chrisforsythe / splunkstuff Goto Github PK

Write an example dashboard for chaining multiple inputs. Explanation:

What I often do is four inputs. First input has no tokens it uses. You fill in that input, which causes the next input to populate because the token it uses is finally defined. When you fill in that input, it allows the populating search of the next input to run, so the user can select their choice for that input, etc. Then, only when the last input in the chain is set can the actual search run, because it depends on a token from that last input.

It'd be nice to have a doc that outlines "these are the index names and descriptions you should be using" as well as "here is when you split an index".

Make a dashboard for splunk certifications to show how to work with different aspects of dashboards. Since the data is relevant to splunk, use the list of training courses and certifications to answer questions of:

• If I have taken these courses, which certifications can I test on.
• If I want this certification, which courses do I need
• Which courses are optional for a certification

Make some spath example snippets.

Document on setting up a heavy forwarder, when to use windows or linux, configuring roles, etc etc etc. Whatever you think is useful.

I got this error:
error: element "fieldset" not allowed here; expected the element end-tag or element "row" or "search" with a seemingly legitimate SimpleXML file.
combined-current-forecast.zip
The command is
java -jar ~/dev/utils/jing-20091111/bin/jing.jar ~/dev/utils/SplunkStuff/validation/simplexml.rng ~/dev/rail-weather-dashboard/src/combined-current-forecast.xml
The xml file zipped is attached in the next comment.

Document when does indexed field extractions help.

• If you search for a key/value pair where the value is not found in other strings (mykey=fancystringvalue): No benefit
• If you search for a value plain as a quoted string without a field ("valuehere"): No benefit
• If you search for a key/value pair where the value is commonly found in multiple keys (mykey=1): Benefit