Hi I was following instructions as per "Web Framework Tookit" instructions to create a bubble chart into one of my app. When I follow the instructions, I'm getting error as below when I open "Web Framework Tookit" Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 1237, in communicate req.respond() File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 554, in respond self._respond() File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 566, in _respond response = self.wsgi_app(self.environ, self.start_response) File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cptree.py", line 239, in __call__ return app(environ, start_response) File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/wsgi.py", line 255, in __call__ response = self.get_response(request) File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/base.py", line 178, in get_response response = self.handle_uncaught_exception(request, resolver, sys.exc_info()) File "/opt/splunk/etc/apps/framework/server/splunkdj/management/commands/runwsgiserver.py", line 189, in handle_uncaught_exception return super(LoggingWSGIHandler, self).handle_uncaught_exception(request, resolver, exc_info, *args, **kwargs) File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/base.py", line 220, in handle_uncaught_exception if resolver.urlconf_module is None: File "/opt/splunk/lib/python2.7/site-packages/django/core/urlresolvers.py", line 342, in urlconf_module self._urlconf_module = import_module(self.urlconf_name) File "/opt/splunk/lib/python2.7/site-packages/django/utils/importlib.py", line 35, in import_module __import__(name) File "/opt/splunk/etc/apps/framework/server/urls.py", line 68, in <module> app_module = importlib.import_module(app) File "/opt/splunk/lib/python2.7/site-packages/django/utils/importlib.py", line 35, in import_module __import__(name) ImportError: No module named mySampleApp The instructions were to: When the toolkit is installed: reference components in the toolkit When the Web Framework Toolkit is installed on the same Splunk instance as your app, you can reference the toolkit components from your app by loading the component libraries directly from the toolkit. Just require the component library using a relative path such as "splunk_wftoolkit/components/component_name/component_name". And, be sure to verify that the latest version of the toolkit is deployed on the server. Any ideas how to fix the error? Also how to access the newly generated views in mySampleApp? ... View more

We got a scenario whereby there are multiple search heads. (Say 2x of them). The main reason being load balancing (both active), providing redudancy etc. Hence logging from end-user seems fine. The challenge with us is, alerting configuration. Splunk searches bulk of data every 2 minutes and sends alerts to Tivoli. Inorder to bring consistency, the same app package is deployed into all Search Heads. Thus the alerting functionality is active at all SHeads. But as a result of this configuration , the alerts are duplicated. (i.e. same alerts pushed from all SHeads) Is there any way/method to prevent this? We can't disable schedule searches as we don't know in case of a failure no one notices it. ... View more

In Splunk6 default simple xml dashboards, there is an option to Open Dashboard as a search. This is particularly useful for debugging purposes. ("Open in Search" option) Is there a similar option with Sideview Utils dashboards/charts? ... View more

We have got a main "Splunk License Server " with few slaves connecting to it. As part of automation, whenever slaves are installed a new entry will be added to point to the license server. ./splunk edit licenser-localslave -master_uri 'https://master:port' This was the case until I changed the logic to make the license handling as part of app. But unfortunately, I can see multiple entries in the Splunk Master, showing reoccurence of the slaves!! i.e. same slaves appearing multiple times. Is there a way to configure them in a config file from the Master? (or has to be deleted?) ... View more

Hi folks We got a requirement to auto-refresh the panels. The underlying search are "SavedSearch" results. But I'm not able to get the Autorefresh-Postprocess-SavedSearch combo to work. I've also tried HiddenSavedSearch. Below snippet is what I did. Any ideas to get SavedSearch to be autorefreshed? Sample_Internal_Search index="_internal" earliest=-5m | stats count by sourcetype, host SideView SavedSearch - Part1 <module name="AutoRefresh" layoutPanel="panel_row2_col1"> <param name="refreshEvery">30</param> <module name="SavedSearch" layoutPanel="panel_row2_col1_grp1" autoRun="True"> <param name="name">Sample_Internal_Search</param> <module name="HiddenPostProcess"> <param name="search"> | stats sum(count) as INTERNALCOUNT</param> <module name="HTML"> <param name="html"><![CDATA[ <h3>SavedSearch Internal events: $results[0].INTERNALCOUNT$</h3> ]]></param> </module> </module> </module> Splunk Built-in HiddenSavedSearch - Part2 <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp2" autoRun="True"> <param name="savedSearch">Sample_Internal_Search</param> <module name="PostProcess"> <param name="search"> | stats sum(count) as INTERNALCOUNT</param> <module name="HTML"> <param name="html"><![CDATA[ <h3>HiddenSavedSearch Internal events: $results[0].INTERNALCOUNT$</h3> ]]></param> </module> </module> </module> Normal Search - Part3 <module name="Search" layoutPanel="panel_row2_col1_grp3" autoRun="True"> <param name="search">index="_internal" earliest=-5m | stats count by sourcetype, host</param> <module name="PostProcess"> <param name="search"> | stats sum(count) as INTERNALCOUNT</param> <module name="HTML"> <param name="html"><![CDATA[ <h3>Search Internal events: $results[0].INTERNALCOUNT$</h3> ]]></param> </module> </module> </module> </module> The normal Search (part3) of XML works perfectly. But the other two values never refreshes. But of course Part3 queries the system everytime per user !! ... View more

Hi I have savedSearch which should alert every 1 min. The searchname is "myApp_Alert_1m" and the file produced is "myApp_Alert_1m.csv" . My Script is kept in $SPLUNK_HOME/bin/scripts/myAlert.py So my SavedSearch outputs this file .. | outputcsv myApp_Alert_1m How can I pass this filename as a parameter into "myAlert.py"? ( I tried putting into Enable Script where it shows "File name of shell script to run" with option, but not getting any output. ) ... View more