I don't know how to word this request very effectivly so I will just show some examples... If anyone knows a better way to word the title of this post, please do. I have my search setup to return the fields and values I want (see below). I need the Month field to be column headers so transpose seems to be the best option for this... Except for 1 little wrinkle. It looks like this: column row 1 row 2 Month 08 Aug 2014 09 Sep 2014 New 53 228658 Reconnect 0 59913 Ratio 0 3.816501 Total Sessions 53 288571 This is close, I am looking to have this though: How do I make this happen? Here is the actual search: earliest=-1mon@mon latest=@mon `xd_index` sourcetype=xendesktop:*:session SiteName="*" SiteName!=*ST UserName!="" StartTime!="" BrokeringTime!="" | stats latest(EstablishmentDuration) as EstablishmentDuration, latest(BrokeringDuration) as BrokeringDuration by BrokeringTime, SessionKey, SiteName | eventstats min(BrokeringTime) as min_BrokeringTime by SessionKey | eval connection_type=if(BrokeringTime=min_BrokeringTime, "New", "Reconnect") | eval timestamp=strptime(min_BrokeringTime, "%m/%d/%Y %H:%M:%S") | eval Month=strftime(timestamp, "%m %b %Y") | chart count by Month, connection_type | eval Ratio=New/Reconnect | eval "Total Sessions"=New+Reconnect | transpose 12 ... View more

I am configuring a Remedy integration with Splunk to use the Remedy WSDL feature to generate tickets in Remedy via Splunk. I have the python script setup and working. The snag I have run into is when trying to add a work flow action for manual ticket creation, I cannot figure out how to get the alert_actions script (which sets up the authentication to Remedy) to be used in the workflow action for manual ticket creation from the Splunk UI. I guess I need to know how to call the python script I have included below in a work flow action... Any help would be greatly appreciated! This is the code that works for the auto ticket creation using alert_actions.conf for the WSDL (I removed sensitive info): #!/usr/bin/python import logging from suds.client import Client logging.basicConfig(level=logging.INFO) logging.getLogger('suds.client').setLevel(logging.DEBUG) #import logging logging.basicConfig(level=logging.INFO) logging.getLogger('suds.client').setLevel(logging.DEBUG) logging.getLogger('suds.transport').setLevel(logging.DEBUG) #url = 'http://[server_name]:8081/arsys/WSDL/public/[server_name]/HPD_IncidentInterface_Create_WS' url = 'http://[server_name]:8081/arsys/WSDL/public/[server_name]/HPD_IncidentInterface_Create_WS' client = Client(url, username='$username$', password='$password$') print client user = client.factory.create('AuthenticationInfo') user['userName'] = '$username$' user['password'] = '$password$' client.set_options(soapheaders=user) result = client.service.HelpDesk_Submit_Service( Reported_source='Systems Management', Impact='3-Moderate/Limited', Urgency='3-Medium', Notes='Threat Detection Test', Service_Type='User Service Request', Action='CREATE', First_Name='SSLContract', Last_Name='Management', Summary='Threat Detection Test 2', Product_Name='SSL Certificate', Product_Categorization_Tier_1='Software', Product_Categorization_Tier_2='Application', Product_Categorization_Tier_3='Information Security', Categorization_Tier_1='Threat Management', Categorization_Tier_2='Remediate', Categorization_Tier_3='Worm', ) '''result = client.service.HelpDesk_Submit_Service( Assigned_Group='cyber_security', Assigned_Group_Shift_Name='', Assigned_Support_Company='[Company_Name]', Assigned_Support_Organization='', Assignee='', Categorization_Tier_1='', Categorization_Tier_2='', Categorization_Tier_3='', CI_Name='', Closure_Manufacturer='', Closure_Product_Category_Tier1='', Closure_Product_Category_Tier2='', Closure_Product_Category_Tier3='', Closure_Product_Model_Version='', Closure_Product_Name='', Department='', First_Name='', Impact='4-Minor/Localized', Last_Name='', Lookup_Keyword='', Manufacturer='Remedy', Product_Categorization_Tier_1='' , Product_Categorization_Tier_2='', Product_Categorization_Tier_3='', Product_Model_Version='', Product_Name='Remedy', Reported_Source='', #This should be of type Reported_SourceType Resolution='', Resolution_Category_Tier_1= , Resolution_Category_Tier_2= , Resolution_Category_Tier_3= , Service_Type Service_Type='User Service Restoration', Status='New', Action='New' , Create_Request='', Summary='Testing - Cyber Security - Ignore - Summary', Notes='Testing - Cyber Security - Ignore - Notes', Urgency='4-Low' , Work_Info_Summary= , Work_Info_Notes= , Work_Info_TypeType , Work_Info_Type= , Work_Info_Date= , #Work_Info_SourceType , #Work_Info_Source= , #Create_RequestType , #Work_Info_Locked= , #Work_Info_View_AccessType , #Work_Info_View_Access= , #Middle_Initial= , #Status_ReasonType, #Status_Reason= , #Direct_Contact_First_Name= , #Direct_Contact_Middle_Initial= , #Direct_Contact_Last_Name= , #TemplateID= , #ServiceCI='tavm', #ServiceCI_ReconID= , #HPD_CI= , #HPD_CI_ReconID= , #HPD_CI_FormName= , #WorkInfoAttachment1Name= , #WorkInfoAttachment1Data= , #WorkInfoAttachment1OrigSize= , Login_ID='userid', #Incident_Number='INC999999', #Direct_Contact_Company='[Company Name]' )''' print result #remedy_prob.set_options(soapheaders=user) #print client.service.queryModuleNames("param1") # this is an exposed method #print client.last_received() # this is handy to see #remedy_prob = suds.client.Client(prob_url) #user = remedy_prob.factory.create('AuthenticationInfo') ##user['userName'] = 'user' #user['password'] = 'password' #remedy_prob.set_options(soapheaders=user) #Service ( HPD_IncidentInterface_Create_WSService ) tns="urn:HPD_IncidentInterface_Create_WS" # Prefixes (1) # ns0 = "urn:HPD_IncidentInterface_Create_WS" # Ports (1): # (HPD_IncidentInterface_Create_WSPortTypeSoap) # Methods (1): # HelpDesk_Submit_Service(xs:string Assigned_Group, xs:string Assigned_Group_Shift_Name, xs:string Assigned_Support_Company, xs:string Assigned_Support_Organization, xs:string Assignee, xs:string Categorization_Tier_1, xs:string Categorization_Tier_2, xs:string Categorization_Tier_3, xs:string CI_Name, xs:string Closure_Manufacturer, xs:string Closure_Product_Category_Tier1, xs:string Closure_Product_Category_Tier2, xs:string Closure_Product_Category_Tier3, xs:string Closure_Product_Model_Version, xs:string Closure_Product_Name, xs:string Department, xs:string First_Name, ImpactType Impact, xs:string Last_Name, xs:string Lookup_Keyword, xs:string Manufacturer, xs:string Product_Categorization_Tier_1, xs:string Product_Categorization_Tier_2, xs:string Product_Categorization_Tier_3, xs:string Product_Model_Version, xs:string Product_Name, Reported_SourceType Reported_Source, xs:string Resolution, xs:string Resolution_Category_Tier_1, xs:string Resolution_Category_Tier_2, xs:string Resolution_Category_Tier_3, Service_TypeType Service_Type, StatusType Status, xs:string Action, Create_RequestType Create_Request, xs:string Summary, xs:string Notes, UrgencyType Urgency, xs:string Work_Info_Summary, xs:string Work_Info_Notes, Work_Info_TypeType Work_Info_Type, xs:dateTime Work_Info_Date, Work_Info_SourceType Work_Info_Source, Create_RequestType Work_Info_Locked, Work_Info_View_AccessType Work_Info_View_Access, xs:string Middle_Initial, Status_ReasonType Status_Reason, xs:string Direct_Contact_First_Name, xs:string Direct_Contact_Middle_Initial, xs:string Direct_Contact_Last_Name, xs:string TemplateID, xs:string ServiceCI, xs:string ServiceCI_ReconID, xs:string HPD_CI, xs:string HPD_CI_ReconID, xs:string HPD_CI_FormName, xs:string WorkInfoAttachment1Name, xs:base64Binary WorkInfoAttachment1Data, xs:int WorkInfoAttachment1OrigSize, xs:string Login_ID, xs:string Direct_Contact_Company, ) # Types (13): # AuthenticationInfo # CreateInputMap # CreateOutputMap # (1000000163, new Value(4000)); // Impact - (High) 1000/2000/3000/4000 (Low) #newEntry.put(1000000162, new Value(4000)); // Urgency - (High) 1000/2000/3000/4000 (Low) #newEntry.put(1000000000, new Value("xyz")); // Description #newEntry.put(1000000151, new Value("xyz")); // Details #newEntry.put(1000000099, new Value(0)); // Service Type - 0/1/2/3 #newEntry.put(240001002, new Value("xyz")); // Product Name #newEntry.put(200000003, new Value("xyz")); // Product Cat Tier 1 #newEntry.put(240001002, new Value("xyz")); // Product Cat Tier 2 #newEntry.put(200000005, new Value("xyz")); // Product Cat Tier 3 #newEntry.put(1000000063, new Value("xyz")); // Operational Cat Tier 1 #newEntry.put(1000000064, new Value("xyz")); // Operational Cat Tier 2 #newEntry.put(1000000217, new Value("xyz")); // Assigned Group #newEntry.put(1000000054, new Value("xyz")); // Corporate ID #newEntry.put(2, new Value("Demo")); Create_RequestType # ImpactType # Reported_SourceType # Service_TypeType # StatusType # Status_ReasonType # UrgencyType # Work_Info_SourceType # Work_Info_TypeType # Work_Info_View_AccessType # # #newEntry.put(7, new Value(0)); // Status #newEntry.put(8, new Value("This record is created via Java API")); // Short Description #newEntry.put ... View more

Just to explain why I have to do this... Rack space is at a premium where I work so we had to consolidate our footprint in the data center. I have successfully consolidated 14 physical indexers to 7 physical indexers with 2 instances of Splunk running on each server. Specs for those Indexing servers are: OS: Linux Red Hat CPU: 16-core 3.2 GHz RAM: 128GB HDD: SAN attached, 3 mounts per instance at 3500 IOPS per mount I am trying to setup the serverclass.conf file to manage the instances on the indexers separately because the mount points for the indexes are different based on the instance name. How can I do this? I have read the serverclass.conf documentation and cannot find it documented in there anywhere... ... View more

A vendor is requesting that we Poke several TCP ports and send specific text to capture application status. "Poke 8080, send http GET for / and Poke TCP 5222 and send string 'test123'". I know how to use powershell to initiate a telnet connection to the ports and monitor port status that way: $Port = 8080,5222,5223 foreach ($P in $Port) { $Socket = New-Object Net.Sockets.TcpClient $Computer = "LocalHost" $RunTime = get-date # Suppress error messages $ErrorActionPreference = 'SilentlyContinue' # Try to connect $Socket.Connect($Computer, $P) # Determine if we are connected. if ($Socket.Connected) { "$RunTime Port $P is open" $Socket.Close() } else { "$RunTime Port $P is closed" } } $Socket = $null How can I modify this code to also pass a text string or command? ... View more

I have to use a root search in a pivot due to needing to join another data type. Is there a way to get _time to extract as Time? I have setup an eval in the pivot to extract the _time field but it wants to define _time as a string. Is there anyway to fix this? ... View more

I have been trying to figure this out for the better part of an hour and have searched through the documentation. I might be searching using the wrong terminology... so I apologize in advance if this has been answered already. I have a bar chart with facilities as labels on the X-Axis. The chart makes them 9px, which is way too small for our end users to see without zooming in (sadly, most don't know they can do this). I dug around through the style info that is default for the chart module. Apparently the CSS is done in-line so making a single change to an application.css seems to be out of the question. Knowing this, I am thinking I will need to create a custom application.js to replace the default settings that Splunk uses when compiling the dashboard chart from XML... Am I making this more complected than it needs to be or am I on the right track? ... View more