message

Can you help me Join 3 source types using OR?

How to create tokens dynamically

How to get earliest datetime

Lookup Fields not updating in the Datamodel

How to join data from two indexes

Login page Banner Message

Re: Move widgets/icons (Search, Inspect, Refresh, ...

Re: How to hide error message icons from dashboard...

Re: Using earliest and latest variables in a form

Re: Can you help me Join 3 source types using OR?

Re: Can you help me Join 3 source types using OR?

Re: Can you help me Join 3 source types using OR?

Can you help me Join 3 source types using OR?

Re: How to create tokens dynamically

Re: How to create tokens dynamically

Re: How to create tokens dynamically

Re: How to create tokens dynamically

How to create tokens dynamically

Re: How to get earliest datetime

Re: How to get earliest datetime

Re: How to get earliest datetime

How to get earliest datetime

Re: Lookup Fields not updating in the Datamodel

Re: Lookup Fields not updating in the Datamodel

Re: Lookup Fields not updating in the Datamodel

Re: Lookup Fields not updating in the Datamodel

Lookup Fields not updating in the Datamodel

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes