Hello -  I have a table with several columns: Host Src IP Dest IP Src Port Dest Port myHost 10.0.0.1 10.0.0.2 50000 80   I would like to have cell based drills downs.  For example, Host would drill down into a dashboard called host_detail.xml, the rest of the columns would fill the value of the clicked cell to the appropriate filter token. The tokens are called src_ip_tok, dest_ip_tok, src_port_tok, and dest_port_tok.  How would I accomplish this? Thank you. ... View more

Hello All -  Using version 1.7.6 on Splunk Enterprise 8.2.3: Search Error: Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'. | tstats summariesonly=t count from datamodel=Web WHERE (*) sourcetype="websense:cg:kv" Web.mid IN (*) Web.id IN (*) Web.user IN ("**") Web.action IN ("*") Web.src IN ("**") Web.status IN ("*") Web.http_method IN ("*") Web.category IN ("*") Web.dest IN ("***") Web.http_user_agent IN ("**") by Web.http_user_agent | rename Web.* as * | stats sum(count) as "count" by http_user_agent | lookup user_agents http_user_agent | table count ua_family http_user_agent | sort 0 -count From Job Inspector: 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': File "/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py", line 54 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': results = user_agent_parser.Parse(http_user_agent) 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': ^ 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': TabError: inconsistent use of tabs and spaces in indentation 08-30-2022 14:30:38.153 ERROR ExternalProvider [53774 StatusEnforcerThread] - Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'. 08-30-2022 14:30:38.153 ERROR SearchStatusEnforcer [53774 StatusEnforcerThread] - StatusEnforcerThread failed with error: Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'. 08-30-2022 14:30:38.153 INFO ReducePhaseExecutor [53774 StatusEnforcerThread] - ReducePhaseExecutor=1 action=CANCEL 08-30-2022 14:30:38.153 INFO DispatchExecutor [53774 StatusEnforcerThread] - User applied action=CANCEL while status=0 08-30-2022 14:30:38.153 ERROR SearchStatusEnforcer [53774 StatusEnforcerThread] - sid:_amFzb25faG90Y2hraXNzQGFvLnVzY291cnRzLmdvdg_amFzb25faG90Y2hraXNzQGFvLnVzY291cnRzLmdvdg_bmxzX1VJX2Rldg__search32_1661869827.397931_B7BA11EF-467A-4E74-B057-FC9CAC03F269 Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'. Any suggestions on how to fix this?  Thank you. ... View more

I would like to determine how many times an app on a deployment server has been deployed.  I'm not concerned with the host information.  I'm trying to determine which Apps are no longer being used and can be archived.  I suspect it would come from the | rest command. | rest splunk_server=127.0.0.1 /services/deployment/server/clients I'm just not sure which fields and how to accurately calculate this. Looking for suggestions. ... View more

Hello -  I'm working with a dashboard with a time picker with the token value of $time$.  This time is currently set to the value of another field using: | eval _time = _mytime I have a timechart in a dashboard with the following values: Results in :   | timechart count limit=24 useother=f usenull=f 2021-10-26 1 2021-10-27 417 2021-10-28 36 2021-10-29 15 2021-10-30 21 2021-10-31 3 2021-11-01 10 2021-11-02 3 2021-11-03 1 When I click on a bar in the time chart, for example, the bar for 2021-10-27, I would like my time picker to change to that date, and redraw the dashboard for all the events for that day. I tried setting <drilldown> <set token="time_earliest">$earliest$</set> <set token="time_latest">$latest$</set> </drilldown> I have also tried <drilldown> <set token="fomr.time_earliest">$earliest$</set> <set token="form.time_latest">$latest$</set> </drilldown> Any suggestions? ... View more

Hello - I am using the following two searches: The first search is creating a table consisting of _time, idx, and b.  There are two other fields available, s for source and h for host.  However, we squash this information for performance reasons. index=_internal sourcetype=splunkd type=Usage source=*license_usage.log | table _time idx b | rename idx as index, b as bytes I have been trying to figure out a way to substitute the s & h data in the events by using a join, append, or appendcols using: | tstats count WHERE index=* sourcetype=* source=* unit_id=* by index, sourcetype, source, host, dept | table index, sourcetype, source,  host, dept Join Example: | tstats count WHERE sourcetype=* source=* host=* unit_id=* by index sourcetype source host dept | table index sourcetype source host dept | join type=inner index [ search index=_internal sourcetype=splunkd type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" | table _time idx b | rename idx as index, b as bytes] Append Example: | tstats count WHERE sourcetype=* source=* host=* unit_id=* by index sourcetype source host dept | table index sourcetype source host dept | append [ search index=_internal sourcetype=splunkd type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" | table _time idx b | rename idx as index, b as bytes] AppendCols Example: | tstats count WHERE sourcetype=* source=* host=* unit_id=* by index sourcetype source host dept | table index sourcetype source host dept | appendcols [ search index=_internal sourcetype=splunkd type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" | table _time idx b | rename idx as index, b as bytes] Results: join: just fails with no data append: the _time and bytes fields are blank appendcols: leaves out the _time field - which I need to create timecharts with. The end result should look like this: _time  index   sourcetype   source   host   dept   bytes where _time, index, bytes comes from the _internal logs where index, sourcetype, source, host, dept comes from the | tstats logs Any help is greatly appreciated.  Thank you. ... View more