Smart AnSwerS #6

Hello Splunkarinos and welcome to the 6th installment of Smart AnSwerS!

We just had our company Break Your New Year’s Resolution party this past weekend to start the New Year…ironically 😛 Good eats, good drinks, good music and fun people? That sounds about right to me! We’re back to business (and fun) as usual here at Splunk HQ as I’m sure you all are too – Check out this week’s featured Splunk Answers posts:

How to change the width of two dashboard panels in the first row from 50% 50% to 75% 25% in Simple XML for Splunk 6.2?

kkuderko was having an issue changing the size of panels on their dashboard, as do many users, which is why customizing Splunk Web is one of the most posted topics in the forum. Sometimes people, especially new users, don’t realize they’re recreating the wheel when there are already some awesome tools in place at their disposal. martin_mueller introduced them to the Splunk 6.x Dashboard Examples app found on apps.splunk.com which pointed kkuderko in the right direction to find their solution. If you need some examples to bounce ideas of off to customize your UI needs, this is just the recipe book for you.

How to search for field values that are returned in one search that don’t appear in another search?

This is a pretty straightforward and common use case I’ve seen perusing Answers, so this may be of use to a good handful of folks out there to store away for future reference or share with other users. djconroy needed to find values for a field called SourceIP that were present in one search for a certain time range that were not found in another. Who answered the post? djconroy himself! How did he do it? With some direction from aljohnson_splunk and doing research through Splunk documentation and Splunk Answers content of course :) If you have a different approach to this scenario that worked well for you, by all means, please share.

How can I calculate the term frequency for all words in a field’s values?

mhqssyh needed to find the number of times all words appeared in a particular field’s values. jimodonald demonstrated what useful content you can find already floating around in Splunk Answers, just like the featured post above. His solution was inspired by an answer from yannK to a question from 3 years ago which, awesomely, was still relevant today.

Thanks for tuning in folks and have a great rest of the week and even better weekend.


Missed out the first five Smart AnSwerS blog posts? Check em out here!

Patrick Pablo
Posted by

Patrick Pablo

Born and raised in Los Angeles, Patrick made his way up north for college and fell in love with the Bay Area, making it his second home. After working 5 years for a non-profit as a college & career counselor in San Francisco public high schools, he stumbled across a new career opportunity himself! Patrick found a new way to apply his community organizing background in a way he didn’t know was possible at Splunk.

Join the Discussion