I have events that are all 144 chars. Is there a setting in props.conf (not regex) that I can use to specify 144 chars to break after? I can't find anything in the docs. If not, does anyone have a solid regex to do this? ... View more

Hi guys, I have a field value like so: <img src="http://site.com/myimage.png"> Is there a quick and dirty way to get this to display as HTML (as an image) using a native simple Splunk XML dashboard (without reverting it to HTML, django bindings, etc) Thanks! ... View more

Happy Monday everyone! I am trying to query collections in my app using the API like so (note, I am using a different password for admin): curl -k -u admin:changeme "https://0.0.0.0:8089/servicesNS/nobody/MYAPP/storage/collections/config" I get the following response. <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Unauthorized</msg> </messages> </response> I am using admin account which has read and write permissions for MYAPP. UPDATE: I think this may be an API permission issue to MYAPP. So, if I run the same query on the search app (without any collections created) I get a valid response, i.e: curl -k -u admin:changeme "https://0.0.0.0:8089/servicesNS/nobody/search/storage/collections/config" As soon as I create a collection in the search app, I then get the unauthorised response again. Argh! Then I thought it my be an issue running it as nobody, or admin on the collections. So I explicitly set owner=nobody in MYAPP/metadata/local for each collection. Still fail. UPDATE: my collections.conf is very basic [myfirstcollection] [mysecondcollection] In transforms I use these for a lookup for searching: [kvstore_myfirst_lookup] external_type = kvstore collection = myfirstcollection fields_list = _key, firstKV [kvstore_second_lookup] external_type = kvstore collection = mysecondcollection fields_list = _key, secondKV I cannot find what permissions I need to set in my app to make this work 😞 Any ideas? ... View more

This DOES NOT work: curl -k -u admin:changeme "https://0.0.0.0:8089/services/receivers/simple?source=mysource&index=myindex" -d {"somefield":"foobar”} This DOES work: curl -k -u admin:changeme "https://0.0.0.0:8089/services/receivers/simple?source=mysource&index=myindex" -d somefield=foobar Looking at the docs (http://dev.splunk.com/view/SP-CAAADQT), I think this is hinting at why the first request is broken "The -d/--post-data arguments for curl/wget need to be url-encoded, should they have characters needing escaping." Can someone tell me how a JSON data should be formatted to be submitted like this? Thanks! ... View more

Hi guys What are the fewest number of Splunk capabilities I need to assign to a user role to send data into an index (via SPLK API POST request)? Use-case - I have an app configured to send data to Splunk via the REST API, using a Splunk user account to authenticate. For security I want to limit the number of capabilities this account has, so that it can only be used to post data into an index (assigning sourcetype, source, index in the request). Thanks! ... View more

hi everyone, looking for some best practice, advice, and awesomeness from you guys on this one. has anyone ever tried calculating speed from lat / long fields in data? for example, I have a .gpx data that looks like this: <time>2015-02-27T09:03:01.000-07:00</time></trkpt> <trkpt lat="43.58573655" lon="-110.82813699"> <ele>1930.0</ele> <time>2015-02-27T09:03:02.000-07:00</time></trkpt> <trkpt lat="43.58597959" lon="-110.82789655"> <ele>1918.0</ele> <time>2015-02-27T09:03:18.000-07:00</time></trkpt> <trkpt lat="43.5859905" lon="-110.82785591"> <ele>1918.0</ele> <time>2015-02-27T09:03:19.000-07:00</time></trkpt> <trkpt lat="43.58598692" lon="-110.8278205"> <ele>1918.0</ele> fields = _time, lat, lon, ele i want to calculate some basic metrics - average speed, top speed - and would love to hear opinions on searches to tackle this so I'm not reinventing the wheel. in the future I will build in some playback element to view the route vs. speed in splunk but for now I just want to know how others have tackled this. examples = kudos 🙂 thanks in advance! -dave ... View more