Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About fabrizioalleva
fabrizioalleva
Path Finder
Member since:
04-18-2019
04-13-2023
Community Statistics
| Posts | 23 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-18-2019 |
Activity Feed
- Posted Re: Splunk doesn't index csv at all on Splunk Enterprise. 06-17-2022 10:44 AM
- Posted Splunk doesn't index csv at all on Splunk Enterprise. 06-17-2022 07:25 AM
- Posted Clickable icon on table on Dashboards & Visualizations. 03-19-2021 08:47 AM
- Posted dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Tagged dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Tagged dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Tagged dashboards.js enabling Create New Dashboard only for admin group on Dashboards & Visualizations. 01-05-2021 07:19 AM
- Posted Re: Dynamically load a dropdown from a value chosen from another on Splunk Enterprise. 11-02-2020 01:56 AM
- Posted Dynamically load a dropdown from a value chosen from another on Splunk Enterprise. 10-30-2020 11:47 AM
- Posted Combining custom_table_row_expansion.js and table_cell_highlighting.js in a dashboard on Splunk Search. 04-22-2020 06:51 AM
- Tagged Combining custom_table_row_expansion.js and table_cell_highlighting.js in a dashboard on Splunk Search. 04-22-2020 06:51 AM
- Tagged Combining custom_table_row_expansion.js and table_cell_highlighting.js in a dashboard on Splunk Search. 04-22-2020 06:51 AM
- Tagged Combining custom_table_row_expansion.js and table_cell_highlighting.js in a dashboard on Splunk Search. 04-22-2020 06:51 AM
- Posted Looping in csv items to count how many values matches in a index on Getting Data In. 04-16-2020 05:54 AM
- Tagged Looping in csv items to count how many values matches in a index on Getting Data In. 04-16-2020 05:54 AM
- Tagged Looping in csv items to count how many values matches in a index on Getting Data In. 04-16-2020 05:54 AM
- Posted Re: Setting token for a dropdwn with a search and init on Dashboards & Visualizations. 04-15-2020 03:34 AM
- Posted Re: Setting token for a dropdwn with a search and init on Dashboards & Visualizations. 04-15-2020 02:27 AM
- Posted Setting token for a dropdwn with a search and init on Dashboards & Visualizations. 04-15-2020 01:16 AM
- Tagged Setting token for a dropdwn with a search and init on Dashboards & Visualizations. 04-15-2020 01:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-17-2022
10:44 AM
Solved. by myself I've to set TIME_PREFIX in props.conf to instruct that the timestamp is the second field and not the first. It's nice to note that the problem there is now that I've some object that has the ID similiar to a UNIX TIMESTAMP. Closed
... View more
06-17-2022
07:25 AM
Hi all, I'm working on a deploy with Universal Forwader, Heavy Forwarder and Indexer Cluster and Search Cluster. The problem is this: I'm indexing data from different csv since long time. For the first time yesterday I realized that not all the raw of my csv files are indexed at all. For example: In a csv I count 24k rows and when I perform a stats count on the index I see only 16/17k rows. Each file rotates every minutes. In the log there's anything that leads to an error. In the UNIVERSAL FORWARDE I've this in inputs.conf [batch:///var/opt/OV/shared/perfSpi/datafiles/metric/final/F5_ResurcesGroup*] disabled = 0 index = f5_metrics sourcetype = f5_metrics initCrcLength = 100000 move_policy = sinkhole In the HEAVY FORWARDER: props.conf [f5_metrics] INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER=1 HEADER_FIELD_DELIMITER =, FIELD_DELIMITER=, HEADER_FIELD_LINE_NUMBER = 0 SEDCMD-dropheader = s/^"Node.+//g SEDCMD-select_fields = s/([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*)/\1,\2,\4,\5,\9,\17,\18/g #SEDCMD-select_fields = s/([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*)/\1,\4,\5,\9,\17,\18/g TRANSFORMS-f5_fields_name_extract=f5_fields_name_extract and in the transform.conf [f5_fields_name_extract] REGEX=([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*),([^,]*) FORMAT=NodeID::$1 TimeStamp::$2 period_length::$3 ltmVirtualServStatClientCurConns::$4 ltmVirtualServStatVsUsageRatio1m::$5 DisplayAttribute::$6 PollingInterval::$7 #FORMAT=NodeID::$1 period_length::$2 ltmVirtualServStatClientCurConns::$3 ltmVirtualServStatVsUsageRatio1m::$4 DisplayAttribute::$5 PollingInterval::$6 WRITE_META = true Any suggestion ? Thanks Fabrizio
... View more
Labels
03-19-2021
08:47 AM
Hi all, I'm looking for a method to put some icons into a table ( 4 or 5 foreach row), which are clickable and open different link ( one syslog, one cmdb infos, one performance and other). I've tried some solution like : https://community.splunk.com/t5/Splunk-Search/How-do-you-add-buttons-on-table-view/m-p/384712#M112364 but it's not what I'm looking for. I succeded in putting only label so somenthing like this: and the click on each link is working fine, so instead of the label I want to put an icon. Thanks in advance for any response Fabrizio
... View more
Labels
- Labels:
-
javascript
-
simple XML
-
table
01-05-2021
07:19 AM
Hi all, I've succeeded in enabling the button "Create New Dashboard" only for the admin user. But if I want to enable it for all the users in admin Roles? I'm trying to work with roles:this.collection.roles this.roles.id = /services/authentication/Roles/admin but nothing.. any suggestions ? Thanks Fabrizio
... View more
Labels
- Labels:
-
javascript
11-02-2020
01:56 AM
Thanks a lot
... View more
10-30-2020
11:47 AM
Hi all, I'm trying to populate a dropdown with dynamic values according the value coming from another dropdown, like unit measure for example: if the dropdown A contains Fruits the B will contain (1000 gr, 100 hg, 1 kG ) instead if the A cointains Liquid B will cointains (1000 ml. 100 cl. ) where 1000/100/1 will be Field For Value and gr hg and KG will be field for Label. I'm trying something like this : | makeresults | eval type="fruits" | eval unit=case(type=="fruits","1000 gr, 100 hg, 1 kg", type=="liquid","1000 ml, 100 cl", 1=1, "no vlaue") | rex field=unit "(?<A>.*)\,(?<B>.*)" | fields A B But I'm not be able to parameterize the two or three values in the fields to make the split.. Thanks
... View more
Labels
- Labels:
-
using Splunk Enterprise
04-22-2020
06:51 AM
Hi all,
I've succeeded in making a table with custom_table_row_expansion,js which expand every rows publishing the child events of a correlated father.
Now I'm tryingto apply table_cell_highlighting to colour the child new event with a color for the dalay.
I've combined table_cell_highlighting.js in the dashboard. In the custom_table_row_expansion.js I set the id of the new table highlight, I made a style css inside the dashboard in the hidden panel:
<panel depends="$alwaysHideCSS$">
<html>
<style>
.table>thead>tr>th {
color: #0066ff !important;
text-shadow: none;
font-family : Verdana !important;
}
.table>thead>tr>th:hover {
/*background-image: linear-gradient(to bottom, #666, #444) !important;*/
color: #000000 !important;
text-shadow: none;
}
.table .sorts a {
text-decoration: none;
font-weight: bold;
font-size: 12px ;
color: #002966;
}
.table>tbody>tr {
width: 20%;
color: #006699;
font-family : Verdana !important;
}
td{
font-size: 11px !important;
font-family : Verdana !important;
}
#highlight tr.range-elevated td {
background-color: #000000 !important;
color: #ffffff;
}
#highlight tr.range-severe td {
background-color: #ff0000 !important;
color: #ffffff;
}
#highlight .table td {
border-top: 1px solid #fff;
}
#highlight td.range-severe, td.range-elevated {
font-weight: bold;
}
</style>
</html>
</panel>
and the javascript is this one:
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
// Row Coloring by String Comparision of Numeric Time Value in HH:MM:SS
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer for DELAY field
return _(['DELAY']).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = cell.value;
// Apply interpretation for DELAY field
if (cell.field === 'DELAY') {
if (value >= "02:00:00") {
$td.addClass('range-cell').addClass('range-severe');
}
if (value < "02:00:00" && value > "01:30:00") {
$td.addClass('range-cell').addClass('range-elevated');
}
}
// Update the cell content with string DELAY value HH:MM:SS
$td.text(value).addClass('string');
}
});
mvc.Components.get('highlight').getVisualization(function(tableView) {
tableView.on('rendered', function() {
// Apply class of the cells to the parent row in order to color the whole row
tableView.$el.find('td.range-cell').each(function() {
$(this).parents('tr').addClass(this.className);
});
});
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
});
But nothing happened when I expand the rows.
Any suggestion ?
Fabrizio
... View more
04-16-2020
05:54 AM
Hi all,
starting from a csv which contains 10 items, I want to count ( in order to produce a chart ) all the matches in the index and all the matches where a specific fields is equal to 1 . So two values for each item ( the first all matches and seconds all the matches where another field = 1 )
If no matches were found the value for csv items should be 0.
I hope it's clear
I try to do it whitout csv, but if an item has no matches in the index that item is not shown in the chart )
Thanks Fabrizio
... View more
- Tags:
- csv
- splunk-enterprise
04-15-2020
03:34 AM
Ok this works fine !
Thanks a lot!
How can I accept this as ansswer ??
... View more
04-15-2020
02:27 AM
It doesn't work in the dropdown the default value is not 15 ( today ) is always $day$.
It seems that Splunk doesn't accept the first query which pass the today value in the token.
The porpouse is to load a dropdown with the list of days, and by default to show the today value.
Thanks
... View more
04-15-2020
01:16 AM
Hello,
I'm trying from an initial search to put the value into a token to use it as a default initial value for a dropdown list something like this:
<form script="table_with_buttons.js">
<search>
<query>
| makeresults
| eval day=strftime(now(), "%d")
| fields day
</query>
<done>
<set token="day">$result.day$</set>
</done>
</search>
<init>
<set token="start_day">$day$</set>
</init>
<row>
<panel>
<title>Data Inizio</title>
<input type="dropdown" token="start_day">
<label>Giorno $start_day$</label>
<fieldForLabel>giorno</fieldForLabel>
<fieldForValue>giornoid</fieldForValue>
<search>
<query>|inputlookup day.csv| table dayid day</query>
</search>
<choice value="$start_day$">$start_day$</choice>
<default>$start_day$</default>
</input>
</panel>
</row>
<form>
at runtime what I obtain is shown in the picture :
Any Suggestion ?
Thanks
Fabrizio
... View more
03-16-2020
11:00 AM
Opsssss. I've tried this but I dont wait for the result to come back!!!!!!
Now I've tried and I wait and the results came back I'm sorry!!!!!!!!
... View more
03-16-2020
10:26 AM
Hi all,
is there a way to pass to a report the filename of a csv as variable, to use it as lookup file ?
Example:
| savedesearch my_report file=my_file.csv
where
my_report
| some search
| lookup $file$
... View more
01-27-2020
05:48 AM
Hi,
in the last days I've succeded in establishing the right comunication between HF and IDX. So now when i bring up the port 9996 all the other forwarding still work fine.
Only the one which runs on 6514 (hf) ---> 9996 (idx_cl ) give me those messagges in metrics.log:
01-27-2020 14:41:26.012 +0100 INFO Metrics - group=tcpin_connections, a.b.c.d:40386:6514, connectionType=rawSSL, sourcePort=40386, sourceHost=a.b.c.d, sourceIp=a.b.c.d, destPort=6514, kb=0, _tcp_Bps=0, _tcp_KBps=0, _tcp_avg_thruput=0, _tcp_Kprocessed=0, _tcp_eps=0, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0
Any suggestion?
Thanks
... View more
01-22-2020
06:55 AM
I've tried even this way, but after the deployment, was alway the same.
In all the NO-SSL app's input.conf I put
_TCP_ROUTING = default-autolb-group
and in the SSL one :
_TCP_ROUTING=splunkindexer-ssl
but it is always the same.
... View more
01-22-2020
05:42 AM
Ok,
Probably the easiest way is to configure the 9997 port on indexer in SSL, and all the comunication will go over SSL
But If I want to configure the other port ?
Does the Heavy Forwarder support a configuration like the one I've posted in my question ?
Fabrizio
... View more
01-22-2020
01:31 AM
Hi all,
I've an enviroment like this:
1 Search Head Cluester ( 3 servers ) ;
1 Indexers Cluster ( 4 server );
1 Deployment Server;
1 Cluster Master;
1 Heavy Forwarder;
and N universal forwarder.
On each server, of the indexer cluster, I've opened the 9997 port to receive and ingest data.
I configured the Heavy forwarder to send data to the IDX cluster through an'APP with an outputs.conf like this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
indexerDiscovery = idxc1
useACK = true
autoLBVolume = 65536
[indexer_discovery:idxc1]
master_uri = https://[cm_ip]:8090
pass4SymmKey = **********
This output is not SSL and all the data which use this output are ingested from IDX cluster.
Now I've to send from the same Heavy Forwarder other data but in SSL. So after creating the certificates for Indexers and for the forwarders, after copying the RootCA on each server, I've created an app on the forwarder with an inputs.conf like this:
[tcp-ssl://6514]
disabled = false
sourcetype = syslog
index = ads
[SSL]
serverCert = $SPLUNK_HOME/etc/certs/hforwarder.pem
sslPassword = ***********
requireClientCert = false
and outputs.conf like this :
[tcpout]
defaultGroup=splunkindexer-ssl
[tcpout:splunkindexer-ssl]
autoLBFrequency = 30
compressed = false
server = idx1:9996,idx2:9996,idx3:9996,idx4:9996
clientCert = $SPLUNK_HOME/etc/certs/splunk.pem
useSSL=true
sslPassword = ***********
On the each indexers node I've create an app to open the 9996 port on SSL, with an inputs.conf like this:
[tcp-ssl://9996]
disabled = false
[SSL]
serverCert = $SPLUNK_HOME/etc/certs/splunk.pem
sslPassword = **********
requireClientCert = false
After deploying this configuration the first flow through the 9997 doesn't receive any data and not all data are forwarded through 9996.
With tcpdump I see the right flow from the source to Heavy Forwarder (6514) , I see some data receveived from the indexer cluster on 9996 but no data where indexed on ads index and on other index.
So now I ask myself what should be wrong and if a forwarder can support two outputs.conf so configured.
Any help is appreciated and welcome
Fabrizio
... View more
09-24-2019
05:41 AM
Ok,
I've solved with a SED command as
https://answers.splunk.com/answers/564940/remove-fields-at-index-time-from-a-csv-file.html
But is there another way to solve it ?
... View more
09-24-2019
02:34 AM
Hi all,
I'm in enviroment so configured:
1 uf, 1 hf, 4 indexers, 1 search head, 1 master cluster.
I've to index a large CSV, read from the universal forwarder, which forwards data to the HF which pass the data to the indexer.
The CSV has 150 fields and I want to index only 10 of these. So I've configured these things:
on universal forwarder:
------------------
inputs.conf
------------------
[monitor:///myfolder/Interface*]
disabled = 0
index = interface_metrics
sourcetype = if_csv
on heavy forwarder
------------------
inputs.conf
------------------
[splunktcp://9996]
index=interface_metrics
sourcetype = if_csv
------------------
props.conf
------------------
[if_csv]
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER=1
HEADER_FIELD_DELIMITER =,
FIELD_DELIMITER=,
HEADER_FIELD_LINE_NUMBER = 0
TRANSFORMS-set=setnull, setparsing, nullhead
------------------
transforms.conf
------------------
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[nullhead]
REGEX = ifInDiscardsDelta
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = ^([^,]),([^,]),(?:[^,]+,\s*)([^,]),([^,])(?:[^,]+,\s*){5}([^,]),([^,])(?:[^,]+,\s*){3}([^,]),([^,]),(?:[^,]+,\s*){2}([^,]),([^,])(?:[^,]+,\s*){7}([^,])(?:(?:[^,]+,?\s)|(?:[,,])){123}([^,]),([^,])
DEST_KEY = queue
FORMAT = indexQueue
example CSV row :
0ef1fa5f-586c-48a4-a902-827aef967f47,1569309580446,300.0,100,9,0,0,0,0,6.6107712E7,5.0463189E7,151356.0,150857.0,0.176,0.135,0.0,0.0,0.0,0.0,0,0,0,0,0,0,4b16e13e-c391-4626-b364-2890fe5a009a,0,0,0,0,,,151351,149267,0,0,451,5,1139,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,039550ed-1d39-487f-9b12-276ad9472771,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3.0,3.0,,,0.056,3.4E-4,0.2,3.0,3.0,,,0.056,3.4E-4,0.2,1569309300000,300
I want to keep the fields:
1,2,4,5,10,11,14,15,26,149,150
I don't succeed in indexing only the fields that I choose, but the whole row.
What I'm wrong ?
Thanks
Fabrizio
... View more
05-09-2019
12:36 AM
PERFECT!!!!! I've to adjust it for my data!!
Thanks a lot
... View more
05-09-2019
12:30 AM
@niketnilay : I have to order a small table with 12 lines, dividing them, for reasons of space in the dashboard, 6 in the first two columns and 6 in the second
... View more
05-08-2019
06:51 AM
Hello,
I need to transform this table:
Fruits Euro
Apples 2
Banana 1
Strawberry 3
Ananas 3
Blueberry 4
Pear 2
into :
Fruits Euro Fruits Euro
apples 2 Banana 1
Strawb 3 Ananas 3
Bluebe 4 Pear 2
Is there a way ?
Thanks Fabrizio
... View more
- Tags:
- splunk-enterprise
04-18-2019
02:24 AM
Hi all,
I'm new of a splunk. I'm wondering if there is a way or if it's possible to put a search result into a token in INIT tag section.
I've to calculate the total of the devices in order to pass it to a single to obtain somenthing like this
n
of total devices
<dashboard>
<init>
<set token="tot_device">some_search</set>
</init>
<label>Example</label>
<row>
<panel>
<single>
<title>Center</title>
<search ref="rpt_random_color"></search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="showTrendIndicator">1</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0x#33cc33","0x6db7c6","0xf7bc38","0xf58f39","#ff3300"]</option>
<option name="rangeValues">[0,1,2,3,4]</option>
<option name="underLabel">of $tot_device$</option>
<option name="useColors">1</option>
<option name="unit"></option>
</single>
</panel>
</row>
</dashboard>
In tag set I try to put search or query tag I see that there no compilation error but no results are shown
Thanks in advance for replies
Fabrizio
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-13-2023
08:56 AM
|
