Hi, if you can reach the api you should be good. However the app tries to contact port 443 - you should be good in specifiy host:port in the .conf though. ... View more

you should be able to get notable events via api. maybe you can say what exactly you need? Maybe have a loot at ta-prtg.... ... View more

Works nicely. I just might polish this half-assed PRTG custom command finally 🙂 ... View more

Hi SloshBurch, my question was regarding writing a custom command and take the search earliest and searchlatest for passing the timerange to filter a request to a api. ... View more

looks like a fairly nice workaround, i will try it 🙂 but would really like to have it directly in one of the tuples ... View more

try something like this: [ | stats count | eval search=strftime(now(), "yaddayadda_%Y%m%d.xls") | fields search] full example: | outputxls [ | stats count | eval search=strftime(now(), "yadda_yadda__%Y%m%d.xls") | fields search] "sender@company.com" "recipient@company.com" "subject" "body" "mailhost.company.com" I never tried with whitespace in file names ... View more

wait - maybe you can do a subsearch (within [ ] ) and the subsearch will deliver the string for the parameter, just make sure its without whitespace OR in quotes. ... View more

I see. I think i would have to provide a alert action integration to allow this so you could define some tokens there - not sure how to do it and especially when 😕 ... View more

Hi @chintan_shah, the parameters for the sendfile (and outputxls) are just strings passed to the custom command. It does not take parameters from fields. I guess it would be possible to do some date macros or some such but i did not think of it because the mail already has a send date :-/. So in essence i think it would be doable to interpret a splunk strftime like string when preparing the email. ... View more

Um, maybe limiting search commands in one of the roles you have? ... View more

Thanks, as you see in the tags i specifically asked for the packaged visualization https://splunkbase.splunk.com/app/3218/ ... View more

It is a universal forwarder. Thing is i have usually no means to deploy binaries and settings on server and wish to be able to set purely splunk settings myself. I would like to build it into the splunk app "forwarder query" ( https://splunkbase.splunk.com/app/2775/ ) i.e. i would like to get a number of servers and apply a setting to those from the deployment server as i have access to the rest endpoint of all forwarders from the server where the deployment server runs. I am ok with deploying an app with a script changing settings locally but i was thinking it should work via rest :-). ... View more

Hm, if the results are taking a while you might get intermediate results. On stdout in line 7 there is "preview: 1" indicating the search has not yet completed. Something like sys.stdin = codecs.getreader('utf-8')(sys.stdin) Check if line 7 is "preview:1" if str(row).strip('[\']') == "preview:1": exit() Does this help with your problem? ... View more

Hi, if you want, have a look at TA-xls ( https://splunkbase.splunk.com/app/1832/ ) ... while the results are not complete splunk says something like preview: 1 in line 7 on stdout. i think the wrapper i have bolted together will help you some. ... View more

Hey Leo, i have a field permalink and in the workflow action i use method get and use the value $!permalink$ but it still tries to use it as a relative url... 😞 ... View more

you could have a look in splunkbase at the TA-XLS which allows in version 0.1 to convert the .csv generated by outputcsv to a Excelsheet and sendfile for sending it as a email attachment. The new version 0.2 has a outputcsv command that directly generates a .xls and allows for sending it via email. (i have trouble uploading the new version right now but in a day or so it should be there). ... View more

Maybe this helps? https://splunkbase.splunk.com/app/1832/ ? ... View more

I do have the same issue with outputcsv that seems to stream the results. I have not yet tried it but... maybe if you run the proper search as subsearch ( in [] ) and have the own backup command run in the main search this issue is mitigated because the subsearch is run completely first? ... View more

Um, i don't really have much trouble with using spath? The ones i need to work on if i recall correctly are the Extended Attributes. What exactly do you need? I might have to check if i pushed the current version with the sample dashboards and lookups etc. update: After reviewing i saw that i added a macro to split those fields like the EA: eval $field$=replace($field$,"u\'","\"") | eval $field$=replace($field$,"\'","\"") | spath input=$field$ | fields - $field$ *.inheritance_source._ref| rename *.value AS * ... View more

Hi, i am quite open for modifications 🙂 and yeah sorry there is currently no github repo. Feel free to contact me though. I think my email is on my profile and visible. Anyway it is curious dot sle at gmail.com for my private email... ... View more