Found snippet example using Python internal SDK: Fired_alert.py Provides object mapping for fired alerts objects Example use case: sessionKey = splunk.auth.getSessionKey('admin','changeme') s = SavedSearch.get('/servicesNS/admin/search/admin/savedsearch/someAlert') alerts = s.get_alerts() # print them all for a in alerts: print a.severity, str(a.trigger_time), str(action) #now delete the most recent one alerts[0].delete() ... View more

Check the CLI test. From $SPLUNK_HOME/bin Check help for test... ./splunk test help ./splunk test sourcetype Example: ./splunk test sourcetype /opt/tradelog/trade_entries.log PROPERTIES OF /opt/log/tradelog/trade_entries.log Attr:ANNOTATE_PUNCT True Attr:BREAK_ONLY_BEFORE Attr:BREAK_ONLY_BEFORE_DATE True Attr:CHARSET UTF-8 Attr:DATETIME_CONFIG /etc/datetime.xml Attr:HEADER_MODE Attr:LEARN_SOURCETYPE true Attr:LINE_BREAKER_LOOKBEHIND 100 Attr:MAX_DAYS_AGO 2000 Attr:MAX_DAYS_HENCE 2 Attr:MAX_DIFF_SECS_AGO 3600 Attr:MAX_DIFF_SECS_HENCE 604800 Attr:MAX_EVENTS 256 Attr:MAX_TIMESTAMP_LOOKAHEAD 44 Attr:MUST_BREAK_AFTER Attr:MUST_NOT_BREAK_AFTER Attr:MUST_NOT_BREAK_BEFORE Attr:SEGMENTATION indexing Attr:SEGMENTATION-all full Attr:SEGMENTATION-inner inner Attr:SEGMENTATION-outer outer Attr:SEGMENTATION-raw none Attr:SEGMENTATION-standard standard Attr:SHOULD_LINEMERGE False Attr:TRANSFORMS Attr:TRUNCATE 10000 Attr:is_valid True Attr:maxDist 100 Attr:sourcetype trade_entries-2 Note attributes including sourcetype. ... View more

4.2 documentation still shows: The PDF Server is supported on any Linux server that: is running Splunk 4.1 or later has the Xvfb X server, xauth and base fonts installed has glibc 2.3 or later installed (glibc 2.4 required for 64 bit systems, eg. Centos 5.0 or later) ... View more

I usually go to the Manager->System settings->System logging view change the ExecProcessor to DEBUG mode. Then I usually search ... index=_internal execprocessor to see if Splunk is running the script. Example I have a ps.sh script running in the UNIX app. Splunk is picking it up as you see below.. 9:55:21.288 AM 01-07-2011 09:55:21.288 INFO ExecProcessor - Ran script: /home/rrpdfserver/opt/splunk/etc/apps/unix/bin/ps.sh, took 30.86 milliseconds to run, 17392 bytes read host=class2.splunk.com Options| sourcetype=splunkd Options| source=/home/rrpdfserver/opt/splunk/var/log/splunk/splunkd.log Options 2 1/7/11 9:55:21.255 AM 01-07-2011 09:55:21.255 DEBUG ExecProcessor - Running: /home/rrpdfserver/opt/splunk/etc/apps/unix/bin/ps.sh host=class2.splunk.com Options| sourcetype=splunkd Options| source=/home/rrpdfserver/opt/splunk/var/log/splunk/splunkd.log Options ... View more

https://localhost:8089/services/pdfserver/renderpdf Must use mgmt port (open endpoint no auth necessary). Endpoint -> /services/pdfserver/renderpdf. ... View more

See http://www.splunk.com/base/Documentation/4.1.6/Admin/Transformsconf NOTE: Keys are case-sensitive. Use the following keys exactly as they appear. queue : Specify which queue to send the event to (can be parsingQueue, nullQueue, indexQueue). _raw : The raw text of the event. _done : If set to any string, this is the last event in a stream. _meta : A space separated list of metadata for an event. _time : The timestamp of the event, in seconds since 1/1/1970 UTC. MetaData:FinalType : The event type of the event. MetaData:Host : The host associated with the event. The value must be prefixed by "host::" _MetaData:Index : The index where the event should be stored. MetaData:Source : The source associated with the event. The value must be prefixed by "source::" MetaData:Sourcetype : The sourcetype of the event. The value must be prefixed by "sourcetype::" _TCP_ROUTING : Comma separated list of tcpout group names (from outputs.conf) Defaults to groups present in 'defaultGroup' for [tcpout]. _HTTP_ROUTING NOTE: Any KEY prefixed by '_' is not indexed by Splunk, in general. Also see transforms.conf.spec ... View more