You'll need to provide some additional details if you want a better answer. Are you expecting the output to show up on the console where splunkweb is launched? What's your script doing exactly? Running custom scripts from CherryPy should probably be pretty limited; I image it would be pretty easy to consume a bunch of threads and cause the whole UI to hang (or at least slow down significantly.) So as an alternate approach, why not just send your output to a log file, preferably one that Splunk can read? Then use Splunk's real-time search capability to show the contents of the log concurrently with whatever else you want to see at the same time. ... View more

Hi harshal_chakranarayan, yes, it is possible. You can add the module: <module name="JobProgressIndicator"/> to your chart, BUT I think this can only be done in advanced XML -> see docs for more info. hope this helps ... cheers, MuS ... View more

Download "UIExamples" , "SideView Utils" ,"Splunk Dashboard Examples" from app stores. You can find many examples ( just copy an paste them ). Put module Button on the top of a Search module on your view XML this is called downstream from module to another. ... View more

Thanks Mus, Got the xml command from your link true It worked perfectly..!!! ... View more

Hi harshal_chakranarayan, Splunk uses the following precedence rules to assign time stamps to events: Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure TIME_FORMAT in props.conf. If no TIME_FORMAT was configured for the data, Splunk attempts to automatically identify a time or date in the event itself. It uses the event's source type (which includes TIME_FORMAT information) to try to find the timestamp. If an event doesn't have a time or date, Splunk uses the timestamp from the most recent previous event of the same source. If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.) For file sources, if no date can be identified in the file name, Splunk uses the file's modification time. As a last resort, Splunk sets the timestamp to the current system time when indexing each event. kudos go to docs team for this cheers, MuS ... View more

Hi there! I cannot make it work, I have this: | head 1 | eval my_time="Sun Apr 30 23:46:53 GMT+00:00 2017" | table my_time | eval final=strptime(my_time, "%a %b %d %H:%M:%S %Z%z %Y") | eval Time=strftime(time,"%Y-%m-%d %H:%M:%S") | table my_time,final,Time I have to fields, StartTime and EndTime and I want to measure the difference between them. But I'm not getting even a timestamp conversion for one field. Help please! Thanks PD: I think I don't have the epoch time neither. So my first problem is there 😞 ... View more

Have you looked at this article, which describes how to set up a similar thing? http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/ /k ... View more

HeHe, thanks somesoni2 for correcting the eval command 😉 ... View more

I would use values instead of list in my stats command: sourcetype=csv 409,1 | rex field=_raw "(d+,){2}(?<fieldid>d+)" | rex field=_raw "(d+,){3}(?<headid>d+)" | rex field=_raw "(d+,){44}(?<head_value>d+)" | stats values(fieldid) as field_ID, values(headid) as head_ID, sum(head_value) as Value | eval Parameter = "parameter_1" | eval hex= "112" | eval bell_id= "33" | fields Parameter hex bell_ID field_ID head_ID Value Also, I don't see a need for the search command - you can put that as part of the first search But on closer reading, I think this may be what you want: sourcetype=csv 409,1 | rex field=_raw "(d+,){2}(?<fieldid>d+)" | rex field=_raw "(d+,){3}(?<headid>d+)" | rex field=_raw "(d+,){44}(?<head_value>d+)" | stats sum(head_value) as sumValue by fieldid headid | stats list(fieldid) as field_ID, list(headid) as head_ID, list(sumValue) as Value | eval Parameter = "parameter_1" | eval hex= "112" | eval bell_id= "33" | fields Parameter hex bell_ID field_ID head_ID Value ... View more

values solved this issue for me as well. values removes duplicate values and sorts the data, so this should be kept in mind when considered this approach. ... View more

Getting error - Error in 'multisearch' command: Multisearch subsearches may only contain purely streaming operations (subsearch 1 contains a non-streaming command.) ... View more

In Python, you could use triple quotes to surround the string instead of the single quotes like so: search_query = """sourcetype=csv| search 48,2 | rex field=_raw "(d+,){0}(?<tableid>d+)" | rex field=_raw "(d+,){101}(?<table_value>d+)" | stats list(TableID) as Table, list(Table_value) as Value""" ... View more

@harshal_chakranarayan - I had come across a similar requirement, and used the following app: http://apps.splunk.com/app/570/ (rowcolorizer app) to solve my issue. You have to copy the appserver folder into your app, and change the js and css accordingly to colorize your row according to the particular field. Hope this helps someone. ... View more

All the platform SDKs provide basically the same functionality. With respect to search and query access, it is exactly the same functionality. All that any of the SDKs do is wrap the same REST API, so you should use whatever you like. There are some places (custom search commands, lookups, and alerts) where the first level of integration prefers Python, but in those cases, calls to other run times can either be called directly or wrapped by Python. ... View more

... | eval myval="\"".myval."\"" ... View more

It would b great if you can provide sample output you're expecting... ... View more

Try this index=blah sourcetype=blan-blah [search sourcetype=ALLXMLDATA xmlvar2=* | stats count by source | fields - count] The subsearch will give you list of source (xml files) which has xmlvar2 variable (xmlvar2=* is equivalent to isnotnull(xmlvar2)). Then you use this subsearch to get the "source=abc" in your other search. ... View more

I've been using pyCharm, but I just happened to read this blog post today: http://blogs.splunk.com/2014/02/03/how-to-debug-django-applications-with-pdb-pycharm-and-visual-studio/ It says that visual studio tends to crash when you stop debugging. I haven't had that issue in pyCharm though. ... View more

You can most likely set up distributed searching, so that you configure your laptop Splunk instance to use the office Splunk as a Search Peer. That way it can search both instances and make the correlations. http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Overviewofconfiguration /K ... View more

Hi, I have tried the steps mentioned in above link. But I see no output after restarting Splunk. I have placed my python file in bin folder of the app and defined the call in commands.conf file. Am I doing anything wrong?? ... View more

I am getting the following error message in Splunkd.log file: 1-21-2013 14:02:49.515 +0530 ERROR TailingProcessor - File will not be read, is too small to match seekptr checksum (file=C:\Users\10603218\Desktop\testing.txt). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source At start, the file is empty and after few minutes the data starts getting dumped into the file. ... View more

The simplest way is do use single quotes to wrap the search and double quotes to handle the source. {% searchmanager id="search1" search='source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error' preview=True %} ... View more

Hi, I'm trying to execute a search in the django and get the results in the views.py, Is possible? ... View more