Hi again, Now I'm struggling transferring the search into props/transforms. I'm probably missing something simple. props.conf: EXTRACT-Privileges = Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+) REPORT-fields = privilege transforms.conf: [privilege] SOURCE_KEY = Privileges REGEX = "(?<privilege>\S+)\s+) REPEAT_MATCH = true MV_ADD = true So the new field that contains the extracted values is not happening. ... View more

Thanks to everyone that has offered help. Much appreciated. ... View more

Perfect! I think you've solved a couple of my past questions. So thank you very much again 🙂 ... View more

This is what I'm getting. ... View more

Hi fdi01, Thanks. Unfortunately this does not change the output. Steve ... View more

Sigh.. Without changing anything, I've just rechecked and the table file now appears in the drop down. I have no idea what happened. Did displaying the file force something? Thanks anyway 🙂 ... View more

Hi D, Yes we are able to view the contents via "| inputlookup" Cheers ... View more

Thanks mharlan, good to know. I keep trying to debug what is happening without success. Though executing the script manually gives this, but I suspect it's probably a red heron 😞 Blockquote -bash-4.1$ /opt/splunk/bin/python2.7 get_ips_feed.py <username> <password< <ipaddr> Traceback (most recent call last): File "get_ips_feed.py", line 8, in <module> import splunk.entity as entity File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 2, in <module> import splunk, rest, util, auth File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 7, in <module> import lxml.etree as et ImportError: /usr/lib64/libxml2.so.2: version `LIBXML2_2.9.0' not found (required by /opt/splunk/lib/python2.7/site-packages/lxml/etree.so) The sdee_get.log displays Blockquote Thu Nov 12 12:52:21 2015 - ERROR - Exception thrown in sdee.get(): TypeError: init() got an unexpected keyword argument 'context' Thu Nov 12 12:52:21 2015 - ERROR - Attempting to re-connect to the sensor: IPAddr Thu Nov 12 12:52:21 2015 - INFO - Checking for exsisting SubscriptionID on host: IPAddr Thu Nov 12 12:52:21 2015 - INFO - SubscriptionID: sub-15-b8f18bf1 found for host: IPAddr Thu Nov 12 12:52:21 2015 - INFO - Attempting to connect to sensor: IPAddr Thu Nov 12 12:52:21 2015 - INFO - Successfully connected to: IPAddr ... View more

Thanks guys.. 🙂 ... View more

Just tried using the previous version of splunk python (6.2.4) which was working with a previous version of ciscoips app (2.0.0) and now get HTTPError: HTTP Error 400: Bad Request. Restored the previous version of the app and now the connection is retried over and over. Also tried a full roll back to splunk-6.2.4 and splunk_ciscoips v2.0.0 and that no longer works 😞 I've restored splunk-6.3.0 and disabled both ciscoips 2.0.0 & 2.1.4 for now 😞 ... View more

Also tried disabling SSL and got the same result 😞 ... View more

I have the same issue. I have patched the get_ips_feed.py file (diff below) so I am now only left with the error: ERROR - Connecting to sensor - xxx.xxx.xxx.xxx: TypeError: init() got an unexpected keyword argument 'context' I'm not sure if that will help you in any way? Note: "get_ips_feed.py.630" is the none patched version. Also trying a wget may identify the issue which I've currently requested to be looked at by the security person. # wget https://xxx.xxx.xxx.xxx/cgi-bin/sdee-server/ --2015-10-23 11:56:55-- https://xxx.xxx.xxx.xxx/cgi-bin/sdee-server/ Connecting to xxx.xxx.xxx.xxx:443... connected. Unable to establish SSL connection. Cheers Steve # diff get_ips_feed.py get_ips_feed.py.630 2a3 > import re 22a24,29 > # ADDON-2386 > if not os.path.exists(RUN_DIR): > os.makedirs(RUN_DIR) > if not os.path.exists(LOG_DIR): > os.makedirs(LOG_DIR) > 48c55,56 < entities = entity.getEntities(['storage', 'passwords'], namespace=APPNAME, owner='nobody', sessionKey=sessionKey) --- > #adding count='-1' as parameter per ADDON-3724 > entities = entity.getEntities(['storage', 'passwords'], namespace=APPNAME, owner='nobody', sessionKey=sessionKey, count='-1') 50c58,59 < exception = traceback.format_exc().splitlines()[-1] --- > exception = traceback.format_exc() > exception = re.sub(r"[\r\n]+", " ", exception) 58c67 < --- > 59a69,71 > # This appears to sleep 5 minutes and then quit because it does sleep 5 minutes and then quit. > # ...Yet this script is called every 1 second IF it is not running, so this sleep actually > # delays the next instantiation by 5 minutes 66c78 < --- > 68c80 < logger("INFO - Checking for exsisting SubscriptionID on host: "+host) --- > logger("INFO - Checking for existing SubscriptionID on host: "+host) 72c84 < logger("INFO - No exsisting SubscriptionID for host: "+host) --- > logger("INFO - No existing SubscriptionID for host: "+host) 77c89 < logger("INFO - No exsisting SubscriptionID for host: "+host) --- > logger("INFO - No existing SubscriptionID for host: "+host) 92c104,105 < exception = traceback.format_exc().splitlines()[-1] --- > exception = traceback.format_exc() > exception = re.sub(r"[\r\n]+", " ", exception) 95c108 < sys.exit() --- > sys.exit() 106c119,120 < exception = traceback.format_exc().splitlines()[-1] --- > exception = traceback.format_exc() > exception = re.sub(r"[\r\n]+", " ", exception) 116c130 < result_xml = sdee.data() --- > result_xml = sdee.data() 123c137 < ## Un Comment for easy debug of raw xml feeds. --- > ## Un Comment for easy debug of raw xml feeds. 133c147 < --- > 138c152 < alert_dict["gc_riskdelta"] = alerts.globalCorrelationRiskDelta --- > alert_dict["gc_riskdelta"] = alerts.globalCorrelationRiskDelta ... View more

Hi, Thanks again. Still no joy 😞 Though I have sorted it another way 🙂 Answer to follow. ... View more

Hi, I removed the |eval span=4 to be safe which made no difference. The problem that I'm having is that the if-then-else is alway returning false which make qos_unit always have the value of qos_thruput even if qos_metric is Bandwidth. So to explain: If qos_metric = bandwidth then let qos_unit contain qos_bandwidth values else qos_unit contains qos_thruput values. ... View more