@kamlesh_vaghela Can we use python script to automate dashboard permissions in splunk? ... View more

Hi @codebuilder I am looking for splunk jobs, we have jenkins jobs of different stages and we need to write a query where we should define the search in such a way that it checks all the previous jobs and then come to release stage. ... View more

@broberg And I don't see any error in the splunkd.log around the same time. ... View more

@broberg I don't see any specific error. I see this error in the web access log. ERROR [5e452b083b7f55f825d890] error:335 - Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/cherrypy/cprequest.py", line 628, in respond self._do_respond(path_info) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 687, in _do_respond response.body = self.handler() File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 219, in __call_ self.body = self.oldhandler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 75, in wrapper resp = handler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/cpdispatch.py", line 54, in __call_ return self.callable(*self.args, **self.kwargs) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 383, in default return route.target(self, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-136>", line 2, in upload File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 40, in rundecs return fn(*a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-134>", line 2, in upload File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 118, in check return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-133>", line 2, in upload File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 166, in validate_ip return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-132>", line 2, in upload File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 245, in preform_sso_check return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-131>", line 2, in upload File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 284, in check_login return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-130>", line 2, in upload File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 304, in handle_exceptions return fn(self, *a, **kw) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/appinstall.py", line 358, in upload 'state': state File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/appinstall.py", line 185, in render_admin_template return manager.render_admin_template(*a, **kw) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1381, in render_admin_template args = root.app.buildViewTemplate(namespace, ADMIN_VIEW_NAME, render_invisible=True, build_nav=False, include_app_css_assets=False) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 806, in buildViewTemplate viewList.sort(key=lambda x: x['label']) TypeError: '<' not supported between instances of 'NoneType' and 'str' ... View more

How do we do that? ... View more

@nickhillscpl How do we confirm whether rate limit is been applied to specific channel or not? ... View more

@jkat54 I tried different slack channel that is using the same webhook url for testing purpose and there also we observed the delay in receiving alerts. PFB error message that we see in the splunkd.log ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 255., search='sendalert slack_webhook_alert results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_bXNpbmdoQGFybG8uY29t_c3BsdW5rX2FwcF9qZW5raW5z_RMD55de36a8bbf79c022_at_1580289000_23596_B2217163-89B0-464E-965F-D5D289E35131/results.csv.gz" results_link="********/app/splunk_app_jenkins/@go?sid=scheduler_bXNpbmdoQGFybG8uY29t_c3BsdW5rX2FwcF9qZW5raW5z_RMD55de36a8bbf79c022_at_1580289000_23596_B2217163-89B0-464E-965F-D5D289E35131"' ... View more

@jkat54 How can we run this command from search head url from the search query? ... View more

@jkat54 How do we do that? Which command to run and from where? ... View more

@jkat54 We are getting alerts in slack but there is a delay in time, suppose I am scheculing an alert for 2 minutes for email and slack, in next 6 minutes I get 3 email alerts but only 2 slack alerts. And in splunkd.log I see this error message "Alert action script returned error code=255". What could be an issue? ... View more

Hi All, I have configured Slack and email for the same alert, however we are not getting the same number of alerts in slack, alert has been scheduled to run every 2 minutes. Email alerts are coming properly but not in Slack. What could be an issue? And there is also a delay in alerts that are coming on Slack. Quick help would be appreciated. ... View more

Hi @to4kawa I want to send an alert if specific job is failing for 5 consecutive times. ... View more

@lguinn2 I have a query, there is a table where we have the job_result column, if we get consective 5 jobs failed then we need to be alerted. ... View more

Hi @adonio I need to set up an alert when I see consecutive value as "FAILURE" in jobs_results field, can you help? If consecutive 4 jobs are failing then I should be alerted. For example: job_result success failure success failure failure failure failure ... View more

@worshamn Is there no way we can add inline table results of Splunk query to Slack messenger? ... View more

@sjodle Is there no way we can add inline table results of Splunk query to Slack messenger? ... View more

I am trying to set up a custom alert which will invoke my script by passing variables such as username, password, source_file path and destination_path but when we are trying to decrypt the password using Fernet and cryptography libraries in the script we are getting module error. Could you please help? ... View more

Hi @DavidHourani I am trying to set up a custom alert which will invoke my script by passing variables such as username, password, source_file path and destination_path but when we are trying to decrypt the password using Fernet and cryptography libraries in the script we are getting module error. Could you please help? ... View more

@doksu I have a query where we are trying to output the results into csv but now we would like to have that in json format. Can we do that through this app? ... View more

We have a usecase, where in we are trying to find the anomalies for very risky apis. For example, I am taking events count of risky apis for last 30 days and then if there is any sudden deviation in the behaviour then machine should train the data automatically and gives us the anomalies. ... View more