Smart AnSwerS #6

Hello Splunkarinos and welcome to the 6th installment of Smart AnSwerS!

We just had our company Break Your New Year’s Resolution party this past weekend to start the New Year…ironically 😛 Good eats, good drinks, good music and fun people? That sounds about right to me! We’re back to business (and fun) as usual here at Splunk HQ as I’m sure you all are too – Check out this week’s featured Splunk Answers posts:

How to change the width of two dashboard panels in the first row from 50% 50% to 75% 25% in Simple XML for Splunk 6.2?

kkuderko was having an issue changing the size of panels on their dashboard, as do many users, which is why customizing Splunk Web is one of the most posted topics in the forum. Sometimes people, especially new users, don’t realize they’re recreating the wheel when there are already some awesome tools in place at their disposal. martin_mueller introduced them to the Splunk 6.x Dashboard Examples app found on apps.splunk.com which pointed kkuderko in the right direction to find their solution. If you need some examples to bounce ideas of off to customize your UI needs, this is just the recipe book for you.
http://answers.splunk.com/answers/180028/how-to-change-the-width-of-two-dashboard-panels-in.html

How to search for field values that are returned in one search that don’t appear in another search?

This is a pretty straightforward and common use case I’ve seen perusing Answers, so this may be of use to a good handful of folks out there to store away for future reference or share with other users. djconroy needed to find values for a field called SourceIP that were present in one search for a certain time range that were not found in another. Who answered the post? djconroy himself! How did he do it? With some direction from aljohnson_splunk and doing research through Splunk documentation and Splunk Answers content of course :) If you have a different approach to this scenario that worked well for you, by all means, please share.
http://answers.splunk.com/answers/186852/how-to-search-for-field-values-that-are-returned-i-1.html

How can I calculate the term frequency for all words in a field’s values?

mhqssyh needed to find the number of times all words appeared in a particular field’s values. jimodonald demonstrated what useful content you can find already floating around in Splunk Answers, just like the featured post above. His solution was inspired by an answer from yannK to a question from 3 years ago which, awesomely, was still relevant today.
http://answers.splunk.com/answers/206552/how-can-i-calculate-the-term-frequency-for-all-the.html

Thanks for tuning in folks and have a great rest of the week and even better weekend.

 

Missed out the first five Smart AnSwerS blog posts? Check em out here!
http://blogs.splunk.com/2015/01/08/smart-answers-5
http://blogs.splunk.com/2014/12/30/smart-answers-4
http://blogs.splunk.com/2014/12/18/smart-answers-3
http://blogs.splunk.com/2014/12/03/smart-answers-2
http://blogs.splunk.com/2014/11/24/smart-answers

4 Trackbacks

  1. […] out the first three Smart AnSwerS blog posts? Check ‘em out here! http://blogs.splunk.com/2015/01/15/smart-answers-6 http://blogs.splunk.com/2015/01/08/smart-answers-5 […]

  2. […] Smart AnSwerS blog posts? Check em out here! http://blogs.splunk.com/2015/01/21/smart-answers-7 http://blogs.splunk.com/2015/01/15/smart-answers-6 http://blogs.splunk.com/2015/01/08/smart-answers-5 […]

  3. […] http://blogs.splunk.com/2015/01/21/smart-answers-7 http://blogs.splunk.com/2015/01/15/smart-answers-6 http://blogs.splunk.com/2015/01/08/smart-answers-5 […]

  4. […] keyword appeared in his data, not the count of events. A similar scenario was featured in a previous Smart AnSwerS post, but martin_mueller creates a search on the raw data without using the mvexpand command to apply […]