Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About hrs2019
hrs2019
Path Finder
Member since:
12-15-2019
08-18-2022
Community Statistics
| Posts | 60 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 3 |
| Member Since | 12-15-2019 |
Activity Feed
- Posted Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA on Splunk Search. 11-13-2021 08:35 AM
- Posted Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA on Splunk Search. 11-13-2021 08:34 AM
- Posted HOW TO GET FULL NAME USING REGEX FROM RAW DATA on Splunk Search. 11-13-2021 07:11 AM
- Posted Re: How to use link list option as a plus button on Dashboards & Visualizations. 08-10-2020 02:51 AM
- Posted Re: How to use link list option as a plus button on Dashboards & Visualizations. 08-09-2020 05:39 AM
- Posted How to use link list option as a plus button on Dashboards & Visualizations. 07-31-2020 05:00 AM
- Karma Re: How to create a text box using condition for niketn. 07-18-2020 08:30 AM
- Posted Re: How to create a text box using condition on Dashboards & Visualizations. 07-18-2020 06:16 AM
- Posted How to create a text box using condition on Dashboards & Visualizations. 07-16-2020 01:03 PM
- Posted How to set a flag in splunk using lookup. on Splunk Enterprise. 06-17-2020 12:22 AM
- Posted Re: custom row expansion on Splunk Dev. 06-14-2020 02:44 AM
- Posted Re: How to add + button for drilldown to detail panel on Dashboards & Visualizations. 06-14-2020 02:21 AM
- Posted How to add + button for drilldown to detail panel on Dashboards & Visualizations. 06-10-2020 11:49 AM
- Karma Re: How to use glowing/flashing button using CSS/HTML for niketn. 06-05-2020 12:51 AM
- Got Karma for Re: How i can Add tooltip to panel on a hover. 06-05-2020 12:51 AM
- Got Karma for Re: How to use glowing/flashing button using CSS/HTML. 06-05-2020 12:51 AM
- Got Karma for Re: How to use glowing/flashing button using CSS/HTML. 06-05-2020 12:51 AM
- Posted Re: How to extract a key and value from the json data? on Splunk Search. 06-01-2020 09:59 AM
- Posted How to extract a key and value from the json data? on Splunk Search. 06-01-2020 07:19 AM
- Tagged How to extract a key and value from the json data? on Splunk Search. 06-01-2020 07:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-13-2021
08:34 AM
@PickleRick Thanks for your reply i have added the screenshot for my output please have a look and the log also.
... View more
- Tags:
- k
11-13-2021
07:11 AM
Hello How i can get the full name from log ie. Name=Busaram Manjraj i am trying with this regex |rex field=-_raw "(?<Name>[^&]+)\s*\d*" but it is giving just Name=Busaram not the full name. Splunk raw data looks like Name=Busaram, Manjraj
... View more
08-10-2020
02:51 AM
@niketn Thankyou so much for your reply. When I am Popping one URL from text box to table the token value in the text box is not getting refreshed and the same value remains there, I want to remove the token value once it's added to the table and I want to use up to 5 URLs( 5 rows). Here are my inline comment 1. When you start, will you have up to 5 URLs in the Text Box (comma separated). No one by one I need to enter. up to by URLs. 2. Then when you click on Plus one URL will be popped from Text Box and will appear as a row in the table. Yes 3. So on till the last URL is removed from Text Box to Table? yes.
... View more
08-09-2020
05:39 AM
@niketn thanks for your reply. Yes, I want to add selected text box values to the table one by one up to five rows. like- 1. https://www.app1.com 2. https://www.app2.com 3. https://www.app3.com 4. https://www.app4.com 5. https://www.app5.com And each time On click of + button selected text box values will add to the table and after that tex box Token Reset. For Text Box Token Reset I was referring your one solution but stuck in between. post link- https://community.splunk.com/t5/Archive/How-do-you-reset-a-dashboard-field-after-hitting-the-submit/m-p/379877 Can you pls suggest how I can achieve that. Please let me know if you need any other details. Thank you so much for all the Splunk answers solutions that are provided by you.
... View more
07-31-2020
05:00 AM
my Requmient is After entering the URL details in the text box, if the user selects the plus button(right side +) it ll update in the below table. Users have the option to enter URL up to 5 times. Can anyone pls suggest some solution. Below is the code what I am using <form theme="dark">
<label>Text Box Validation</label>
<search>
<query>| makeresults
| eval url="$url$"
| eval url_count=split(trim(url),",")
| rex field=url "(?<url_type>(https|http))" max_match=0
| eval boolValidationURLCount=case(mvcount(url_count)<=5,"true",true(),"false")
| eval boolValidationURLCondition=case(url_type="https" AND url_type!="http","true",true(),"false")</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<done>
<condition match="$result.boolValidationURLCount$=="true" AND $result.boolValidationURLCondition$=="true"">
<set token="tokValidURLs">$result.url$</set>
</condition>
<condition match="$result.boolValidationURLCount$=="false" AND $result.boolValidationURLCondition$=="false"">
<set token="tokValidationError">Only upto 5 URLs allowed. URL must start with https</set>
<unset token="tokValidURLs"></unset>
</condition>
<condition match="$result.boolValidationURLCount$=="false" AND $result.boolValidationURLCondition$=="true"">
<set token="tokValidationError">Only upto 5 URLs allowed.</set>
<unset token="tokValidURLs"></unset>
</condition>
<condition match="$result.boolValidationURLCount$=="true" AND $result.boolValidationURLCondition$=="false"">
<set token="tokValidationError">URLs must start with https</set>
<unset token="tokValidURLs"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<!-- <html>
<a class="btn btn-primary" align="right" role="button" style="position:absoluate; left:0.0%;">+</a>
</html>-->
<input id="splunk_input_text_url" type="text" token="url" searchWhenChanged="true">
<label>Enter Upto 5 URLs (https ONLY)</label>
<default>https://www.facebook.com</default>
</input>
<input type="link" id="buton" token="plusbutton">
<label></label>
<choice value="+">+</choice>
</input>
</panel>
</row>
<row>
<panel>
<html rejects="$tokValidURLs$">
<style>
#splunk_input_text_url{
width: 1220px !important;
}
#buton{
width: 50px !important;
}
</style>
<div>
<b style="color:red">$tokValidationError$.</b>
</div>
<div>
Please validate input <b style="color:red">$url$</b>!!!
</div>
</html>
<table depends="$tokValidURLs$">
<title>Table with valid URLs</title>
<search depends="$tokValidURLs$">
<query>| makeresults
| fields - _time
| eval URL="$tokValidURLs$"
| makemv URL delim=","
| mvexpand URL
| rex field=URL "(?<URL_Type>(https|http))"
| table URL, URL_Type</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
chart
-
panel
-
trellis layout
07-18-2020
06:16 AM
Hi, @niketn Thank You so much for your solution. Actually I am getting one issue that needs your help. While entering the URL 1 it shows URL1 in the panel which is correct, but while entering URL 2 it shows only Url 2, ideally it has to show both the URLs. This is applicable for 5 URLs as we have set the condition. If any URL is missing https//: it ll not allow and ll not display in the panel. Can you please help me to fix this. I have added the screenshot for more info.
... View more
07-16-2020
01:03 PM
Hello How to create the text box with the condition for Accepting user input only if the URL starts from https://somthinglike.com. if any user enters www.facebook.com it ll not consider or save to the text box because https is missing. Need to implement 1.URL condition. 2. Only 5 URL allow Below is the screenshort
... View more
Labels
- Labels:
-
table
06-17-2020
12:22 AM
Hello everyone, i am trying to achieve below logic | set a flag called <adminuser> if current user ID is present in lookup (in the lookup 4 name is there AAP1 APP2 AAP3) | if adminuser is False, then filter where Requestor in event is <current user ID> else do not filter |table "Requested Date" "ID" "Requestor" "MD" "SM" "SL" Status My XML code is index=* sourcetype="testapp" |eval split=split(Requestor, "@"), Requestor=mvindex(split, 0)
| eval "Requested Date" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| Get current user ID = (| rest /services/authentication/current-context splunk_server=local | rename username as Requestor |eval split=split(Requestor, "@"), Requestor=mvindex(split, 0))
| set a flag called <adminuser> if current user ID is present in lookup (in the lookup 4 name is there AAP1 APP2 AAP3)
| if adminuser is False, then filter where Requestor in event is <current user ID> else do not filter
|table "Requested Date" "ID" "Requestor" "MD" "SM" "SL" Status @niketn do you have any idea how to achieve the above logic
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-14-2020
02:44 AM
@vnravikumar can we use the same custom row expansion logic using XML /HTML/CSS. Since I don't have access to upload JS file in Splunk so looking for same solution in XML/HTML/CSS?
... View more
06-14-2020
02:21 AM
@niketnilay Again Thanks for your answer but i am looking solution in XML /CSS /HTML because I don't have access to download ( Splunk Dashboard Examples ) app as you mention the below solution. I don't have permission to upload any JS file also.....
... View more
06-10-2020
11:49 AM
How to add + button for log details. if user select + button the log tab with details will open and display as per Screenshot. Need to add two condition here 1.If user select + button it ll expend 2.If user select - button it ll hided the log details. index=test1 sourcetype=app1 |table ID Request CD SMSL Date status I don't have permission to add JS file. So looking for solution in XML/HTMl/CSS
... View more
Labels
- Labels:
-
CSS
-
drilldown
-
panel
-
trellis layout
06-01-2020
09:59 AM
@reed.kelly Thanks for your help
Actually the data is already index in Splunk and I can't modify the JSON file.
I want to use the existing data and try to fetch the filed name with that output.
is there is any way?
I can list the data till "success_criterion" but after that, I can't
... View more
06-01-2020
07:19 AM
Hi all, I am not able to extract the below-given value from the JSON file
fields are
"initiator": test_abce,
"releasenumber":0.0.11,
"source": "test420",
"deployenv": testppt,
"ServiceMD": app
"ServiceManager": app1
"ServiceLead": app2
I
I am attaching the screenshot for more information there is space i thing that is causing the issue i tried to add the field name also in my query like source name......... releasenumber source |table releasenumber source deployenv ServiceMD ServiceManager
Am not able to list the data which all are in yellow color
JSON File.
{
"Pirid" : 7965,
"url": "https://connects.test.com/home",
"id": 88,
"level": "202",
"guideline": "2.4",
"help": {
"description": "testid"
},
"pagestest1" : 0,
"pagestest2": 0,
"pagestest3": 1,
"principle": 2,
"severity": "review",
"success_criterion": "2.4.10",
"initiator": test_abce,
"releasenumber":0.0.11,
"source": "test420",
"deployenv": testppt,
"ServiceMD": app
"ServiceManager": app1
"ServiceLead": app2
"success_criterion_title": "Section",
"more_details": "https://api.test",
"ApplicationNm": "Connects",
"_links": {
"pages": {
"href": "https://api/pages"
},
"progress": {
"history": {
"pages": "https://api./history"
}
}
}
}
... View more
Labels
- Labels:
-
field extraction
-
fields
05-25-2020
08:09 AM
@richgalloway for recent events check i want only the one top event which is submitted recently
... View more
05-25-2020
07:30 AM
Hi Thanks for your reply @richgalloway
no, it is not working after adding 1000 for the top. append lookup is not creating any field more than 10 .
actually I am using this lookup for bot status.
i am using the submit button to save the status info. (disconnected or connected)
i have added the screenshot also
... View more
05-25-2020
06:55 AM
II am using this lookup for bot status.
I am using the "submit" button to save the status info. (disconnected or connected)
I have added a screenshot:
| inputlookup status.csv
| append [ makeresults | eval Time= strftime(_time,"%Y-%m-%d %H:%M:%S")
| eval "DI Name"="I9", "Bot Name"="CD1","Support poc"="sam","Support Team"="IA",Status="disconnected"]
| top "DI Name" "Bot Name" "Support poc" "Support Team" Status Time
| table "DI Name" "Bot Name" "Support poc" "Support Team" Status Time
| outputlookup status.csv
| head 1
... View more
05-21-2020
01:08 AM
thanks @gcusello
Actually, my requirement is to get these 510 events where the key matches the new key.
Also to get 510 events where the key-value matches the new key generated
in subquery where only generates a list of latest url_time combination as a new key
index="yut" sourcetype="test" cd IN(*) level="rrr" severity="error"
| eval evtdate = strftime(_time,"%Y-%m-%d")
| eval CD=cd
| eval key=_time + url (this query is giveing me 504 key)
| append ----------------( want to use here append)
[ search index="yut" sourcetype="test" cd IN (*) severity="error" | eval CD=cd
| eval evtdatein = strftime(_time,"%Y-%m-%d")
| sort by _time desc
| dedup url | eval newkey=_time + url
| table newkey] --------------(this query is giving me 6 newkeys)
... View more
05-20-2020
10:14 PM
Hello everyone,
I just want to use append instead of a join.
My code is
index="yut" sourcetype="test" cd IN(*) level="rrr" severity="error" | eval evtdate = strftime(_time,"%Y-%m-%d")
| eval CD=cd | eval key=_time + url | table key ------(this query is giveing me 504 key)
| append ----------------( want to use here append)
[ search index="yut" sourcetype="test" cd IN (*) severity="error" | eval CD=cd
| eval evtdatein = strftime(_time,"%Y-%m-%d")
| sort by _time desc
| dedup url | eval newkey=_time + url
| table newkey] --------------(this query is giving me 6 newkeys)
| eventstats values(newkey) as UniqueKeys | search key IN UniqueKeys
want to add all 504 +6 = 510 key and remove the duplicate key from the 504
... View more
05-20-2020
05:33 AM
Thanks @niketnilay it is working
... View more
05-20-2020
05:23 AM
How to change the table color according to the below image. I have used multiple colors in different tables it is now showing like the given image the table border is not showing properly.
just want to use the same as the below image.
... View more
05-17-2020
03:58 AM
1 Karma
Thanks again @niketnilay it is working i have tested in my local splunk.
But i don't have admin access in my office splunk enterprise so i can't upload JS file there.
just want to know do we have any option using CSS? without uploading JS file.
... View more
05-14-2020
04:26 AM
@niketnilay if i want to use gif instead of connected or disconnected how i can add in cleavel.
gif link is
https://github.com/hemraj26/test/blob/master/red.gif
https://github.com/hemraj26/test/blob/master/yellow.gif
... View more
05-14-2020
03:07 AM
@niketnilay Thanks for your all help.
... View more
05-13-2020
11:11 PM
@niketnilay Yaah got it thanks again,
just one more help i need if we have 0 out put for any panel in given time i just want to use a message like "data is not available"
panel 1 panle 2 panel 3
0 0 0
my requirement
panel 1 panle 2 panel 3
data is not available" data is not available" data is not available"
... View more
