Smart AnSwerS #42

Hey there community and welcome to the 42nd installment of Smart AnSwerS.

Last week, we had our very first SplunkTrust Virtual .conf Session, the beginning of a series of live online talks via WebEx to give users access to the best technical content presented every year at the Splunk Worldwide User Conference, .conf. Our first presenter was SplunkTrust member Martin Mueller who covered his .conf2015 session “Optimizing Splunk Knowledge Objects –  A Tale of Unintended Consequences”, followed by Q&A. We had an amazing turnout of 100+ users from different timezones around the world. Our next session #2 will be on Monday, November 23rd, 2015 @ 11:00AM PST, presented by alacercogitatus on his .conf2014 session “Lesser-known Search Commands.” We hope to “see” you there!

Check out this week’s featured Splunk Answers posts:

How do I reverse/swap characters in a string value returned from a search?

ajya_mk had a search that returned a string value, but wanted to know how to completely reverse the order or swap characters in the string. woodcock provides an awesome answer using the rex command with mode=sed to tackle both cases. With a suggestion by somesoni2 to improve the regex, these two SplunkTrust members combined their powers for an all-star answer.

Is there a way to count the number of dashboard views per day or per hour for a particular dashboard?

lbogle was looking for a way to track the use of each dashboard in her environment by counting how many times each one was viewed within a certain period of time. adityapavan18 shares a short, concise search to do just the job by looking at splunkd_access.log and using rex to extract views to run stats on.

Is there a way to “unset” a form parameter when a user deletes everything from the text input?

bruceclarke had a dashboard with a text input for users to supply an ID that would switch which panels are shown or hidden. However, after a user filled in the text input and deleted it, the form parameter wasn’t getting “unset” and was displaying the wrong panels. Splunk technical writer frobinson_splunk suggested using a condition element to control the behavior for the panel. bruceclarke had tried this before, but being reminded of that option actually helped him develop a workaround by creating a separate token to set/unset based on the input of the textbox. If you happen to know a direct solution, feel free to chime in on the post :)

Thanks for reading!

Missed out on the first forty-one Smart AnSwerS blog posts? Check ‘em out here!

Posted by