could you please provide sample queries for OMS which can be executed through this TA?
I tested few queries in python script and got result below:
Request : search_params="{'query': 'Event | summarize count(Computer)'}'
Response : {"tables":[{"name":"PrimaryResult","columns":[{"name":"count_Computer","type":"long"}],"rows":[[23572]]}]}
When I tried testing same query in TA. getting an error like below,
2018-07-11 14:24:50,693 ERROR pid=24842 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-OMS_Inputs/bin/ta_oms_inputs/modinput_wrapper/base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-OMS_Inputs/bin/oms_inputs.py", line 96, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/TA-OMS_Inputs/bin/input_module_oms_inputs.py", line 95, in collect_events
search_id = data["id"].split("/")
KeyError: 'id'
as per the python scirpt in TA :
data = response.json()
search_id = data["id"].split("/")
id = search_id[len(search_id)-1]
status = data["__metadata"]["Status"]
its expecting id from the response. if there is no id found in response then its throwing an error. if this is the behaviour we cant execute dynamic queries using this TA.
Please let me know how to parse this using this TA, otherwise I need to write parser for this. then there is no use of this TA.
... View more
