I've got the Add-on for Atlassian JIRA Service Desk alert action plugin installed (https://splunkbase.splunk.com/app/4958/) on my search head cluster so I can create tickets from searches and alerts however I am having trouble getting the TA to talk to JIRA. I've created an internal JIRA user on our JIRA deployment, validated the credentials work by logging into JIRA with them, so I know my credentials are okay. The configuration section in the TA accepts the credentials. However, when I go to the app and ask it to show me projects or, for that matter, anything, it returns 0 projects and 0 results. All the canned reports return a Python error in the UI. Following a different thread I checked the troubleshooting steps at https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/troubleshoot.html where it specifically talks about Python errors and how that tends to me there is a connectivity issue or credential issue. I ran the curl commands from the search head I was connected to and it can successfully connect to JIRA and pull data back!  [root@splunk-head-2 ~]# curl -k https://jira.mystuff.com/rest/api/latest/project --user prodsec-splunk Enter host password for user 'prodsec-splunk': [{"expand":"description,lead,url,projectKeys","self":"https://jira.mystuff.com/rest/api/2/project/15334","id":"15334","key":"VFR","name":" Vermin Feature Request","avatarUrls":{"48x48":"https://jira.mystuff.com/secure/projectavatar?avatarId=15163","24x24":"https://jira.mystuff.com/secure/projectavatar?size=small&avatarId=15163","16x16":"https://jira.mystuff.com/secure/project So I have good credentials and end to end connectivity. I am not sure how to troubleshoot further...

Hi All,   We use SafeNet Trusted Access(STA) as our identity provider and we would like to pull the logs from STA to Splunk Cloud. I don't see any app for this integration. Can some one point how to integrate and configure it?  Thanks In Advance!

hi all, I would like to access DS via Winscp so I can look at and donwload some apps. The problem is that Splunk is installed as and owned by splunk user. When I use Putty, I use "sudo su - splunk" and am able to make changes to any directories under /opt/splunk. Can someone give me a hint what I need to change for Winscp to be able to use it and access the directories as I am currently getting "permission denied" messages.  Thanks!

User of splunk attempted a search of index="os" It returns nothing after Dec 23. (Yes this went unnoticed for this long. We were on a single version of RedHat until recently). Splunk servers are all RH7.9 Version:8.2.4 Build:87e2dda940d1   Clients are all 7.9 or 8.5

tl;dr I want to take a list of events, separately sum the fields "message_accounts" (accounts processed in the event) and "message_processing" (time it takes to process) by "transaction_id" (so, in essence, two composite values related to the transaction_id across however many chunks it was split to) so that I can bucket/bin the sum of the message_accounts by the corresponding average of the message_processing value across all of these families of events I have messages that show sub-totals of processing time for split-off chunks of a larger message, identified by a field called "transaction_id"  For example, our service accepts consolidated messages from another service (from 1 unit to thousands of combined message units) and splits them into chunks no larger than 100, where each chunk retains the "transaction_id" of the message source, so it's unique to the original message which we then split into more manageable pieces to be processed in parallel.

I am trying to create a pie chart that would show difference error codes by category.  Here is my current query: index= my_index | stats last(_time) as _time last(Message) as Message by Type | stats count by Type | eval ErrorCode=443 | eval ErrorrCode=503   I'd like to pull in all errors without specifying the ErrorCodes as I have in my query.

I have a time selector with custom tokens that control various aspects of the dashboard.  Changing the value of the time selector changes the values of the custom tokens. I also have a separate input dropdown with a list of times taken from when our alerts fired.  I need to update the time selector when the alert dates/times are chosen so the panels below update with a timeframe showing what happened with alert.  When changing the value of the separate input dropdown to a new date, the 'earliest' and 'latest' update on the time selector, but none of its custom tokens do.  They only change when I change the time selector. When I update input dropdowns with other input dropdown dynamically, they work, just not when I attempt to update the time selector from another input dropdown.   How can I update "all" tokens on the time selector, not just 'earliest' and 'latest' from the other dropdown?       <form theme="dark"> <label>Time Issue</label> <description></description> <fieldset submitButton="false" autoRun="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Time Frame</label> <default> <earliest>@d-1d</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest">if(len('earliest')=0 OR 'earliest="" OR isnull('earliest') OR 'earliest'="null" OR 'earliest'="0", "@d-90d", 'earliest')</eval> <eval token="time.latest">if('latest'="now" OR len('latest')=0 OR isnull('latest') OR 'latest'="null","@m",'latest')</eval> <eval token="time.earliest_type">if(match('earliest', ".*[@smhdwy].*"), "rel", "abs")</eval> <eval token="time.latest_type">if(match('latest', ".*[@smhdwy].*"), "rel", "abs")</eval> <eval token="time.earliest_epoch">if($time.earliest_type$="rel", relative_time(now(), 'earliest'), 'earliest')</eval> <eval token="time.latest_epoch">if($time.latest_type$="rel", relative_time(now(), 'latest'), 'latest')</eval> <eval token="time.difference">$time.latest_epoch$-$time.earliest_epoch$</eval> <eval token="form.panel">if($time.difference$&lt;=604801,"compare","single")</eval> <eval token="form.span">if($time.difference$&gt;2592000,"1d",if($time.difference$&gt;604800,"1h",if($time.difference$&gt;172800,"15m",if($time.difference$&gt;86400,"3m","1m"))))</eval> <eval token="time.earliest_day1">if($time.earliest_type$="rel", 'earliest' . "-1d", 'earliest'-86400)</eval> <eval token="time.earliest_day1_epoch">'earliest'-86400</eval> <eval token="time.latest_day1">if($time.latest_type$="rel", 'latest' . "-1d", 'latest'-86400)</eval> <eval token="time.latest_day1_epoch">'latest'-86400</eval> <eval token="time.earliest_week1">if($time.earliest_type$="rel", 'earliest' . "-1w", 'earliest'-604800)</eval> <eval token="time.earliest_week1_epoch">'earliest'-604800</eval> <eval token="time.latest_week1">if($time.latest_type$="rel", 'latest' . "-1w", 'latest'-604800)</eval> <eval token="time.latest_week1_epoch">'latest'-604800</eval> </change> </input> <input type="dropdown" token="span" searchWhenChanged="true"> <label>Span</label> <choice value="1m">1 Minute</choice> <choice value="3m">3 Minute</choice> <choice value="5m">5 Minutes</choice> <choice value="10m">10 Minutes</choice> <choice value="15m">15 Minutes</choice> <choice value="30m">30 Minutes</choice> <choice value="1h">1 Hour</choice> <choice value="3h">3 Hours</choice> <choice value="6h">6 Hours</choice> <choice value="12h">12 Hours</choice> <choice value="1d">1 Day</choice> <change> <eval token="span.seconds">case($span$="1m", 60, $span$="3m", 180, $span$="5m", 300, $span$="10m", 600, $span$="15m", 900, $span$="30m", 1800, $span$="1h", 3600, $span$="3h", 10800, $span$="6h", 21600, $span$="12h", 43200, $span$="1d", 86400)</eval> <eval token="time.earliest_snap">(int($time.earliest_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval> <eval token="time.latest_snap">int($time.latest_epoch$/$span.seconds$)*$span.seconds$</eval> <eval token="time.earliest_week1_snap">(int($time.earliest_week1_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval> <eval token="time.latest_week1_snap">int($time.latest_week1_epoch$/$span.seconds$)*$span.seconds$</eval> <eval token="time.difference_snap">$time.latest_snap$-$time.earliest_snap$</eval> <eval token="span.intervals">ceil($time.difference$/$span.seconds$)</eval> <eval token="span.intervals_snap">$time.difference_snap$/$span.seconds$</eval> </change> <default>5m</default> <initialValue>5m</initialValue> </input> <input type="dropdown" token="panel" searchWhenChanged="true"> <label>Panel</label> <choice value="single">Single</choice> <choice value="compare">Compare</choice> <change> <condition value="compare"> <unset token="showPanelSingle"></unset> <set token="showPanelCompare">true</set> </condition> <condition value="single"> <unset token="showPanelCompare"></unset> <set token="showPanelSingle">true</set> </condition> </change> <default>compare</default> <initialValue>compare</initialValue> </input> <input type="dropdown" token="timeOption" searchWhenChanged="true"> <label>Choose a Time</label> <fieldForLabel>timeLabel</fieldForLabel> <fieldForValue>time</fieldForValue> <search> <done> <condition match="len('timeOption') != &quot;0&quot;"> <unset token="form.time.earliest"></unset> <unset token="form.time.latest"></unset> <eval token="form.time.earliest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval> <eval token="form.time.latest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval> </condition> </done> <query>| makeresults count=5 | eval _time = floor((relative_time(_time, "@d") / 86400) * 86400) | streamstats current=false count as _row | eval time = _time - (_row * 86400) | eval timeLabel = strftime(time, "%Y-%m-%d")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="len('timeOption') != &quot;0&quot;"> <unset token="form.time.earliest"></unset> <unset token="form.time.latest"></unset> <eval token="form.time.earliest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval> <eval token="form.time.latest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval> </condition> </change> </input> </fieldset> <row> <panel> <html> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>timeOption</span></div> <div style="width: 300px; float: left;"><span>$timeOption$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest</span></div> <div style="width: 300px; float: left;"><span>$time.earliest$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest</span></div> <div style="width: 300px; float: left;"><span>$time.latest$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_type</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_type$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_type</span></div> <div style="width: 300px; float: left;"><span>$time.latest_type$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.difference</span></div> <div style="width: 300px; float: left;"><span>$time.difference$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_day1</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_day1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_day1</span></div> <div style="width: 300px; float: left;"><span>$time.latest_day1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_day1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_day1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_day1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_day1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_week1</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_week1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_week1</span></div> <div style="width: 300px; float: left;"><span>$time.latest_week1$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.earliest_week1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.earliest_week1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>time.latest_week1_epoch</span></div> <div style="width: 300px; float: left;"><span>$time.latest_week1_epoch$</span></div> </div> <div style="width: 100%; clear: both;"> <div style="width: 300px; float: left;"><span>panel</span></div> <div style="width: 300px; float: left;"><span>$panel$</span></div> </div> </html> </panel> </row> </form>    

I have a situation where I want to launch lookup editor in a new window, load a particular lookup and have a pre-determined filter that is set by a token on the dashboard I'm coming from.  All work BUT the filter portion because it appears that the filtering takes place in jquery and therefore I dont have a way to pass the string.  Is there a way to pass the string in the url with an undocumented property so that I can get the dashboard link to launch completely?

Hi all,  i want to hide / delete / exclude some keyword like " supersaiyan" , "leave" from the below event using mvfilter. can anyone please tell me how to do it ?   | makeresults | eval target_text="My name is supersaiyan, leave this to me"   Thanks