This response does not appear to be correct, I can see no way to color a row based on a cell value in Splunk 7+ ... View more

I am not able to get this to work either in Splunk Ent 7.1 with text values. ... View more

How did you fix this in your script, this still does not seem to address your original problem, coloring the whole row based on a text value in a cell. ... View more

For some reason I cannot make this work. The only thing applied is the css background color defined. ... View more

While this works with a single token, can you set 2 tokens and drive 2 html panels with them from the same search? ... View more

The field names are as follows codeDropUploadMap.20180828..qcTickets codeDropUploadMap.20180711..qcTickets codeDropUploadMap.20180804..qcTickets etc. The data contained within is a comma delimited string of id's. each row only has values for one of the columns, if any. I used your format to do something similar with another field and it worked fine. I think it might have to do with the data within? ... View more

For whatever reason, this still is not working. Your example works, however replacing verbatim the foo and bar sections with my own data fails to parse out the information. ... View more

I should add, that although json is a random order payload, the script itself somehow always returned the same order when run via pycharm, etc. The reason I care is I need to set line_breakers to extract each incident into its own event. ... View more

Thanks! Ugh, I was just looking to see how to get Splunk to recognize the field name in the eval, tried double quotes, as Splunk itself uses if you let it build the search query, but apparently you need to use single quotes with fields like that. It would have been nice if any of the documentation mentioned that. 😞 ... View more

That's what I thought, however when providing a time in the event Json, and selecting the _json structured sourcetype, it would not work, as none of the examples spoke to the importance of the selected sourcetype when following the provided examples, this wasted a lot of troubleshooting time. I would suggest that the sample curl in the doc's include a time element, as that is key to how Splunk works, rather than simply sending a string message, which shows a successful post but does not get indexed. ... View more

Ok, I got this to work. It would have been much easier with a one sentence edit in the documentation. The documented examples are in json , however when setting up the token you get to also select a sourcetype . I selected _json and it did not work. It was looking for a timestamp . You need to select _json_no_timestamp for the examples to work as documented. ... View more

Thanks, all of this was checked, data is not showing up in any index. My best assumption is it may be permissions related, either having access to view or within the backend with permissions to write. As I stated _introspection shows the metrics of the event it saw come in successfully, but on the index management page within splunk, no events are being added to any index. Is there some condition where an event will not get written to an index, and not log an error in _internal? ... View more

I should note, I am admin, full privilages ... View more

Searching all time, still nothing ... View more

I am even seeing it was indexed in the _introspection logs, but just cant search it {"datetime":"07-09-2018 11:59:27.627 -0700","log_level":"INFO","component":"HttpEventCollector","data":{"token_name":"hectest","series":"http_event_collector_token","transport":"http","format":"json","total_bytes_received":50,"total_bytes_indexed":14,"num_of_requests":1,"num_of_events":1,"num_of_errors":0,"num_of_parser_errors":0,"num_of_requests_to_disabled_token":0,"num_of_requests_in_mint_format":0}} ... View more

This is on standalone enterprise test instance. indexes are created and searchable. ... View more

I am not seeing any warnings or errors anywhere. Just unable to find the test messages in any index at all anywhere after the successful response that the event was posted. ... View more

So the following worked with my example. This is just a test for functionality, so the sourcetype definitions aren't actually any different yet. Not 100% sure what made this work, as I was positive I had this config earlier, however I think that the existence of the sourcetypes already available in the app, along with the transforms.conf FORMAT section including the sourcetype:: key did it. The following configuration seems to work as intended. Within the scope of the app: "all referenced sourcetypes were pre-created" inputs.conf [default] index = iem_test [monitor://C:\QV\Augustus.log] disabled = false sourcetype = augustus props.conf [augustus] TRANSFORMS-change_sourcetype = mapped_events DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom disabled = false [augustus_mapped] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom pulldown_type = 1 transforms.conf [mapped_events] FORMAT = sourcetype::augustus_mapped REGEX = DEBUG.*EXIT DEST_KEY = MetaData:Sourcetype ... View more

turns out you do need the sourcetype:: in the FORMAT for it to work. this now works and lets me search on the sourcetype [mapped_events] FORMAT = sourcetype::augustus_mapped REGEX = DEBUG.*EXIT DEST_KEY = MetaData:Sourcetype ... View more