About dominiquevocat

dominiquevocat · ‎10-13-2017

um, mail me curious.sle@gmail.com i guess i can include some debuging output for you

dominiquevocat · ‎10-13-2017

would you care to accept the answer?

dominiquevocat · ‎10-13-2017

duno, you guys use https? then only have https as protocol 🙂 example: [default] server=prtg.xxx user=prtgxxx password=prtgxxx protocol=http i slightly anonymize it anyway it should all look like this when it works: https://www.youtube.com/watch?v=_vOb6UFX6hU

dominiquevocat · ‎10-12-2017

Um, asuming you found out the sensorid you can then (using your credentials in prtg.conf in the default stanze) do something like this: | prtghistoricdata id=126586 | timechart max("Datenverkehr eingehend (volume)(RAW)") where you would select the row you want to chart, this is using the german version... | prtghistoricdata id=126586 this will just show all columns for the timerange specified by the search Use the inlcuded dashboard "overview" to find your probe Overview -> Inventory -> select the probe and then below in "Latest measurement of Sensor (click desired measure to chart)" select the sensor to chart. Open the search to see what the command would be... Does this help?

dominiquevocat · ‎10-12-2017

um, as per the description that is apparently lacking... " TA-prtg Custom commands to use the PRTG Webapi from Splunk. Includes a dashboard with an overview of your PRTG Data illustrating the usage and/or directly useful to you i guess. Config is in prtg.conf in \local only! Currently implemented: | prtgws api="table" columns="objid,type,group,device,sensor,status,message,lastvalue,priority,favorite" gets you the inventory | prtglivedata content="status" | fields Alarms gets you the alarms, generally content="" equals to the api call on prtg http api. | prtglivedata content="sensors" filter_status=5 count=100 | table _time,device,group,message,sensor,status,objid gets you the sensors marked as DOWN (filter_type=5) | prtglivedata content=sensordetails id=2071 | fields - _raw,_time,source,sourcetype ,host |transpose | rename column AS Key | rename "row 1" AS Value gets you the sensordetails for sensor 2071 | prtghistoricdata id=2071 count=1 | fields - _raw,_time,*(RAW),source,sourcetype,host | transpose | rename column AS Key | rename "row 1" AS Value will give you the current measurement for sensor 2071 | prtghistoricdata id=2071 | timechart max("Traffic Total (speed)(RAW)") will get you the sensordata from the timerange of the search for the sensor 2071 and chart the series "Traffic Total (speed)(RAW)" (we use a SNMP traffic sensor for this example. Config is in prtg.conf in \local only!" You can use your credentials in prtg.conf to run any of these commands in search on a searchhead to get data. There is a dashboard showing some usage. Nowhere does it say to install it on an indexer and nowhere does it say that it is a scripted input... It could be made though. Actually it might be a good case to implement it as a virtual index allowing for regular searching but not sure if i get around to it. I made the current implementation as a preparation for a monitoring project so that we could use metrics already in PRTG to use it in ITSI but we never went for ITSI so we do not use it at all i think.

dominiquevocat · ‎10-08-2017

Hi, sorry for the delay i was on vacation... the prtg.conf needs to be in the local folder and contain these items: [default] server=[dns.name|192.168.0.2] protocol=[HTTP|HTTPS] user=USERNAME password=ThisIsAClearTextPasswordForNow It will then collect the historicdata endpoint of prtg true. If nothing is specified it will use the [default] stanza else use server=stanzaname to specify which section to use does this help?

dominiquevocat · ‎09-23-2017

i think this only relates to apps under /etc/apps

dominiquevocat · ‎09-23-2017

i updated it for .conf - it just checks what .spec files are under system and clears those.

dominiquevocat · ‎09-20-2017

Simple enough... multivalue values are strings in a list file = open(file_path,"r") results = [] content = file.readlines() result = {} result["ldif"] = content results.append(result) file.close() splunk.Intersplunk.outputResults(results)

dominiquevocat · ‎09-19-2017

example: data i would like to give back to splunk: dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com the way it looks in splunk: dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com so yeah, a multilined text is presented as a single line, stripped of linefeeds and extra whitespace.

dominiquevocat · ‎09-18-2017

splunk.intersplunk.outputResults output multiline strings in a field I have multi-line results which I would like to output as a multi-lined text in a field. Splunk is doing some cleaning in fields like stripping leading spaces and ignoring linefeed. How would I go about sending multi-lined string variable to Splunk?

dominiquevocat · ‎08-28-2017

you can get the library from the machine learning toolkit for your platform

dominiquevocat · ‎08-28-2017

yeah i think this would be a better default set: (from line 47:) os.remove(os.path.join(appsPath,appName,'local','alert_actions.conf')) os.remove(os.path.join(appsPath,appName,'local','authentication.conf')) os.remove(os.path.join(appsPath,appName,'local','authorize.conf')) os.remove(os.path.join(appsPath,appName,'local','commands.conf')) os.remove(os.path.join(appsPath,appName,'local','database.conf')) os.remove(os.path.join(appsPath,appName,'local','datamodels.conf')) os.remove(os.path.join(appsPath,appName,'local','db_connection_types.conf')) os.remove(os.path.join(appsPath,appName,'local','db_connections.conf')) os.remove(os.path.join(appsPath,appName,'local','dblookup.conf')) os.remove(os.path.join(appsPath,appName,'local','distsearch.conf')) os.remove(os.path.join(appsPath,appName,'local','event_renderers.conf')) os.remove(os.path.join(appsPath,appName,'local','eventgen.conf')) os.remove(os.path.join(appsPath,appName,'local','eventtypes.conf')) os.remove(os.path.join(appsPath,appName,'local','fields.conf')) os.remove(os.path.join(appsPath,appName,'local','identities.conf')) os.remove(os.path.join(appsPath,appName,'local','indexes.conf')) os.remove(os.path.join(appsPath,appName,'local','inputs.conf')) os.remove(os.path.join(appsPath,appName,'local','java.conf')) os.remove(os.path.join(appsPath,appName,'local','limits.conf')) os.remove(os.path.join(appsPath,appName,'local','macros.conf')) os.remove(os.path.join(appsPath,appName,'local','outputs.conf')) os.remove(os.path.join(appsPath,appName,'local','props.conf')) os.remove(os.path.join(appsPath,appName,'local','restmap.conf')) os.remove(os.path.join(appsPath,appName,'local','savedsearches.conf')) os.remove(os.path.join(appsPath,appName,'local','searchbnf.conf')) os.remove(os.path.join(appsPath,appName,'local','server.conf')) os.remove(os.path.join(appsPath,appName,'local','settings.conf')) os.remove(os.path.join(appsPath,appName,'local','tags.conf')) os.remove(os.path.join(appsPath,appName,'local','telemetry.conf')) os.remove(os.path.join(appsPath,appName,'local','transforms.conf')) os.remove(os.path.join(appsPath,appName,'local','ui-prefs.conf')) os.remove(os.path.join(appsPath,appName,'local','user-prefs.conf')) os.remove(os.path.join(appsPath,appName,'local','viewstates.conf')) os.remove(os.path.join(appsPath,appName,'local','visualizations.conf')) os.remove(os.path.join(appsPath,appName,'local','web.conf')) os.remove(os.path.join(appsPath,appName,'local','workflow_actions.conf'))

dominiquevocat · ‎08-25-2017

I eneded up with this role and it works fine for me... The trick was to give admin_all_objects authorize.conf [role_splunk_operations] admin_all_objects = enabled cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 edit_server = enabled get_diag = enabled importRoles = power restart_splunkd = enabled run_debug_commands = enabled schedule_rtsearch = disabled srchFilter = index="_*" srchIndexesAllowed = _* srchIndexesDefault = _* srchMaxTime = 0

dominiquevocat · ‎08-25-2017

maybe this is of some use? https://splunkbase.splunk.com/app/2775/ (soon to be updated in time for .conf 2017 🙂 )

dominiquevocat · ‎08-25-2017

Ended up doing my own custom command and a bit of UI and it is available at https://splunkbase.splunk.com/app/2775/

dominiquevocat · ‎08-25-2017

If you face the same issue just use the new custom command mergeapp in https://splunkbase.splunk.com/app/3685/

dominiquevocat · ‎08-25-2017

ok, so i ended up doing my custom command and its up for grabs at https://splunkbase.splunk.com/app/3685/

dominiquevocat · ‎08-08-2017

Seems to be mostly good enough: if pagehandle.status_code==200: data = json.loads(pagehandle.text) if "entry" in data: results = data["entry"] for row in results: #decorate each list item with fields from the returned data if "origin" in data: row["origin"]=data["origin"] if "generator" in data: row["version"]=data["generator"]["version"] row["build"]=data["generator"]["build"] if "paging" in data: row["paging:total"]=data["paging"]["total"] row["paging:offset"]=data["paging"]["offset"] row["paging:perPage"]=data["paging"]["perPage"] #flatten notable data if "acl" in row: for acl in row["acl"]: aclitem = str(acl) row[aclitem] = row["acl"][acl] row.pop("acl", None) #alternatively return it as json #row["acl"] = json.dumps(row["acl"]) #row["acl"].replace("\"", "'") if "perms" in row: if row["perms"] is not None: # there might be "None" values for perm in row["perms"]: permitem = str(perm) row[permitem] = row["perms"][perm] row.pop("perms", None) #alternatively return it as json #row["acl"] = json.dumps(row["acl"]) #row["acl"].replace("\"", "'") if "content" in row: for content in row["content"]: contentitem = str(content) row[contentitem] = row["content"][content] row.pop("content", None) #alternatively return it as json #row["content"] = json.dumps(row["content"]) #row["content"].replace("\"", "'") if "links" in row: for link in row["links"]: linkitem = str(link) row[linkitem] = row["links"][link] row.pop("links", None) #alternatively return it as json #row["links"] = json.dumps(row["links"]) #row["links"].replace("\"", "'") splunk.Intersplunk.outputResults(results) else: splunk.Intersplunk.generateErrorResults("nothing to show")

dominiquevocat · ‎08-07-2017

for the usecase see https://splunkbase.splunk.com/app/2775/ 🙂

dominiquevocat · ‎08-04-2017

So I call the Splunk REST API and collect results in JSON format and that is kind of okay. Then I would like to pass it to splunk.Intersplunk.outputResults() Intersplunk fails to flatten this kind of complex object, so a workaround would be to just get the subset data["entry"] and one leven nesting gets flattened nicely. However, there are nested elements in that as well like ACL, links, etc. The nested elements show up as python object in string representation, which you can not then (as a lazy way out) use spath on... Has anyone found a good way to do this transformation? example: { "links": { }, "generator": { "build": "debde650d26e", "version": "6.4.1" }, "updated": "2017-08-04T15:19:21+02:00", "origin": "https://xxx:8089/servicesNS/nobody/-/", "entry": [ { "links": { "alternate": "/servicesNS/nobody/SplunkUniversalForwarder/" }, "name": "SplunkUniversalForwarder", "updated": "2017-08-04T15:19:21+02:00", "id": "https://xxx:8089/servicesNS/nobody/SplunkUniversalForwarder/" }, { "links": { "alternate": "/servicesNS/nobody/alert_logevent/" }, "name": "alert_logevent", "updated": "2017-08-04T15:19:21+02:00", "id": "https://xxx:8089/servicesNS/nobody/alert_logevent/" }, { "links": { "alternate": "/servicesNS/nobody/introspection_generator_addon/" }, "name": "introspection_generator_addon", "updated": "2017-08-04T15:19:21+02:00", "id": "https://xxx:8089/servicesNS/nobody/introspection_generator_addon/" } ] }

dominiquevocat · ‎08-03-2017

Maybe this helps? https://splunkbase.splunk.com/app/2775/

dominiquevocat · ‎07-25-2017

Is there a way to package an app in /etc/deployment-apps or /etc/master-apps analog to apps in /etc/apps ? For apps in /etc/apps there is a est endpoing and a cli parameter allowing it to merge /local and /default and build a .spl for distribution with /opt/splunk/bin/splunk package app appname I would like to do this also for deployment-apps and master-apps but there seems to be no endpoint on /services/deployment/server/applications/appname that allows something like that. Could i copy the app to /etc/apps, package and remove it again or is that like a really really bad idea?

dominiquevocat · ‎06-28-2017

You could install this app https://splunkbase.splunk.com/app/2775/ and then do this search: | metadata type=hosts index=_internal| fields host | forwarderquerystreaming api="/services/data/inputs/monitor" | spath input=returnvalue | fields host,feed.entry.title

dominiquevocat · ‎06-16-2017

Might be useful? https://splunkbase.splunk.com/app/2775/

Posts	292
Solutions	20
Karma Given	26
Karma Received	57
Member Since	‎08-26-2010

Online Status	Offline
Date Last Visited	a month ago

commands against localhost?

Splunk_TA_mcafee-wg fields wrong?

difficulty in updating a lookup file via rest

How to write/create permission under /etc from pyt...

How do I go about sending multi-lined string varia...

Splunk REST API: Issue wtih flattening JSON-format...

package deployment-app via CLI or rest

DB Connect 2 and Firebird SQL

persist settings per logged in user in a controlle...

Merging local into default using git?

Re: TA-prtg: How do I add the PAI on the prtg to t...

Re: What is the process to run the TA-prtg Add-on?

Re: TA-prtg: How do I add the PAI on the prtg to t...

Re: How do I get bandwidth usage from PRTG to Splu...

Re: TA-prtg: How do I add the PAI on the prtg to t...

Re: TA-prtg: How do I add the PAI on the prtg to t...

Re: package deployment-app via CLI or rest

Re: merging local into default using git

Re: How do I go about sending multi-lined string v...

Re: How do I go about sending multi-lined string v...

How do I go about sending multi-lined string varia...

Re: how can I enable MMAP caching in Google GeoIP ...

Re: merging local into default using git

Re: Permission required for GUI restart of Splunk

Re: Can I call REST Endpoint of Universal Forwarde...

Re: How to change settings on a forwarder via REST...

Re: merging local into default using git

Re: merging local into default using git

Re: Splunk REST API: Issue wtih flattening JSON-fo...

Re: Splunk REST API: Issue wtih flattening JSON-fo...

Splunk REST API: Issue wtih flattening JSON-format...

Re: Can the REST call to delete a user from Splunk...

package deployment-app via CLI or rest

Re: Is there a search to centrally list what my un...

Re: Splunk rest command: Is it possible to generat...