Not to my knowledge. ... View more

Application Icons must be called appIcon_2x.png (32px X 32px), appIconAlt_2x.png(32px X 32px), appIcon.png (72px X 72px), appIconAlt.png(72px X 72px). And need to be placed in $SPLUNK_HOME/etc/apps/<yourAPp>/static. ... View more

This is lightly documented in the documentation in the section Custom Response Handlers. The response handlers can be found in the bin directory in a file call responsehandlers.py. By the Modular input use DefaultResponseHandler which just pass the REST response to STDOUT. You can change it to any of the ones find the file by added the following setting to the stanza of your input, response_handler= <class>. class is just one of the classes from responsehandlers.py. From the sounds of it your REST response gives you multiple events in the message which you need to split or else it comes in as one giant event. Looking at responsehandlers.py it looks like you will have to write a little bit of python which should take about 15 lines of code. Not know how your raw data looks I might write something like this. This was not tested as just wrote of the hip. class AlarmResponseHandler: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): #for each line in response. Assuming it reads like a text file with new line char returns for line in raw_response_output: # if ',/alarm>' in the line end of event if '</alarm>' in line: event = event += line print_xml_stream(event) # clear event for new event event = None ... View more

Thats my point. When default is set Splunk will use the system Time/ Timezone. BST is one hour ahead of UTC so thats why your data shows up as off. In your profile set the TZ to GMT or what ever timezone you want. Splunk will automatically apply search offsets. ... View more

Fixed link. ... View more

The short answer is kinda. Useragent can be spoofed and their is not standard how devices or browsers identify themselves. However their is a community app not built by splunk called TA-user-agents. https://splunkbase.splunk.com/app/1843 ... View more

Have you checked your time zone preferences for your user. It defaults to the TZ of the local system. Edit your account and set Time Zone. Splunk handles offsets for users. ... View more

Please provide more information. such as a sanitized log sample. I am assuming your are referring to web logs such as IIS or access*. ... View more

Then your only real option is to use a HTML embedded tag and write a Javascript extension similar to the Single Value Tend in the simple XML app. You can still use simple xml, but you have to write javascript extensions. ... View more

I believe you can use a simple xml form and using in-page Drilldown with Perma-link. Below is an example with input type of text, but you could change it to use checkbox. The bottom chart use attribute depends to delay render/ search. This example can be found in the simple xml app <form> <label>In-Page Drilldown with Perma-linking</label> <fieldset submitButton="false"> <!-- Create an input to store the drilldown value. It will be hidden using custom javascript when the dashboard is loaded. --> <input type="text" token="sourcetype" searchWhenChanged="true" /> </fieldset> <row> <table id="master"> <title>Master</title> <searchString>index=_internal | stats count by sourcetype</searchString> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> <!-- Set the type of of drilldown, since we will always consume the same field, use row--> <option name="drilldown">row</option> <drilldown> <!-- Use set to specify the new token to be created. Use any token from the page or from the click event to produce the value needed. --> <set token="sourcetype">$row.sourcetype$</set> <!-- If we also set the form.sourcetype the input will get updated too --> <set token="form.sourcetype">$row.sourcetype$</set> </drilldown> </table> </row> <row> <!-- depends is the way we tell the content to only show when the token has a value. Hint: use comma separated values if the element requires more than one token. --> <chart id="detail" depends="$sourcetype$"> <title>Detail: $sourcetype$</title> <searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> </chart> </row> </form> ... View more

The best way to do this is not to remove it from the UI, but to change your user permission. Thought I would probably create a custom role. On your search heads create authorize.conf within an app or system/local directory. [role_limited_user] change_own_password = enabled embed_report = enabled get_metadata = enabled get_typeahead = enabled input_file = enabled list_deployment_client = enabled list_forwarders = enabled list_inputs = enabled output_file = enabled request_remote_tok = enabled rest_apps_view = enabled rest_properties_get = enabled run_debug_commands = enabled search = enabled schedule_search = enabled # this settings limited there maxium search window below is two weeks in seconds srchTimeWin = 1209600 #leave this capabilility commented out #rtsearch = enabled Additionally you can set the UI time picker to defaults from $SPLUNK_HOME/etc/system/local/ui-prefs.conf. Below sets the default to 15m and fast mode when the search window loads for all users. [default] dispatch.earliest_time = -15m dispatch.latest_time = now display.page.search.mode = fast I do recommend creating a new roles. ... View more

You do transaction on order id. then find where order don't contain completed. probably the simplest. ... View more

Native python. ... View more

you could try python -c 'import setuptools; execfile("setup.py")' build. I also have a bunch of eggs built for mac and gnu/linux which may work for you. ipython, nltk, numpy, pandas, scipy, six, statsmodels, and sympy. Would you be interested? ... View more

I've update the post with an alternative, but I don't recommend as it can be problematic sometimes. ... View more

if you are using crsSalt you want to crcSalt=<SOURCE> . Additionally you can blacklist using regex, blacklist = .gz ... View more

Yes, This is relatively easy with the use of python egg files. Though you must be careful as you will have to build all the eggs and dependencies per arch type. Looking at the pyAOS module it depends on NumPy/SciPy which is a pain to build all the eggs for. You will need to build them on the same OS as your Splunk instance. If you are using a Windows server you will need to download Intel's Math Kernel Library(INTEL MKL) to build some of the eggs. You will need to do the following: 1. Make sure you have setuptools installed with an python 2.7.x install. 2. Download pyAOS source. 3. untar. run the following the follow command python setup.py bdist_egg. Note: you will need to do this on the same OS archtype as you production splunk. Now you will probably get an error. review the error and find missing module. Then download the missing modules source. Repeat step three. You will have to do this until you build all the missing eggs. Once you have build the missing eggs you can use the following code to load all the complied eggs during your scripts run time. The following will find the running path of your script then search an egg directory in the same path. import os import sys from platform import system platform = system().lower() # Loading eggs into python execution path if platform == 'darwin': platform = 'macosx' running_dir = os.path.dirname(os.path.realpath(\_\_file\_\_)) egg\_dir = os.path.join(running_dir, 'eggs') for filename in os.listdir(egg\_dir): file_segments = filename.split('-') if filename.endswith('.egg'): filename = os.path.join(egg\_dir, filename) if len(file\_segments) <= 3: sys.path.append(filename) else: if platform in filename: sys.path.append(filename) import foo, bar, spam \# \# \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# \# Alternative import os, sys import subprocess import splunk.Intersplunk # Remove problematic environmental variables if they exist. for envvar in ("PYTHONPATH", "LD\_LIBRARY\_PATH"): if envvar in os.environ: del os.environ[envvar] # os interpreter python\_executable = "/usr/bin/python" try: realscript = os.path.join(os.path.dirname(\_\_file\_\_), "realscript\.py") p = subprocess.Popen([python\_executable, realscript], stdout=subprocess.PIPE, stderr=subprocess.PIPE) out, err = p.communicate() print out splunk.Intersplunk.outputResults(out); except: # log something pass This is the same approach I use in my app called Compuware GPN which loads SUDS. I have done this with the NLTK module, but its a pain and took about 6 hours of tinkering with. ... View more

question are you running splunk as local system or as a service account? ... View more

My suggestion would be to use the https://apps.splunk.com/app/1613/ and open a support ticket. ... View more

Thank for you for voting my answer up, could you accept it? ... View more

The setting I gave should work. If its not working it could be a bug in 6.2.1, but applying your own css always works. ... View more

I dont see anything wrong, but I also does know what else you apply. You may want try attaching your own css to the page for those elements. ... View more