Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sb01splunk
sb01splunk
Explorer
Member since:
09-27-2019
08-23-2022
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 09-27-2019 |
Activity Feed
- Posted Re: How can I write the following to get past the join limitation? on Splunk Search. 06-16-2022 06:38 AM
- Posted How can I write the following to get past the join limitation? on Splunk Search. 06-15-2022 02:45 PM
- Posted Re: How to limit the 'All' option to what query actually returns and not for * entries for targetAppAlternateId on Dashboards & Visualizations. 04-13-2022 05:04 AM
- Posted Re: How to limit the 'All' option to what query actually returns and not for * entries for targetAppAlternateId on Dashboards & Visualizations. 04-12-2022 05:45 AM
- Posted How to limit the 'All' option to what query actually returns and not for * entries for targetAppAlternateId on Dashboards & Visualizations. 04-11-2022 01:08 PM
- Posted Re: Number of active VPN users over time on Splunk Search. 03-18-2022 06:54 AM
- Posted Re: Dynamic dropdown and multiple tokens on Dashboards & Visualizations. 10-08-2020 11:15 AM
- Karma Re: Dynamic dropdown and multiple tokens for ITWhisperer. 10-08-2020 11:15 AM
- Posted Dynamic dropdown and multiple tokens on Dashboards & Visualizations. 10-08-2020 08:08 AM
- Got Karma for How to rename extracted values. 06-05-2020 12:50 AM
- Posted How to have the Dynamic dropdown select All from dropdown list only? on Dashboards & Visualizations. 09-30-2019 09:08 AM
- Tagged How to have the Dynamic dropdown select All from dropdown list only? on Dashboards & Visualizations. 09-30-2019 09:08 AM
- Tagged How to have the Dynamic dropdown select All from dropdown list only? on Dashboards & Visualizations. 09-30-2019 09:08 AM
- Tagged How to have the Dynamic dropdown select All from dropdown list only? on Dashboards & Visualizations. 09-30-2019 09:08 AM
- Tagged How to have the Dynamic dropdown select All from dropdown list only? on Dashboards & Visualizations. 09-30-2019 09:08 AM
- Posted Re: How to rename extracted values on Splunk Search. 09-27-2019 07:38 PM
- Posted How to rename extracted values on Splunk Search. 09-27-2019 02:35 PM
- Tagged How to rename extracted values on Splunk Search. 09-27-2019 02:35 PM
- Tagged How to rename extracted values on Splunk Search. 09-27-2019 02:35 PM
- Tagged How to rename extracted values on Splunk Search. 09-27-2019 02:35 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-16-2022
06:38 AM
Thanks for getting me in the right direction. The following seems to work (index=aws sourcetype="aws:cloudtrail" eventName=TerminateInstances) OR (index=aws source="us-west-1:ec2_instances" sourcetype="aws:description")
| eval joiner=if(sourcetype="aws:cloudtrail", 'requestParameters.instancesSet.items{}.instanceId', vm_id)
| eval Time=if(eventName="TerminateInstances", _time, null())
| eval Time=strftime(Time, "%Y-%d-%m %H:%M:%S")
| stats values(*) as * by joiner
| where 'requestParameters.instancesSet.items{}.instanceId'=vm_id
| table Time, userName, action, vm_id, "tags.Name" if I try something like this though it returns nothing (index=aws sourcetype="aws:cloudtrail" eventName=TerminateInstances) OR (index=aws source="us-west-1:ec2_instances" sourcetype="aws:description")
| eval joiner=if(sourcetype="aws:cloudtrail", 'requestParameters.instancesSet.items{}.instanceId', vm_id)
| eval Time=if(eventName="TerminateInstances", _time, null())
| eval Time=strftime(Time, "%Y-%d-%m %H:%M:%S")
| stats values(Time) as Time, values(userName) as userName, values(action) as action, values(vm_id) as vm_id, values('tags.Name') as tags.Name by joiner
| where 'requestParameters.instancesSet.items{}.instanceId'=vm_id
| table Time, userName, action, vm_id, "tags.Name" I'm curious why the 2nd one returns nothing.
... View more
06-15-2022
02:45 PM
How can I write the following to get past the join limitation?
index=aws eventName=TerminateInstances
| Rename "requestParameters.instancesSet.items{}.instanceId" AS vm_id
| join vm_id type=left max=0
[ search index=aws source="us-west-1:ec2_instances" sourcetype="aws:description" ]
| dedup vm_id
| table _time, action, vm_id, tags.Name, userName
... View more
Labels
- Labels:
-
join
04-13-2022
05:04 AM
Thank you so much! Works perfectly!
... View more
04-12-2022
05:45 AM
I am sure I am doing something wrong but it is not working for me. Below is the full sample I am testing: <form theme="dark">
<label>Logins</label>
<fieldset submitButton="false">
<input type="time" token="selectTime">
<label>Time:</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="myApp">
<label>Application:</label>
<fieldForLabel>targetAppAlternateId</fieldForLabel>
<fieldForValue>targetAppAlternateId</fieldForValue>
<search>
<query>index=myIndex targetAppAlternateId="App1.*" OR targetAppAlternateId="App2" | dedup targetAppAlternateId
| sort by targetAppAlternateId</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
<change>
<condition match="$value$=="*"">
<set token="condition_tkn">targetAppAlternateId="App1.*" OR targetAppAlternateId="App2"</set>
</condition>
<condition>
<set token="condition_tkn">targetAppAlternateId="$value$"</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=myIndex targetAppAlternateId="$myApp$"
| stats count by targetAppAlternateId</query>
<earliest>$selectTime.earliest$</earliest>
<latest>$selectTime.latest$</latest>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">none</option>
</chart>
</panel>
</row>
</form>
... View more
04-11-2022
01:08 PM
I would like to be able to limit the 'All' option to what my query actually returns and not for * entries for targetAppAlternateId.
<form theme="dark">
<label>Logins</label>
<fieldset submitButton="false">
<input type="dropdown" token="myApp">
<label>Application:</label>
<fieldForLabel>targetAppAlternateId</fieldForLabel>
<fieldForValue>targetAppAlternateId</fieldForValue>
<search>
<query>index=myIndex targetAppAlternateId="App1.*" OR targetAppAlternateId="App2" | dedup targetAppAlternateId
| sort by targetAppAlternateId</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
</input>
Any help would be greatly appreciated.
... View more
Labels
- Labels:
-
simple XML
-
token
03-18-2022
06:54 AM
I know this is old but did you ever come up with a query that worked over time?
... View more
10-08-2020
11:15 AM
This works perfectly! Thanks!!
... View more
10-08-2020
08:08 AM
I have a very simple dynamic dropdown that lists computers by their FQDN. I have one panel that can use that token value "Failures" and I have one panel that needs the domain name stripped away "Errors." Is there an easy way to do this? <fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="TheName">
<label>Computers:</label>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>index="bfront" source="/var/log/audit/audit.log" | dedup host | table host | sort by host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="time" token="TheTime" depends="$TheName$">
<label>Time:</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel depends="$TheName$">
<title>Failures</title>
<chart>
<search>
<query>index="bfront" sourcetype="linux_audit" host="$TheName$" type=USER_LOGIN res=failed | top limit=10 acct</query>
<earliest>$TheTime.earliest$</earliest>
<latest>$TheTime.latest$</latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.placement">none</option>
<option name="charting.seriesColors">["0xf8be34","0xf8be34","0xf8be34","0xf8be34","0xf8be34"]</option>
<option name="height">260</option>
<option name="refresh.display">none</option>
</chart>
</panel>
<panel depends="$TheName$">
<title>Errors</title>
<chart>
<search>
<query> index="bront" source="/var/log/messages" host="$TheName$" eventtype=err0r | top limit=20 process</query>
<earliest>$TheTime.earliest$</earliest>
<latest>$TheTime.latest$</latest>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">all</option>
<option name="height">270</option>
<option name="refresh.display">none</option>
</chart>
</panel>
</row>
... View more
09-30-2019
09:08 AM
I currently have a dropdown that is working properly but I want to add an All selection and make it default. The problem I am running into is either it will select all items in the inputlookup or it will return nothing.
XML for working dropdown:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="ProjectName" searchWhenChanged="true">
<label>Project Name</label>
<fieldForLabel>PROJ_NAME</fieldForLabel>
<fieldForValue>PROJ_NAME</fieldForValue>
<search>
<query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
This will create a dropdown like:
Project ABC
Project DEF
Project XYZ
And yes there are spaces in the output.
I have tried something like this:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="ProjectName" searchWhenChanged="true">
<label>Project Name</label>
<fieldForLabel>PROJ_NAME</fieldForLabel>
<fieldForValue>PROJ_NAME</fieldForValue>
<search>
<query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<choice value="*">All Projects</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
But this returns ALL ProjectCodes and is not limiting it to 99*
I also tried the following:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="ProjectName" searchWhenChanged="true">
<label>Project Name</label>
<fieldForLabel>PROJ_NAME</fieldForLabel>
<fieldForValue>PROJ_NAME</fieldForValue>
<search>
<query>| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<choice value="all_projects">All Projects</choice>
<change>
<condition value="all_projects">
<set token="queryFilter">[| inputlookup assets.csv | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode | table PROJ_NAME]</set>
</condition>
<condition>
<set token="queryFilter">PROJ_NAME="$value$"</set>
</condition>
</change>
</input>
</fieldset>
This just returns nothing.
Any help would be greatly appreciated.
... View more
Labels
- Labels:
-
Dashboard Studio
09-27-2019
07:38 PM
Thanks a lot to both of you. I wish I could put Accepted to both replies.
... View more
09-27-2019
02:35 PM
1 Karma
I have the following data:
Code Area
1234.1234 ABC
9933.9933 DEF
6611.6611 GHI
8910.8910 ABC
8910.1111 ABC
Search looks like the following:
| inputlookup combined.csv | search Code=* | eval NewArea=case('AREA'="DEF","Opeth",'AREA'="GHI","Danzig") | table Code, NewArea
New output:
Code Area
1234.1234 ABC
9933.9933 Opeth
6611.6611 Danzig
8910.8910 ABC
8910.1111 ABC
What I also need to do, is if Code equals 8910.* rename it to "Tool" and if Code equals 1234.1234 rename it to "Gojira".
Code Area
1234.1234 Gojira
9933.9933 Opeth
6611.6611 Danzig
8910.8910 Tool
8910.1111 Tool
Is something like this possible?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-23-2022
10:01 AM
|
