We are trying to create a data model with a custom _time field. We created the data model, and added a calculated field (SUBMIT_DATE_cron_e) that calculates a UNIX time with microseconds (like 1619093900.0043). We then created another calculated field called _time, and set this equal to SUBMIT_DATE_cron_e. This effectively overwrites the inherited (or original) _time field. These steps worked well.  A problem occurred when setting the data model to accelerated. If I do a search on the data model during the acceleration build process, and I inspect the _time field, I see times in UNIX format with microseconds (like 1619093900.0043), as intended. However as the build progresses, the _time values change to UNIX time with no microseconds (like 1619093900). It looks like the _time field is truncated to have only seconds. Is this according to design for accelerated data models? Is there a way to have a _time field in UNIX format with micro seconds? ... View more

I'm trying to get the time-based functionality to work on a kvstore, but I'm not getting anywhere. I have taken a look at the other posts on this topic, but I can't get it working.  My collections.conf file: [tracking] enforceTypes=true field.dashboard = string field.idhash = string field.misc = string field.time = number My transforms.conf file: [tracking] collection = tracking external_type = kvstore fields_list = _key,time,dashboard,misc,idhash time_field = time time_format = %s I am adding records to the kvstore via the API, and I'm writing the time in epoch form (seconds, 10 digits). I'm mainly following the directions is this post: https://community.splunk.com/t5/Splunk-Search/How-to-get-time-based-lookups-working-with-KV-Store/m-p/221824  It looks like Splunk isn't recognising the time format - when I do a time based search, all the records in the kvstore are returned (| inputlookup tracking). ... View more

Hi I'm trying to make use of the Forecast Chart Visualisation. I have added this visualisation to my dashboard, but I'm getting this message when I run a search: Error rendering Forecast Chart visualization: This visualization requires the `forecastviz` or `smartforecastviz` macro to generate data. See the custom visualization docs for details. I have set the correct permissions for the MLTK. I have also located the forecastviz(4) macro in the macros.conf file (in /etc/apps/Splunk_ML_Toolkit/default). ... View more

Good day I'm trying to write a python script that will be called from Splunk search. The script has a generating command: @Configuration(type='reporting') class getInfo(GeneratingCommand): def generate(self): .... .... After the generating command I want to send an email. I have managed to get the generating command working, as well as the email sending working, but not both in the same script. For the generating command, the commands.conf file details are: [kvstoreupdate] filename = kvstore_update.py chunked = true generating = true For the sendemail script the commands.conf is: [testemail] filename = email_test.py streaming = false run_in_preview = false passauth = true required_fields = changes_colorder = false supports_rawargs = true undo_scheduler_escaping = true is_risky = true supports_multivalues = true I have found that the testemail script does not work if I set "chunked=true" i.e. make use of SCPv2. Conversely, the generating command does not work if "chunked=true" is not set - I get the error:  Script output = "chunked 1.0,426,0.... .... .... Failed to parse transport header: authString:<auth> .... ...." I'm wondering if it is possible to do both of these actions, since they seem to be compatible with different versions of SCP...? ... View more