Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About richkappler
richkappler
Path Finder
Member since:
05-19-2017
11-01-2022
Community Statistics
| Posts | 35 |
| Solutions | 2 |
| Karma Given | 8 |
| Karma Received | 3 |
| Member Since | 05-19-2017 |
Activity Feed
- Got Karma for Re: tstats summariesonly query does not return results. 09-25-2020 04:45 AM
- Got Karma for Re: tstats summariesonly query does not return results. 09-25-2020 04:45 AM
- Karma Re: IIS Logs: Missing host field / inconsistent host values ms:iis:default and ms:iis:auto for triest. 06-05-2020 12:51 AM
- Karma Re: Drilldown from lookup populated dropdown for vnravikumar. 06-05-2020 12:50 AM
- Karma Re: 2 clusters vs clustered and unclustered vs etc/system/local for micahkemp. 06-05-2020 12:49 AM
- Karma Re: Indexes searched by CIM data models for rpille_splunk. 06-05-2020 12:49 AM
- Karma Re: Am I allowed to do an eval inside a sum when creating dashboards? for elliotproebstel. 06-05-2020 12:49 AM
- Got Karma for Re: How to access data from a Lookup table in another app to a custom dashboard in ES?. 06-05-2020 12:49 AM
- Karma Re: How to loop through all the values of a list, run the same search for each value, and finally combine the results? for lguinn2. 06-05-2020 12:48 AM
- Karma Re: Why does PDF generation with custom logo for alerts fail? for bohanlon_splunk. 06-05-2020 12:48 AM
- Karma Re: What are the pros and cons of using search workflow action vs subsearch? for adonio. 06-05-2020 12:48 AM
- Posted Re: How come extra tabs in our drilldown dashboards are opening without apparent cause? on Dashboards & Visualizations. 02-21-2019 01:15 PM
- Posted How come extra tabs in our drilldown dashboards are opening without apparent cause? on Dashboards & Visualizations. 02-21-2019 01:13 PM
- Tagged How come extra tabs in our drilldown dashboards are opening without apparent cause? on Dashboards & Visualizations. 02-21-2019 01:13 PM
- Tagged How come extra tabs in our drilldown dashboards are opening without apparent cause? on Dashboards & Visualizations. 02-21-2019 01:13 PM
- Tagged How come extra tabs in our drilldown dashboards are opening without apparent cause? on Dashboards & Visualizations. 02-21-2019 01:13 PM
- Posted Re: Drilldown from lookup populated dropdown on Splunk Search. 02-13-2019 11:10 AM
- Posted Re: Drilldown from lookup populated dropdown on Splunk Search. 02-13-2019 11:08 AM
- Posted Re: Drilldown from lookup populated dropdown on Splunk Search. 02-13-2019 10:54 AM
- Posted Re: Drilldown from lookup populated dropdown on Splunk Search. 02-13-2019 10:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-21-2019
01:15 PM
not sure why the code didn't come through, let me try again:
top board:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host
| dedup group
| table group
</query>
</search>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition>
<link target="_blank">
drilldown1?group_tok=$group_tok$
</link>
</condition>
</change>
</input>
</fieldset>
1st drilldown:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="host_tok" searchWhenChanged="true">
<label>Bot</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host where group=$group_tok$
| table host
</query>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<change>
<condition>
<link target="_blank">drilldown2?host=$host_tok$</link>
</condition>
</change>
</input>
<input type="time" token="timepicker" searchWhenChanged="true">
<label>Search Time</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
... View more
02-21-2019
01:13 PM
CONTEXT: I have a group of servers divided into several groups. From the top page, a user makes a choice from a dropdown to get to a dashboard with data from all servers in that group, and from the first drilldown, the user can choose (again from a dropdown) a specific server within the group to open a dashboard with logs specific to the chosen server.
The server lists and groups are fairly maleable, so I have set each of the top 2 dashboards to populate the dropdowns dynamically from a lookup table.
PROBLEM: When I open the top level dash, 1 to 3 of the 1st drilldown open (in new tabs) and either 3 or 9 of the second drilldown opens. This should happen until a choice is made.
top board:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host
| dedup group
| table group
</query>
</search>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition>
<link target="_blank">
drilldown1?group_tok=$group_tok$
</link>
</condition>
</change>
</input>
</fieldset>
1st drilldown:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="host_tok" searchWhenChanged="true">
<label>Bot</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host where group=$group_tok$
| table host
</query>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<change>
<condition>
<link target="_blank">drilldown2?host=$host_tok$</link>
</condition>
</change>
</input>
<input type="time" token="timepicker" searchWhenChanged="true">
<label>Search Time</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
Any idea why I'm getting these extra tabs opened without a choice actually being made? And why in batches of 3?
I've tried with autoRun=true and false, submitButton=true and false (obviously not at the same time for each) and I get the same behaviour.
... View more
02-13-2019
11:08 AM
No, that was the original non-working code I posted. Tried again just to be sure, makes no difference. I had verified the functionality of not using CDATA before I posted it.
... View more
02-13-2019
10:54 AM
Further information: @vnravikumar - running your code as written does indeed work as a standalone, however, when I add in the search to populate the lookup instead of hardcoding choice, it does not work. Here are the 2 pieces of xml:
This works:
<form>
<label>navigation</label>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition label="group">
<link target="_blank">
drilldown1?form.param=$group_tok$
</link>
</condition>
</change>
<choice value="group">group</choice>
</input>
</fieldset>
</form>
This does NOT work:
<form>
<label>navigation</label>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host
| dedup group
| table group
</query>
</search>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition label="group">
<link target="_blank">
drilldown1?form.param=$group_tok$
</link>
</condition>
</change>
</input>
</fieldset>
</form>
You will please note that the only difference is choice is removed and the search is added. As before, I can see, in the url bar, that the $group_tok$ is picking up the dropdown selection, but the new tab is not opening. The search is not providing a choice to the change stanza.
... View more
02-13-2019
10:37 AM
missing from above: for some reason the xml phrase I put in did not publish, should have read -> "making a choice from the dropdown is not beingpassed to the change stanza" and "passing tokens from the dropdown to change and from one dash to another."
... View more
02-13-2019
10:28 AM
This did not work. I've built literally dozens of drilldowns to dashboards that read an pass tokens, this is the first time I have populated the dropdown with a lookup, I don't know if that's relevant. It would appear that the $group_tok$ that is being generated by making a choice from the dropdown is not being passed to the stanza. Can't figure out why. If I hard code it, it works, even passing tokens from the dropdown to and from one dash to another.
... View more
02-13-2019
08:30 AM
I see and understand the changes that you suggested, though I'm confused as to why there are 2 forms on one page, am I missing something?
Regardless, this did not work. the group only added, as one would expect, a choice of "group" to the dropdown, which I do not want.
The search is not in your code, so there is nothing to populate the dropdown with except the above-mentioned "group"
... View more
02-13-2019
07:57 AM
I would suggest, for your own sanity, setting up an indexer cluster and having AWS as one site and Azure as another, but monitoring both environments from one Splunk instance is easily achieved.
... View more
02-13-2019
07:45 AM
I have a dashboard dropdown that I'm populating with "groups" from a lookup "group_ip_host". The idea is to have the user choose a group that takes the user, carrying the $group_tok$, to another dashboard that is generic to any group and does stuff based on the value of $group_tok$.
The dropdown is populating. I can see $group_tok$ being populated in the URL bar (notenoughkarmatopostalink/rpa_clone?form.group_tok=HR). I have verified that the "drilldown" dashboard is available and works given a $group_tok$, but making the selection on the top level dash doesn't take you to the drilldown. Here's my fieldset, what am I missing?
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<search>
<query>
| inputlookup group_ip_host
| dedup group
| table group
</query>
</search>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition label="group">
<link target="_blank">
<![CDATA[/app/XXXXX/drilldown1?group=$group_tok$]]>
</link>
</condition>
</change>
</input>
</fieldset>
... View more
08-21-2018
10:03 AM
1 Karma
IS this on a search head with Enterprise Security installed? If so, try summariesonly instead of summariesonly=true. In my experience the latter will cause trouble, if it will even run, on an ES search head, whereas the former is built in to ES and works every time. Also, verify the summary range of the data model, is your search within the summary range?
... View more
08-21-2018
07:55 AM
We are running SE 6.5.4, ES 4.7.1, Splunk_SA_CIM - 4.8.0
I'm getting a discrepancy between 3 searches over the exact same 15 minute period (any given 15 minute period) for the following 3 searches:
| tstats count FROM datamodel=Web WHERE Web.action=blocked BY Web.category (test case: 49 results)
| tstats summariesonly count FROM datamodel=Web WHERE Web.action=blocked BY Web.category (test case: 44 results)
index=XXXX_proxy action=blocked | stats count by category (test case: 49 results)
Web datamodel is accelerated, Earliest time as set in CIM setup = 2 month
The disparity is not consistent. Sometimes the result count is equal for all 3 searches, sometimes the 2 data model searches are equal and raw is different, etc.
This is making us question the validity of our data models, it seems all three result sets should be the same.
How should I troubleshoot this?
... View more
08-06-2018
07:05 AM
1 Karma
Found it,
https://docs.splunk.com/Documentation/ES/4.7.1/Install/ImportCustomApps
... View more
08-06-2018
06:49 AM
Trying to access data from a lookup table in another app (TA_recordedfuture-cyber) to a custom dashboard we've created in our ES instance. "lookup table is invalid."
Have verified that lookup is available to all apps and has global permissions.
Lookups from that app are available in all other apps on the search head except ES.
Do I need to Configure > Data Enrichment > Lists and Lookups > Add Lookup to make this available?
If I do, does that affect the availability of that lookup table in it's parent app or other apps?
... View more
05-01-2018
06:50 AM
Having trouble wrapping my head around the various "times" associated with data model acceleration. In the CIM setup, you have "Earliest Time" which the docs define as "How far back in time the Splunk platform keeps these column stores, specified as a relative time string."
Summary range is described in the docs as "Data model acceleration summary ranges span an approximate range of time. At times, a data model acceleration summary can have a store of data that slightly exceeds its summary range, but the summary never fails to meet that range, except during the period when it is first being built."
How do these two differ, play together, etc?
... View more
02-19-2018
09:28 AM
no, now I get no results instead of too many:
"No results found."
... View more
02-19-2018
09:05 AM
All times of all events ingested are in UTC. I can't post the actual search due to corporate constraints, but for sake of argument, this should work:
<query>
index=someIndex
| eval several fields
| timechart span=1mon sum(field_0) as first sum(field_1) as second
</query>
<earliest>-3mon@mon</earliest>
<latest>@mon</latest>
as Isaid earlier, I also tried @mon-1d and there was no change
... View more
02-19-2018
08:15 AM
@mon-1d was the first thing I tried before rbinging the issue here. Made no difference.
... View more
02-19-2018
08:12 AM
1 Karma
Wildcards are not supported, see http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Tstats#Wildcard_characters
... View more
02-19-2018
08:01 AM
I have a search I'm turning into a panel for a pre-existing dashboard. On that dash I have used snap time successfullynumerous times:
<earliest>-6mon@mon</earliest>
<latest>@mon</latest>
which obviously just gives me the previous 6 calendar months. In this new panel I'm adding, I want the previous 3 calendar months, so I'm using:
<earliest>-3mon@mon</earliest>
<latest>@mon</latest>
No brainer. But it's giving me Nov, Dec, Jan, and Feb 1. wtf??? Any ideas what might be going on here?
... View more
02-09-2018
09:02 AM
Bloody brilliant, missed that. elliotproebstel, post that as a comment, not a reply so I can accept it. By changing stats to eventstats it works. Thanks!!!
... View more
02-09-2018
08:51 AM
Thanks Giuseppe, that didn't quite work. Here's what I've got now:
| stats sum(x) as X, sum(y) as Y, sum(z) as Z, sum(a) as A, sum(b) as B, sum(c) as C
| eval VALUE_1= X + Y + Z
| eval VALUE_2=A + B + C - VALUE_1
| timechart span=1mon sum(VALUE_1) as VALUE_1 sum(VALUE_2) as VALUE_2
If I leave off that last line, I get the statistics table with all the correct values. Adding the timechart gives me no result.
... View more
02-09-2018
08:26 AM
I now also see why sum(eval (a bunch of sums)) won't work, there's nothing for the outside sum to sum. Not sure how to proceed though.
... View more
02-09-2018
08:16 AM
I see I added too many parens, it's actually this:
| timechart span=1mon sum(eval (sum(a) + sum(b) + sum(c)) as value1 sum(eval (sum(a) + sum(b) + sum(c) - sum(x) - sum(y) - sum(z)) as value2
... View more
02-09-2018
08:13 AM
I've been poking at this for a couple of hours, I think I'm missing something obvious but it's a forest for trees thang.
I have to create 2 dashboards, first is done and tested sat, second uses all of the first except the last line. No, I can't post the exact code. Suffice it to say, I have aggregated 6 fields, a, b, c, x, y, z.
In the first panel, I had to sum a, b, c and then display them in a timechart span=1mon as a stacked bar chart. Works great.
In the second panel I have to sum x, y, z, then take that and subtract it from sum of a, b, c, and present sum of x, y, z and diff (a+b+c) - (x+y+z) in a stacked bar chart, span=1mon.
Here's the line I have to try to do this, but its not presnting any values (nor errors):
| timechart span=1mon sum(eval (sum(a) + sum(b) + sum(c)) as value1) sum(eval (sum(a) + sum(b) + sum(c) - sum(x) - sum(y) - sum(z)) as value2)
Am I allowed to do an eval inside a sum? Is that the issue?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-01-2022
03:07 PM
|
Karma given to
