I'm not sure if this is the correct way to put a suggestion. But it would be great to have Splunk DBConnect with SQlite (serverless) database which would help in building some wonderful applications. Cheers ... View more

Hi, I'm in process of enabling SplunkJS Stack as per this link (Splunk 6.0.1) I was able to install "myWebApp" successfully using.. /opt/splunk/etc/apps/framework/splunkdj createapp myWebApp But when I'm running the app via GUI, it throws error.. Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 1237, in communicate req.respond() File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 554, in respond self._respond() File "/opt/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/__init__.py", line 566, in _respond response = self.wsgi_app(self.environ, self.start_response) File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cptree.py", line 239, in __call__ return app(environ, start_response) File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/wsgi.py", line 255, in __call__ response = self.get_response(request) File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/base.py", line 178, in get_response response = self.handle_uncaught_exception(request, resolver, sys.exc_info()) File "/opt/splunk/etc/apps/framework/server/splunkdj/management/commands/runwsgiserver.py", line 189, in handle_uncaught_exception return super(LoggingWSGIHandler, self).handle_uncaught_exception(request, resolver, exc_info, *args, **kwargs) File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/base.py", line 220, in handle_uncaught_exception if resolver.urlconf_module is None: File "/opt/splunk/lib/python2.7/site-packages/django/core/urlresolvers.py", line 342, in urlconf_module self._urlconf_module = import_module(self.urlconf_name) File "/opt/splunk/lib/python2.7/site-packages/django/utils/importlib.py", line 35, in import_module __import__(name) File "/opt/splunk/etc/apps/framework/server/urls.py", line 114, in <module> jsurls.create_javascript_urlpatterns() File "/opt/splunk/etc/apps/framework/server/splunkdj/utility/jsurls.py", line 83, in create_javascript_urlpatterns makedirs(dirpath) File "/opt/splunk/lib/python2.7/os.py", line 157, in makedirs mkdir(name, mode) OSError: [Errno 13] Permission denied: '/opt/splunk/etc/apps/framework/server/static/JS_CACHE' Btw, I've checked permission for directories and as far as i can see all are fine. I'm not sure if any of you guys have seen it. IF yes, any solution? ... View more

We got a requirement to extract information from log file. The log file contains JSON data which is the bread-butter for splunk. This is a mixed data whereby the logging application puts some info like logging time| messageSeverity | class | thread etc.. Later, the JSON message starts like - [{ json }]. 2013-12-23T14:55:09.574+0000|INFO|glassfish3.1.2|javax.enterprise.system.std.com.sun.enterprise.server.logging|_ThreadID=102;_ThreadName=Thread-2;|2013-12-23 14:55:09,574 DEBUG parent-container$child#1-10 [] com.abc.transform.listeners.xyz- [{ "timestamp" : "2013-12-23T14:55:09.558Z", "host" : "myPC", "event_id" : "1234", "customer_id" : "123456", ... ... "country" : "Canada", "product" : "iPad", "msg" : "Hello Guys", "transaction_id" : "100200300400" } }] | Please note that this JSON is not fixed, so it can extend to extra lines. How to extract the JSON data alone into key-value pairs for easy presentation? ... View more

Hi I'm having issues while running script command within the search. I've tried running something like .. | savedsearch UsersCount_byDomain_Pie | script python SavedSearch.py I've updated "commands.conf" in $SPLUNK_HOME/etc/apps/myApp/local (also tried $SPLUNK_HOME/etc/apps/myApp ) and have restarted splunk cat commands.conf [samplePython] FILENAME = SavedSearch.py I've kept the script under $SPLUNK_HOME/etc/apps/myApp/bin Error Shown Error in 'script' command: The external search command 'SavedSearch.py' does not exist in commands.conf. I've checked the Saved Search and the python Script individually and it works. i'm confused if I need to provide absolute path (the example shown in Splunk docs is not sufficient) in the search string? (My confusion is "where would you keep the commands.conf and the script ?" I'm not convinced if splunk recognizes the myApp/bin directory correctly) ... View more

Unfortunately, i'm unable to get a forwarder app deployed using deployment Server. Below is what I' ve done till now (Splunk 5.0.2) - Port Connections Ok - Able to phone home correctly from forwarder @Deployment Server App: /opt/splunk/etc/deployment-apps/UNIX_FWDER serverclass: /opt/splunk/etc/system/local/serverclass.conf @Deployment client Expected Forwarder app location: /opt/splunkforwarder/etc/apps DeplomentClient Conf: /opt/splunkforwarder/etc/apps/deployclient/local/deploymentclient.conf As per Splunk Wiki I did lot of debugging. Turned on DEBUG in client & Server. Client log is 12-03-2013 14:47:06.736 +0000 DEBUG DeploymentClient - Phone home recvd reply: <?xml version="1.0" encoding="UTF-8"?>\n<deployResponse restartSplunkd="true" restartSplunkWeb="false" stateOnClient="enabled" repositoryLocation="$SPLUNK_HOME/etc/apps" endpoint="$deploymentServerUri$/services/streams/deployment?name=$tenantName$:$serverClassName$:$appName$">\n <serverClass name="FWDR1"/>\n</deployResponse>\n serverclass.conf [global] restartSplunkd = true [serverClass:FWDR1] whitelist.0=* So definitely, the Client is identifying the Server class and phoning every 60s. But the apps are NOT copied from "deployment-apps" in Server to "/opt/splunkforwarder/etc/apps" in the client. Anyone Experienced this issue before? ... View more

hi Folks, I'm fairly new to splunk. I've written a script to get logs from F5 using SNMP. The events retrieved are - 2 events after x seconds (LEG1 & LEG2) per same messageID per F5SERVERNAME A sample is given below F5SERVERNAME=DENVER messageID=1383665849; LEG=2; RUNTIMEEPOCH=1383665910; sysStatHttpRequests=0; sysHostMemoryUsed=4108898304; sysStatMemoryUsed=84254856; sysStatClientCurConns=28; sysStatServerCurConns=28; F5SERVERNAME=DENVER messageID=1383665849; LEG=1; RUNTIMEEPOCH=1383665876; sysStatHttpRequests=0; sysHostMemoryUsed=4108128256; sysStatMemoryUsed=84262776; sysStatClientCurConns=27; sysStatServerCurConns=27; F5SERVERNAME=SIGMAS messageID=1383665849; LEG=2; RUNTIMEEPOCH=1383665901; sysStatHttpRequests=7816342; sysHostMemoryUsed=4109127680; sysStatMemoryUsed=85828904; sysStatClientCurConns=118; sysStatServerCurConns=118; F5SERVERNAME=SIGMAS messageID=1383665849; LEG=1; RUNTIMEEPOCH=1383665867; sysStatHttpRequests=7816342; sysHostMemoryUsed=4108111872; sysStatMemoryUsed=85845016; sysStatClientCurConns=113; sysStatServerCurConns=113; The aim is to do calculations on messages from same F5SERVERNAME with same messageID eg MEMORY_USED_PER_SECOND= (LEG2:sysStatMemoryUsed - LEG1:sysStatMemoryUsed ) / (LEG2:RUNTIMEEPOCH - LEG1:RUNTIMEEPOCH) My aim is to do the calculations and put the search as a saved search or macro. So the results can be exported into csv. I tried transaction command, but I couldn't find a name to subtract values as they have same variable names Any help would be much appreciated. Cheers ... View more