Hi Seeing the following when adding my 1st input to LA - couldn't see this message in other posts 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:39.805 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/TA_ms_loganalytics_log_analytics?--cred--=1&output_mode=json&count=0 HTTP/1.1" 200 2096 - - - 927ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:40.613 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/data/inputs/log_analytics?count=0&output_mode=json HTTP/1.1" 200 2300 - - - 38ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:40.656 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/storage/passwords/?count=-1&offset=0 HTTP/1.1" 200 233366 - - - 8ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:40.738 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/TA_ms_loganalytics_settings/logging?--cred--=1&output_mode=json&count=0 HTTP/1.1" 200 1239 - - - 1526ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:41.798 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/properties/TA-ms-loganalytics HTTP/1.1" 404 151 - - - 0ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:41.804 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/configs/conf-ta_ms_loganalytics_settings/_reload HTTP/1.1" 200 2106 - - - 23ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:41.830 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/configs/conf-ta_ms_loganalytics_settings/logging?output_mode=json HTTP/1.1" 200 1713 - - - 1ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:42.270 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/storage/collections/config/TA_ms_loganalytics_checkpointer HTTP/1.1" 200 5631 - - - 1ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:42.272 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/storage/collections/config/?search=TA_ms_loganalytics_checkpointer&count=-1&offset=0 HTTP/1.1" 200 4829 - - - 1ms 127.0.0.1 - splunk-system-user [14/Nov/2018:16:33:42.277 +1100] "GET /servicesNS/nobody/TA-ms-loganalytics/storage/collections/data/TA_ms_loganalytics_checkpointer/soc_diagnostics_rg_01 HTTP/1.1" 404 140 - - - 1ms 2018-11-14 16:33:44,747 ERROR pid=74474 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events for i in range(len(data["tables"][0]["rows"])): UnboundLocalError: local variable 'data' referenced before assignment Collapse 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" Traceback (most recent call last): 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" self.collect_events(ew) 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" input_module.collect_events(self, ew) 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" for i in range(len(data["tables"][0]["rows"])): 11-14-2018 16:33:44.747 +1100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment ... View more

trying to extract the msg field from an azure blob which uses the _json sourcetype - the msg : field shows as one long field - how to extract this please ? msg: 2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE:: Validate - user {"_id":"25fd57973c","email":"[email protected]","email_verified":true,"clientID":"8NReZXmds4","updated_at":"2018-07-10T06:53:42.764Z","name":"[email protected]","picture":"https://web.png","user_id":"email|5b3c37dd","nickname":"nickname","identities":[{"user_id":"5b3c3","provider":"email","connection":"email","isSocial":false}],"created_at":"2018-07-04T02:58:55.014Z","user_metadata":{"firstname":"bob","lastname":"bob","name":"bob bob"},"global_client_id":"rEJsAkwGVI","app_metadata":{"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_xxxxx"}}},"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_46"}},"persistent":{}} thanks *** UPDATE *** So i've made some progress where i can create a new_msg field stripping off the non-json part of the msg field : 2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE::Validate - user and then that allows me to run spath on the new_msg | rex field=msg "^[^{]+(?<new_msg>.*)" | spath input=new_msg now my field count has gone from ~50 to 500+ Is there a better way ? ... View more

i am receiving data via HEC to a SH which then sends to an index tier. I've like to also send this data to a secondary indexing tier which is a separate env - need some clarification with the config is the section 'Forward data for a single index only' relevant here - will it still index locally ? http://docs.splunk.com/Documentation/Splunk/7.1.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding [tcpout] #Disable the current filters from the defaults outputs.conf forwardedindex.0.whitelist = forwardedindex.1.blacklist = forwardedindex.2.whitelist = #Forward data for the "myindex" index forwardedindex.0.whitelist = myindex ... View more

I'm following the doco here : http://docs.splunk.com/Documentation/ITSI/3.0.2/RESTAPI/ITSIRESTAPIreference#ITOA_Interface i run a search : | rest /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search and i can get a json blob of data i'd like to create a table from this of search names, base_search, etc Is that possible ? ... View more

Trying to instrument a copy of konakart with the following : java version "1.7.0_75" This app has been successfully instrumented with both newrelic and CA APM and trying the Splunk tool now working settings: #JAVA_OPTS="$JAVA_OPTS -javaagent:/opt/konakart/wily/Agent.jar -Dcom.wily.introscope.agentProfile=/opt/konakart/wily/core/config/IntroscopeAgent.profile" # ---- New Relic switch automatically added to start command on 2017 Jun 14, 00:15:53 #NR_JAR=/opt/konakart/newrelic/newrelic.jar; export NR_JAR #CATALINA_OPTS="$CATALINA_OPTS -javaagent:$NR_JAR"; export CATALINA_OPTS snippet from the catalina.sh using the splunkagent.jar I have tried both: #JAVA_OPTS="$JAVA_OPTS -javaagent:splunkagent.jar" Also: SP_JAR=splunkagent.jar; export SP_JAR CATALINA_OPTS="$CATALINA_OPTS -javaagent:$SP_JAR=/opt/konakart/SplunkJavaAgent/config/splunkagent.properties"; export CATALINA_OPTS In the catalina.out i see the following: Error opening zip file or JAR manifest missing : splunkagent.jar Error occurred during initialization of VM agent library failed to init: instrument ... View more