About genesiusj

genesiusj · ‎03-22-2023

Hello, I downloaded and installed Splunk Enterprise 9.x on my laptop. I am creating a Studio Dashboard and experiencing an issue with images. I am using a token in the image path to change the image based on a dropdown input. Therefore, the images can't be held in the kvstore. They must remain local to my PC. In my production environment at work, RedHat, this works. The image path - within the DS Configuration Pane - is /en-US/static/app/search/images Although the path on the Linux server is really etc/apps/search/appserver/static/images Splunk manipulates the path name in some strange way. apps becomes app, static is placed before the search (the app name). I am using Windows on my laptop, and I can't figure out the correct path for the image URL. The Windows path for these images is C:\Program Files\Splunk\etc\apps\search\appserver\static\images What is Dashboard Studio Splunk-Speak for this path in Windows? Thanks in advance for your help. God bless, Genesius

genesiusj · ‎03-21-2023

TY @bowesmana That is not the case. The searches for both dropdowns are the same inputlookup* file; one dropdown is one field, and the other is the other. But only one of the dropdowns has the filter box. *Have to use inputlookup and not index because data is originating from dbconnect. The second dropdown (displays the filter box) is text. The first dropdown is a number (no filter box displayed). I converted to a string (added AAA in front of the number), but this did not work either. Each dropdown search includes one of these | search fieldA=$fieldA_from_other_dropdown$ | search fieldB=$fieldB_from_other_dropdown$ I also tried reversing the order of the dropdowns in the dashboard. But this did not fix the issue. Thanks for any guidance you can provide. God bless, Genesius

genesiusj · ‎03-20-2023

Hello, Why do some dropdowns have a filter box and others don't? Are there options on the <input type="dropdown"...> tag that needs to be set? What other options are available for dropdowns? Thanks and God bless, Genesius

genesiusj · ‎03-10-2023

Hello, Is it possible to create indexed fields on log files uploaded from my PC? The log file is tens of thousands of records. I need to index two of the fields in order to run tstats against them. Running a normal search and extracting these two fields (and others) at search time is not efficient. If these two fields were indexed I could run searches with tstats much, much faster. Thanks in advance and God bless, Genesius

genesiusj · ‎02-10-2023

Hello, Our use case is to add a viz which is a URL for an interactive map. New Jersey County Map This map should be displayed on the dashboard at all times. When a user clicks on any County, a data table will open in the lower left of the window/panel/viz. Tried inserting it as an image, and changed the domain for images in the web.conf. dashboards_csp_allowed_domains = *.njogis-newjersey.opendata.arcgis.com But since it is not really an image, but an image rendered on a webpage, this didn't work - received this error. With Classic DB we used I-Frame on occasion. But this was kludgy at best. We haven't worked with REST API. But could that be a possible solution? Thanks in advance and God bless, Genesius

genesiusj · ‎02-02-2023

@PaulPanther Apologies for the delay in replying. Priorities constantly shift where I work. I did not try with Example 1 because the cell color needs to change after the results from the search appear on the dashboard. They are not the result of an input (no token to be set). Concerning Example 2. Is user the column name where the string is to be found? Here is my code. I'm only using one color to match. Since every cell contains the string CPU the cell should be changed to that color. Once I know that works, then I can add other colors and other values for those colors. "viz_tiles_3": { "type": "splunk.table", "title": "Hyper-V Host Max Metrics - 3", "dataSources": { "primary": "ds_main_tiles" }, "options": { "hypervHostMaxMetrics": { "data": "> table | seriesByName(\"hypervHostMaxMetrics\") | formatByType(hypervHostMaxMetrics_ColumnFormatEditorConfig)", "rowColors": "> table | seriesByName('hypervHostMaxMetrics') | pick(hypervHostMaxMetrics_RowColorsEditorConfig)", "rowBackgroundColors": "> table | seriesByName(\"hypervHostMaxMetrics\") | matchValue(hypervHostMaxMetrics_RowBackgroundColorsEditorConfig)" } }, "context": { "hypervHostMaxMetrics_ColumnFormatEditorConfig": { "string": { "unitPosition": "after" } }, "hypervHostMaxMetrics_RowColorsEditorConfig": [ "#b5b5b5" ], "hypervHostMaxMetrics_RowBackgroundColorsEditorConfig": [ { "match": "CPU", "value": "#5C33FF" } ], "someValue": "> primary | seriesByIndex(0) | lastPoint()" } } Thanks and God bless, Genesius

genesiusj · ‎02-01-2023

Hello, The Subject pretty much says what I am looking for. I am new, 3 weeks in, to Dashboard Studio. One of the (many) functionalities(?) missing is the ability to show and hide visualizations. Has anyone figured out a workaround or band-aid in the JSON, or some other override? Thanks in advance and God bless, Genesius

genesiusj · ‎01-27-2023

@PaulPanther Thank you. I will check these out and get back to you after the weekend. God bless, Genesius

genesiusj · ‎01-23-2023

@PaulPanther In Studio, using a case statement in the SPL results with an additional value in the field. I use a case statement in Classic; however, this is within the format tags. No additional values. I could perhaps modify this value's font color to the color of the overall cell based on the case statement. Hmmm! Let me think about that one. Thanks and God bless, Genesius

genesiusj · ‎01-20-2023

@PaulPanther Many questions. My code did not work. "viz_qRFCeLJ6": { "type": "splunk.table", "options": { "columnFormat": { "Tags": { "rowBackgroundColors": "> table | seriesByName('hypervHostMaxMetrics') | matchValue(hypervHostMaxMetricsRowBackgroundColorsEditorConfig)" } } }, "context": { "hypervHostMaxMetricsRowBackgroundColorsEditorConfig": [ { "match": "*S1*", "value": "#1F4D5B" }, { "match": "*S2*", "value": "#D81E5B" } ] }, How do I search for wildcards? From my original post, the data will look something like this: HOST-S1-123456 CPU 30.0% W MEM 14.0% N NET 85.0% C Because hypervHostMaxMetrics contains at least 1 occurrence of % C, the background should be red. If there were no % C, but at least 1 occurrence of %W, the background should be orange. And if there are no occurrences of % C and no occurrences of % W, meaning there are 3 occurrences of % N, the background should be green. In the above-supplied code, I am using the S1 or S2 as these are in the HOST because there is only one occurrence of either of these per cell. Where the % C, W, N might have 1, 2, or 3 occurrences. troubleshooting wildcards and not the occurrences of the match. I am only using the json for rowBackgroundColors, rowColors, and countRowColorsEditorConfig pertaining to the string. The numeric color formatting is not required. In Classic I used the <format> tags to select the color based on the % C, W, or N using a case statement/command. <format type="color" field="Hyper-V Host Max Metrics"> <colorPalette type="expression">case (match(value,"% C"), "#FF0000",match(value,"% W"), "#FFA500",match(value,"% N"), "#008000")</colorPalette> </format> How do I do the same in DS? I changed match to matchValue as explained in the Selector and formatting functions page I referred to in the original post. But this did not work either. Thanks again for your help. God bless, Genesius

genesiusj · ‎01-20-2023

@PaulPanther I'm going to show some love right now and hand out the karma. I will hopefully get a chance today to review and implement it, and mark as the resolution. Always something going on. As I told my staff this morning. " I didn't know, 😋 , we had a DS Examples app. Reel Cool!" Thanks and God bless, Genesius

genesiusj · ‎01-19-2023

Hello, Using dashboard studio (DS), and having an issue formatting a table with a single column based on its value. The field values look something like this. CPU: 37.1% C MEM: 60.2% W NET: 3.6% N Here is the pseudocode for selecting the background color of the cell based on its value. If the value contains at least one "% C" the background color of the cell needs to be red. Else if the value contains at least one "% W", the background color of the cell needs to be yellow. Else if the value does not contain "% C" AND does not contain "% W", the background color of the cell needs to be green. End if. According to some web page I read about DS, you cannot perform any inline CSS or JS functions. I don't believe I need JS for this simple use case. I read here, Selector and formatting functions, that I can use matchValue(). After resolving all the json errors (brackets and braces missing), no change in the color of cell background. Thanks in advance and God bless, Genesius

genesiusj · ‎12-14-2022

Hello, I need to generate a 1000+ records (5-10 fields) fake PII. What Best Practices, SPL, process have you designed to create via | makeresults or lookups/kvstores? Thanks and God bless, Genesius

genesiusj · ‎12-13-2022

Hello,, I have installed the Hyper-V TA on our search head and our heavy forwarders. There was a Splunkbase app called Splunk for Server Virtualization, but it was retired. What have Splunkers used for creating visualizations of this data? Thanks and God bless, Genesius

genesiusj · ‎11-09-2022

@starcher Thanks. I figured as much, but no harm in asking. God bless, Genesius

genesiusj · ‎11-07-2022

Hello, Currently, our client receives daily emails with the data from the CSV file embedded in the email. Is there a Splunk-only process for encrypting the email after embedding; or, encrypting the attached CSV file? We know how to encrypt at the OS level, but want to know if can be done via Splunk only. Example CSV file Name Address State...... John Smith 123 B'way, NY Betty Boop 456 Main Street, NJ etc... Thanks in advance and God bless, Genesius

genesiusj · ‎10-21-2022

Hello, Quick question. How do I change the default number of lines to return in search? Is there a setting in limits.conf? index=_audit action=search AND search!=*_internal* AND search!=*_audit* AND user="user1" The linecount max is 128. My larger search values return with ...(truncated)', autojo... in the _raw. Thanks in advance and God bless.

genesiusj · ‎10-13-2022

Hello, Is it possible to control timed access to a dashboard or a knowledge object? I do not include the SPL here because I don't believe it is needed at this time. We have a dashboard populated from the results of several outputlookup files run at 5:00 in the morning every day. The users of this dashboard have been advised to not use the dashboard until 5:45 am. However, it is still possible that they could. As all the outputlookup files are not in place until approx 5:40, the results on the dashboard might be incomplete or totally inaccurate. Is there a way to control timed access to the dashboard? Thanks and God bless, Genesius

genesiusj · ‎09-13-2022

Thanks, @richgalloway That is pretty much what I am doing when I am using Splunk against log data. The problem is I need to search through millions of database records. The number of db records needs to be limited to just those containing the values found before I table them. Otherwise, the dbxquery or dbxlookup commands will take 20, 30 or minutes to complete. Thanks and God bless, Genesius

genesiusj · ‎09-13-2022

Hello, Need to perform a search using a list of values and I do not know the field names. In Splunk, this works. index=employees AND (123456789 OR SMITH OR "1 MAIN STREET") | table * In SQL I can do this. Note: These are not my table or field names. This is an example from the Internet. DECLARE @ColName varchar(126) = 'col_name' DECLARE @ColVal varchar(64) = 'col_val' DECLARE @SQL AS nvarchar(MAX) SET @SQL = '' SELECT @SQL = @SQL + 'SELECT * FROM ' + IST.TABLE_SCHEMA + '.' + IST.TABLE_NAME +' where '+ @ColName +' = '''+ @ColVal +''' ' + CHAR(13) FROM INFORMATION_SCHEMA.TABLES IST INNER JOIN INFORMATION_SCHEMA.COLUMNS ISC ON IST.TABLE_NAME = ISC.TABLE_NAME WHERE ISC.COLUMN_NAME = @ColName EXEC (@SQL) Is it possible to write the above for DBConnect? Thanks and God bless, Genesius

genesiusj · ‎07-15-2022

Hello, We are using Splunk v8.2.5 (Build:77015bc7a462 if this helps). Since we upgraded we no longer receive errors or warnings when stats, eventstats, or streamstats is not returning the correct values. We have a lookup csv of nearly 3 million records containing several fields that need to be counted and compared: prize code, address, email, etc. The eventstats command fails and there is no error or warning. However, the stats command works. This would be okay if we had only one field to be counted. We have 4-8 fields that must be counted and compared. Using the stats command quickly becomes a nightmare because every field that is not being counted in relation to the particular field in the by clause would need to be added using values(FIELDNAME). The eventstats command would be cleaner. Or would it? | bin _time span=1d | eventstats count(prize_code) as count_prize_code by _time, address | dedup address, count_prize_code, _time | eventstats count(_time) as count_prize_code_dates, sum(count_prize_code) as sum_count_prize_code by address | dedup address, count_prize_code_dates, sum_count_prize_code | table address, count_prize_code_dates, sum_count_prize_code Thanks and God bless, Genesius

genesiusj · ‎07-07-2022

Hello, We have a lookup/kvstore containing over 3.M records*. We need to count the number of times each value is found over all of the records. Ex: Count the occurrence of the same LAST_NAME Field Name: LAST_NAME Values: JONES, SMITH, DAVIS, GARCIA Counters Values: 12, 34, 16, 23 This is just one of several different counters: BIRTH_YEAR, CITY, STATE, etc. Because of the limits within Splunk, this code would result in blanks and inaccurate counts. | eventstats count(ID) as count_same_city by CITY Any suggestions? * The number of records increases by 10K every week. Thanks in advance, and God bless, Genesius

genesiusj · ‎07-01-2022

Hello, Trying to find an efficient way to take the results from a dbxlookup - where a single userID would bring back more than one record, - into multiple multiple row output. Example: I have a list of 10 userIDs and run a dbxlookup against a d/b containing login/logout times. I want to see how many times each userID logged in/out, as well as their first login/out of the month, and their most recent login/out. I will supply my SPL shortly, but I wanted to see if anyone might have experienced this issue in the past and has a solution. Thanks and God bless, Genesius

genesiusj · ‎03-29-2022

I figured out the solution. Use eval instead of set in the <condition>. Then use relative_time and time modifiers. See the final input XML code below (showing only one condition for brevity). <input type="radio" token="tok_toggleTime"> <label>Select preset days</label> <choice value="ThM">Last Thursday to Monday</choice> : : <change> <condition value="ThM"> <set token="tok_fromTime1">06:45:00</set> <set token="tok_toTime1">06:45:00</set> <eval token="tok_fromDate1">strftime(relative_time(now(),"@w-3d"),"%Y-%m-%d")</eval> <eval token="tok_toDate1">strftime(relative_time(now(),"@w+1d"),"%Y-%m-%d")</eval> </condition> </change> </input> Thanks and God bless, Genesius

genesiusj · ‎03-28-2022

Hello, Need to create a date/time token for a dbxlookup. The default values for start needs to be Thursday from the previous week, and the end needs to be Monday from the current week. Here is the dbxlookup command. | dbxquery connection="SPLUNK" maxrows=0 query="select * from VW_SPLUNK where to_date (TO_CHAR (create_date_time, 'yyyy-mm-dd hh24:mi:ss'), 'yyyy-mm-dd hh24:mi:ss') between to_date ('$tokFromDate1$ $tok_startTime$','yyyy-mm-dd hh24:mi:ss') AND to_date ('$tokToDate1$ $tok_EndTime$','yyyy-mm-dd hh24:mi:ss') " Here is the XML I have for the tokens. <input type="radio" token="tok_toggleTime"> <label>Select date: Thu-Mon vs Mon-Thu</label> <choice value="ThM">Last Thursday to Monday</choice> <choice value="MTh">Last Monday to Thursday</choice> <change> <condition value="ThM"> <set token="tok_startTime1">06:45:00</set> <set token="tok_endTime1">09:30:00</set> <set token="tok_textStartTime">1</set> <set token="tokFromDate1">@w0-3d</set> <set token="tokToDate1">@w0+1d</set> </condition> <condition value="MTh"> <set token="tok_startTime1">06:45:00</set> <set token="tok_endTime1">09:30:00</set> <set token="tok_textEndTime">1</set> <set token="tokFromDate1">@w0+1d</set> <set token="tokToDate1">@w0-3d</set> </condition> </change> </input> <input type="text" token="tok_startTime" searchWhenChanged="true"> <label>Start Time - Can enter new time</label> <default>$tok_startTime1$</default> <suffix/> </input> <input type="text" token="tok_endTime" searchWhenChanged="true"> <label>End Time - Can enter new time</label> <default>$tok_endTime1$</default> <suffix/> </input> Thanks and God bless, Genesius

Posts	282
Solutions	11
Karma Given	33
Karma Received	16
Member Since	‎07-06-2018

Online Status	Offline
Date Last Visited	‎12-19-2024 12:28 PM

Fuzzy Match Between Two LARGE Lookups

Classic Dashboard - need line breaks in select cel...

Running SPL via Visual Studio Code

Calculate the sum of values that overlap

Splunk and Visual Studio Code

How to correct colors in Dashboard Studio?

Parsing Windows Logs

How would I search what records are in the larger ...

Any Splunkers who can share ALL of the <option nam...

Splunk Enterprise (Free Version) Image Path

Splunk Enterprise (Free Version) Image Path

Re: Why Do Some Dropdowns (Classic) Have a Filter ...

Why do some dropdowns (classic) have a filter box,...

Is it possible to create indexed fields on log fil...

Dashboard Studio - Interactive Viz URL

Re: How to format a table column based on its valu...

Has anyone figured a workaround for not having DEP...

Re: How to format a table column based on its valu...

Re: How to format a table column based on its valu...

Re: How to format a table column based on its valu...

Re: How to format a table column based on its valu...

How to format a table column based on its value us...

What are some best practices for creating large da...

Hyper-V TA Installed on SH and UF's- What have Spl...

Re: Is there a Splunk-only process for encrypting ...

Is there a Splunk-only process for encrypting the ...

How to change the default linecount for "search" f...

Is it possible to control timed access to a dashbo...

Re: How do I search for unknown columns using DB C...

How do I search for unknown columns using DB Conne...

Since upgrading, why are there no errors when even...

How to create a search to count Millions of Record...

How to Convert dbxlookup results of one to many

Re: How to create time/date token for a dbxlookup?

How to create time/date token for a dbxlookup?