All Apps and Add-ons

Issue with OMS JSON Query

eskarthi
New Member

Hello,

Nowadays we are relaying on OMS query for pulling data into Splunk, however i have noticed some gaps in the OMS - Json query.

For example : we are querying azure activity for every hour and we got some intermittent network disconnection/timeout error for sometime. Once the network connection was resumed the oms connector is not pulling the data from where it left .

Technically the script is constructing values in end,start parameters for extracting the query, however OMS/Log Analytics is not listening to the value we set in end,top,start parameters, it takes only the "query" parameter and execute.

{"query": "AzureActivity | where TimeGenerated > ago(1h)", "end": "2019-05-01T00:00:00", "top": "1", "start": "2019-05-01T11:21:56"}

Furthermore, I have tested the above query using postman utility and the OMS is ignoring those values and i don't know why we are sending those values to Azure ?

is there any way to fix the intermittent connection issues in code ? Please advise.

Thanks
Karthik

0 Karma

jkat54
SplunkTrust
SplunkTrust

The app is a concept app based on the original OMS query language. The API the app used has been changed significantly.

If you can suggest any edits to code, I'd love to make patches for you and the community when I can.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...