Hi, I have dozens of HTML Dashboards (I know it's deprecated...) running on iPad in our production. The Dashboards are used for user input for data our machine can't deliver themselves (like why was the produced unit bad instead of only that is was bad). Basically there are a few big buttons to choose from and select a error reason for example. If the button is pressed a Splunk search is executed with a collect command and the selected data is written into a summary index.  This works most of the time but not always. I assume in 10-20% of searches, the search could not be finished because of network connection error. This also happens at logging in into Splunk sometimes, an error "no network connection " occurs.  Our network guys didn't find any issues on their side.  And the other interesting part is, it only happens on iPads/iOS. On Windows machines it never happens!   Does anybody came across the same issues or something similar?    Thanks! ... View more

Hello guys!   I use some reports with the    | multireport   command like this:    ...search... | multireport [ | table _time L5PS1GutStk | sort + _time | where L5PS1GutStk!="" | autoregress L5PS1GutStk | reverse | fillnull | stats count(eval(L5PS1GutStk!=L5PS1GutStk_p1 AND L5PS1GutStk!=0)) as passes1 ] [ | table _time L5PS2GutStk | sort + _time | where L5PS2GutStk!="" | autoregress L5PS2GutStk | reverse | fillnull | stats count(eval(L5PS2GutStk!=L5PS2GutStk_p1 AND L5PS2GutStk!=0)) as passes2 ] ...rest of the search...    This worked until yesterday, when Splunk was updatet from 7.3.3 to 8.2.2.  Then this error occured: It had to be fixed very fast so we created a simpler but more wrong search. Today I was further investigating what went wrong and causes this issue.  If first thought of the not documented multireport command and that this command was removed or something in the new version. But my colleague had a similar search with multireport and it still worked. I removed the whole multireport and it worked again so somethin with the multireport was wrong. Then I removed line after line for its own in the subsearches to figure out the source of the problem.  Finally after removing the |table command in the first line of each subsearch, the whole search was working again!! I found the source. I replaced the table with the field command and everything works well again, crisis averted. I then tested another thing: Just replacing |table with |fields in only 1 subsearch. --> It worked again, no error.    So my question to you guys is: Does anybody know what went wrong here and what are the differences in the Splunk versions to produce this error? Thanks!!   PS to the Splunk Team: Please never delete the multireport and make it official, it is a very useful command! ... View more

Hi guys, I have a dashboard where a user inputs data using dropdowns and text inputs.  If he inputs all data and click on submit a hidden search (row) is executed which populates a lookup with values of the tokens of the input fields. The next row displays a table with the lookup content. Additional to that there is a row with one dropdown to select a tool from a production machine. If this dropdown is used, a search is started which searches after produced pieces of this tool since the last entry of that tool in lookup above. If he clicks on the single value displayed from the search, the piece count is pasted into the matching field of the main inputs above.  This helps the user to get all data for the input into the lookup. Now the problem is, that dropdown for the tool selection has searchWhenChanged=true so the search for the piece count can start. But sometimes (not every time I think) it also starts the hidden search from above and sends data to the lookup although the submit button wasn't clicked. This results in unwanted data. What I tried is to unset all input tokens after the hidden search is done. This prevents it from sending data to the lookup without clicking submit because there are missing tokens for that search. But it deletes the input too just when selecting a tool.    In short: Is there a way to specify which search is executed by changing a input field / token and not just all searches? Thanks!   Here is the SimpleXML:     <form hideFilters="true" theme="dark"> <label>Edelhoff Werkzeug Wartungsboard</label> <init> <eval token="default_von">strftime(now(),"%d.%m.%Y")</eval> <eval token="default_bis">strftime(now(),"%d.%m.%Y")</eval> <set token="tok_trigger"></set> <set token="tok_trigger_date_update"></set> </init> <fieldset submitButton="true"> <input type="dropdown" token="tok_WN" searchWhenChanged="false"> <label>Auswahl Werkzeug</label> <fieldForLabel>Werkzeugname</fieldForLabel> <fieldForValue>Werkzeugnummer</fieldForValue> <search> <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu | dedup Werkzeugnummer | fields Werkzeugnummer | sort Werkzeugnummer | lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeugnummer OUTPUTNEW Werkzeugname | table Werkzeugnummer Werkzeugname</query> <earliest>0</earliest> <latest></latest> </search> </input> <input type="dropdown" token="tok_grund" searchWhenChanged="false"> <label>Ausfallgrund</label> <choice value="Gratbildung">Gratbildung</choice> <choice value="Massabweichung">Maßabweichung</choice> <choice value="sichtbarerSchaden">sichtbarer Schaden</choice> <choice value="Elektrik">Elektrik</choice> <choice value="Hydraulik">Hydraulik</choice> <choice value="StempelGebrochen">Stempel gebrochen</choice> </input> <input type="dropdown" token="tok_massnahme" searchWhenChanged="false"> <label>Instandsetzungsmaßnahme</label> <choice value="Nachschleifen">Nachschleifen</choice> <choice value="Stempel-/Matrizenwechsel">Stempel- /Matrizenwechsel</choice> <choice value="Federn">Federn</choice> <choice value="Führungen">Führungen</choice> </input> <input type="text" token="tok_end_rep" searchWhenChanged="false"> <label>gewartet zurück</label> <initialValue>$default_bis$</initialValue> <default>$default_bis$</default> </input> <input type="text" token="tok_stueckzahl" searchWhenChanged="false"> <label>Stückzahl</label> <default>-</default> <initialValue>-</initialValue> </input> <input type="text" token="tok_details" searchWhenChanged="false"> <label>Bemerkungen</label> <default>-</default> <initialValue>-</initialValue> </input> </fieldset> <row depends="$never_show_this_row$"> <panel> <table> <search> <done> <unset token="form.tok_WN"></unset> <unset token="form.tok_grund"></unset> <unset token="form.tok_massnahme"></unset> <unset token="form.tok_end_rep"></unset> <unset token="form.tok_stueckzahl"></unset> <unset token="form.tok_details"></unset> <eval token="default_von">strftime(now(),"%d.%m.%Y")</eval> <eval token="default_bis">strftime(now(),"%d.%m.%Y")</eval> <eval token="form.default_von">strftime(now(),"%d.%m.%Y")</eval> <eval token="form.default_bis">strftime(now(),"%d.%m.%Y")</eval> </done> <query>| makeresults | eval Werkzeug="$tok_WN$" | eval Wartungsgrund="$tok_grund$" | eval Wartungsmaßnahme="$tok_massnahme$" | eval rep_back="$tok_end_rep$" | eval Stueckzahl="$tok_stueckzahl$" | eval Bemerkungen="$tok_details$" | fields Auftrag Werkzeug Wartungsgrund Wartungsmaßnahme "zum WZB" rep_back Stueckzahl Bemerkungen | fields - _time | outputlookup append=t W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <search> <done> <set token="tok_rep">$result.rep_back$</set> </done> <query>| inputlookup W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv | eval _time=strptime(rep_back,"%d.%m.%Y") | stats latest(rep_back) as timestamp by Maschine | eval header=rep_back | transpose 100 header_field=header | where Werkzeug=="$tok_WN$"</query> <earliest>0</earliest> <latest></latest> </search> <option name="count">5</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <title>Wartungshistorie</title> <table> <search> <done> <eval token="tok_trigger_date_update">now()</eval> </done> <query>| inputlookup append=t W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv | lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeug OUTPUTNEW Werkzeugname | eval _time=strptime(rep_back,"%d.%m.%Y") | rename rep_back as "repariert zurück" | sort - _time | fillnull value="-" | fields - _time | table "repariert zurück" Werkzeugname Werkzeug Wartungsgrund Wartungsmaßnahme Stueckzahl Bemerkungen | rename Werkzeug as Speicherplatznummer</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> <refresh>15s</refresh> <refreshType>delay</refreshType> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="tok_WN">$row.Speicherplatznummer$</set> <set token="tok_WN2">$row.Speicherplatznummer$</set> <set token="form.tok_WN">$row.Speicherplatznummer$</set> <set token="form.tok_WN2">$row.Speicherplatznummer$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>Werkzeug Stückzahlen nach der letzten Wartung</title> <input type="dropdown" token="tok_WN2" searchWhenChanged="true"> <label>Auswahl Werkzeug</label> <fieldForLabel>Werkzeugname</fieldForLabel> <fieldForValue>Werkzeugnummer</fieldForValue> <search> <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu | dedup Werkzeugnummer | fields Werkzeugnummer | sort Werkzeugnummer | lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeugnummer OUTPUTNEW Werkzeugname | table Werkzeugnummer Werkzeugname</query> <earliest>0</earliest> <latest></latest> </search> </input> <single> <title>seit $tok_end_rep2$</title> <search> <done> <set token="tok_end_rep2">$result.back$</set> </done> <query>index=machinedata_w05 source=W05FBEdelhoffIV7460 Werkzeugnummer_1min OR name=Werkzeugnummer_10min OR name=NSW_Stempel_Winkel_Aktuell10ms earliest=@d latest=now | eval Nummer=case(name=="Werkzeugnummer_10min", value, Werkzeugnummer_1min!="", Werkzeugnummer_1min) | eval {name}=value | rename NSW_Stempel_Winkel_Aktuell10ms as Winkel | reverse | filldown Nummer | reverse | filldown Winkel | where Nummer=$tok_WN2$ | eval pressing = if((Winkel&gt;130 AND Winkel&lt;150), 1, 0) | fields pressing _time Kraft1 Nummer Hauptantrieb_Strom Hauptantrieb_Temperatur Hauptantrieb_Drehmoment Hubhoehe | filldown | autoregress pressing | eval pressingAction = if(pressing==1 AND pressing_p1==0, 2, 0) | reverse | stats c(eval(pressingAction==2)) as Stueckzahl | eval Stueckzahl = Stueckzahl + [ | search index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu Werkzeugnummer=$tok_WN2$ [ | inputlookup W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv where Werkzeug=$tok_WN2$ | fields rep_back | eval rep_back=strptime(rep_back,"%d.%m.%Y") | sort - rep_back | head 1 | eval result="earliest=\"".rep_back."\"" | return $result ] latest=now | stats c as Stueckzahl | return $Stueckzahl ] | appendcols [ | inputlookup W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv where Werkzeug=$tok_WN2$ | fields rep_back | eval rep_back=strptime(rep_back,"%d.%m.%Y") | sort - rep_back | head 1 | eval result=strftime(rep_back, "%d.%m.%y") | return $result ] | rename search as back</query> <earliest>1566774000</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <drilldown> <set token="form.tok_stueckzahl">$click.value$</set> <set token="tok_stueckzahl">$click.value$</set> </drilldown> </single> </panel> </row> <row> <panel> <title>Werkzeug Gesamtstückzahl</title> <input type="dropdown" token="tok_WN2" searchWhenChanged="false"> <label>Auswahl Werkzeug</label> <fieldForLabel>Werkzeugname</fieldForLabel> <fieldForValue>Werkzeugnummer</fieldForValue> <search> <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu | dedup Werkzeugnummer | fields Werkzeugnummer | sort Werkzeugnummer | lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeugnummer OUTPUTNEW Werkzeugname | table Werkzeugnummer Werkzeugname</query> <earliest>0</earliest> <latest></latest> </search> </input> <single> <search> <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu Werkzeugnummer=$tok_WN2$ | stats c as Stueckzahl | eval Stueckzahl = Stueckzahl + [ | search index=machinedata_w05 source=W05FBEdelhoffIV7460 Werkzeugnummer_1min OR name=Werkzeugnummer_10min OR name=NSW_Stempel_Winkel_Aktuell10ms earliest=@d latest=now | eval Nummer=case(name=="Werkzeugnummer_10min", value, Werkzeugnummer_1min!="", Werkzeugnummer_1min) | eval {name}=value | rename NSW_Stempel_Winkel_Aktuell10ms as Winkel | reverse | filldown Nummer | reverse | filldown Winkel | where Nummer=$tok_WN2$ | eval pressing = if((Winkel&gt;130 AND Winkel&lt;150), 1, 0) | fields pressing _time Kraft1 Nummer Hauptantrieb_Strom Hauptantrieb_Temperatur Hauptantrieb_Drehmoment Hubhoehe | filldown | autoregress pressing | eval pressingAction = if(pressing==1 AND pressing_p1==0, 2, 0) | reverse | stats c(eval(pressingAction==2)) as counter | return $counter ]</query> <earliest>1566774000</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </form>         ... View more

Hi guys, I'm currently developing a Dashboard for user interaction.  We have a production machine with three work stations which are separated.  Now every work station can stop the conveyor.  We can't get the reason the conveyor stops automatically out of the machine so we want to digitize our worker knowledge (they see a faulty part for example).  Every work station now has an own iPad where the HTML-dashboards are running.    Out of a lookup I load the possible reasons why a worker at a certain station could have stopped the conveyor and display them accordingly on the dashboards just as red buttons.  If a button is pressed a search is executed to store the work station, the stopping reason and the time in an index. Now all dashboards are locked (buttons deactivated) that nobody can set two reasons at once. One work station can start the conveyor again and on that dashboard the buttons are replaced with one big dismiss button which has to be pressed if the worker starts the conveyor again.    This works as expected.  Now, because of the separation of the work stations, they want to display the stop reason, work station and time of the current stop on all dashboards.  To do this I implemented a second search which updates a lookup with the required information or deletes it.  Now to my problem: To display the information I run a cyclic search (with setTimeout(function, delay)). Now this works multiple times but then it just stops the execution of the cyclic search (as far as I know).  Question: How can I ensure to run the cyclic search forever?  OR:  Can I retrieve the lookup data in another way?   If you have questions to my question or I forgot to implement some info, please give me a note! Splunk version: 7.3.3  The code:       startCyclicSearch(10000); function cyclicSearch(){ console.log("Start zyklische Suche"); searchReadST.settings.set("search", '| inputlookup Stoerung' + Linie.substr(Linie.length-1,1) + lookup + '.csv' ); searchReadST.startSearch(); } function resetKommendGedrueckt(){ kommendgedrueckt = false; } var aktStoerungArray; var aktStoerungResults = searchReadST.data("results"); // get the data from that search aktStoerungResults.on("data", function() { var tokens = mvc.Components.get("default"); //console.log(aktStoerungResults.data().rows); aktStoerungArray = aktStoerungResults.data().rows; console.log("Arbeitsplatz: " + aktStoerungArray[0][0] + " " + aktStoerungArray[0][1] + " aktive Störung: " + aktStoerungArray[0][2] + " Uhrzeit: " + aktStoerungArray[0][3]); if (!kommendgedrueckt){ if (aktStoerungArray[0][0] == ""){ $("#aktSt").html(""); $("#row00").hide(); $(".btnKommend").prop("disabled", false); } else{ $("#aktSt").html(aktStoerungArray[0][0] + " " + aktStoerungArray[0][1] + ": aktive Störung = " + aktStoerungArray[0][2] + " Uhrzeit: " + aktStoerungArray[0][3]); $("#row00").show(); $(".btnKommend").prop("disabled", true); } } startCyclicSearch(2000); }); var St; var counter = 0; // Eventlistener für Störungsbuttons registrieren document.addEventListener('click',function(e){ if(e.target && $(e.target).hasClass("btnKommend")){ console.log("Entering Kommend"); clearTimeout(intervalID); kommendgedrueckt = true; // Sofort Button deaktivieren um nicht auf lookup warten zu müssen und versehentlich eine 2. Störung zu senden $(".btnKommend").prop("disabled", true); // Störung aus Button Text übernehmen St = e.target.innerHTML; // Suche starten --> Störung mit Timestamp und AP speichern in Summary index machinedata_w05_sum searchST.settings.set("search", mvc.tokenSafe('| makeresults 1 | eval area="Pulvertechnik", machine="inputDevicePulveranlagen", app="StörungenPulveranlagen" | eval Störung="'+ St +'" | eval action="kommend" | eval Arbeitsplatz="' + AP + '", Linie="' + Linie + '" | table _time area machine app Störung action Arbeitsplatz Linie | collect index="' + summaryIndex + '" testmode=f' )); searchST.startSearch(); // TODO: Remove the following line if it doesn't work searchST.finalize(); //console.log("Suche ausgeführt " + getFormattedDate()); //console.log(searchST.id); searchST.settings.set("search", mvc.tokenSafe('')); // Störung in inputlookup schreiben --> Andere Dashboards können drauf zugreifen searchStoreST.settings.set("search", mvc.tokenSafe('| makeresults 1| eval _time=strftime(_time, "%H:%M:%S") | eval Stoerung="'+ St +'" | eval Arbeitsplatz="' + AP + '", Linie="' + Linie + '" | outputlookup Stoerung' + Linie.substr(Linie.length-1,1) + lookup + '.csv ')); searchStoreST.startSearch(); $(".btnKommend").prop("disabled", true); setTimeout(resetKommendGedrueckt, 10000); startCyclicSearch(10000); }       Thanks alot! ... View more