Splunk Search

spl2 module upload successful, and testing is also successful but it's nowhere to be found.

kundeng
Path Finder

Am I missing something?  

I have vscode running splunk extension and created a simple _default.spl2nb.  

I'm able to testing it and getting results back, and uploading to the search app or a custom app spl2-test also gives me success message. 

But when I go to the splunk deployment <app>/default/data.  I don't see spl2 folder at all. 

What's going on?  Thanks. 


Labels (1)
Tags (1)
0 Karma

kundeng
Path Finder

I don't know why I have to run the following, and the spl2 file shows up.  

~/splunk/bin/splunk download-spl2-modules app spl2-test -dest default

 But still, I am getting error when I try to run

|@spl2 from search1



Error in 'SearchParser': The SPL2 query is invalid: 'unknown error: Unable to fetch roles for the user'.
0 Karma

kundeng
Path Finder

I will answer my own question:
* spl2 currently still uses kv-store and file sync implementation is neither complete nor fully functional as of today. 
* one needs to apply enterprise license for spl2 to be enabled. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...