I'll answer here. With pictures. Going through the difficulty of writing a button to export results to CSV is not worth they payoff. Every single panel in a Splunk Dashboard, and in the search results, by default, has a "Button On the Dashboard, That When Clicked, Will Download a CSV Through a User's Browser". That is the requirement here, no? The functionality exists already, why duplicate it? I don't always do things "just because the customer asked for it", instead, show them the built-in, supported, automatic, scaleable feature. They will love you for it. Instead of spending a week Developing this feature, you now have spent 1 hour explaining it. Much better ROI if you ask me. Every Panel has this : Clicking the second button gives you this: This is exactly what you wanted. A button on a dashboard to export data to CSV, with UNLIMITED results. ... View more

Make sure you are specifying "CUS_NAME" as the <fieldForLabel> and <FieldForValuealue> fields of the drop down. Then, make your populating search this: index="MYINDEX" host="MYHOST" source="MYSOURCE.csv" | stats count by CUS_NAME Stats is much more efficient in removing dedups. ... View more

What do you need Splunk to connect to the internet for? There is the App Store, and there is there is the login page. Other than that, why do you need it to connect outbound? ... View more

I don't think that is going to do what you think it does. Using a subsearch with 2 pivot commands is not a good practice to start, since using datamodel is the preferred method any way. ... View more

You could do it at the tail end of that search. <that_Search> | stats last(*) as * by Date This will take the "last" of each value on each date, and output it. You can also use "first" to get the first event found. Remove the |stats dc(Date) by Date , since that is probably interfering with the search. ... View more

Also take a look here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputcsv and http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Exportsearchresults ... View more

Without knowing the specifics of your Data Model, I can give you a "normal search" that gives you what you want, and then perhaps you can apply it to your data model. <find_your_web_logs> | bin span=1d _time | top limit=5 VisitSession by _time This will split your data in 1 day chunks, and then do a top with the split by of _time , which then gives the top 5 per day. Sticking it into datamodel land (using some assumptions): |datamodel <datamodel> <object> search | bin span=1d _time | top limit=5 VisitSession by _time ... View more

This error typically means that you do not have a ZIP code defined in the interface at "home.nest.com". Please confirm or set the ZIP code for your account, and let me know how it goes. ... View more

Oh, so in this case, you don't want to load the subview INSIDE the main view, you want to drill down to another view. In your app/myapp/details , use the form features of SimpleXML. <form> <fieldset> <input type="text" token="id"> </fieldset> .... </form> See the complete reference here: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#form Then, you can pass items through the URL, just like you would like: app/myapp/details?form.id=49 . ... View more

Yes, If you have a script writing out that JSON object, put each item in it's own line. You can put them all in the same file, but Splunk will read them in as individual events. { "TIMESTAMP":"2016-03-07 09:03:43", "outputname": "Attachmate Reflection X", "version": "14.1.1217" } { "TIMESTAMP":"2016-03-07 09:03:43", "outputname": "Adobe Reader", "version": "1.2.3" } ... View more

From : http://www.quackit.com/html_5/tags/html_iframe_tag.cfm Note that in previous versions of HTML, you could create "fallback content" by placing content within the opening and closing <iframe> </iframe> tags. In HTML 5 however, the <iframe> element never has fallback content. ... View more

You need to explain "Dynamic Sub View". If I am understanding correctly, you will have 2 views defined. You want to load (via iframe perhaps) the sub view with a query passed in from the main view. Short answer: Yes and No. It all depends on the definition of your sub view. IMHO, you are already using an HTML view. Leverage the JS on a single view, and dynamically build panels and views withing the master view. Don't try to load a second view, instead build it dynamically within the master view. ... View more

Yes. Core Splunk is written in C/C++, afaik. Perhaps you could expand on your question? Why does this matter to you? What is your goal in learning this? ... View more

I believe it is a problem with the XML parser trying to parse some special characters. Try wrapping your html data in a CDATA tag: <html><[CDATA[ <h1>test</h1> <iframe src="http://myhost:8181/pc/view/page?ViewContainer=1&DrillDown=1&AddCopyright=1&timeRange=0&startTime=2016-03-03+15%3A38+America%2FNew_York&endTime=2016-03-03+16%3A38+America%2FNew_York&GroupID=1775934&ViewToken=7fLY_Er8Nv9_lVHdvDsPcbOsPQvfUK4swldSpsBt1u07SWbOM4bTsJH3DPDBX00YHaGk901FsqpSYfaRDANJ86dNPcyhpZzVTmHRGjnUA6F811LlPNwYT4LHghzJTOU2So_CU_TBGdHoVN3dd2b-5rXEfhdFnZAhmAsxFak65r8*">my routers</iframe> ]]></html> ... View more

So you want to be able to use the SPL Search bar to search elastic search peers? Is that correct? ... View more

What do you mean "ratio"? Also, please include the searches, there might be an SPL way to calculate your "ratio"s without having to resort to JavaScript and HTML Views. ... View more

The way JavaScript works within Splunk is not exactly the same as it works elsewhere on a "regular" web site. Splunk uses JS Frameworks (notably mvc, backbone, jquery, requirejs, bootstrap, etc) to perform a majority of the UI integrations and implementations. There are two books I am aware of with specifics to Splunk App Developing: Building Splunk Solutions http://amzn.com/1514615746 Splunk Developer's Guide http://amzn.com/1785882376 (just for transparency - I wrote the Splunk Developer's Guide 😄 ) Take a look at those, read through dev.splunk.com about a bajillion times, and ask lots of specific questions. Try doing it once or twice. Might be easier to start with a Converted Dashboard (HTML) to see some of the under lying code. Also - you can find me on IRC (#splunk on Efnet as alacer) , The Splunk Usergroup Slack (sign up at www.splunk402.com/chat) and here on answers, among other resources. ... View more

I know this is an old post, but this changes should take place on the SH, not needed on IDX. Just FYI for future me. ... View more

So to construct the URL, you need 3 things. 1) Name of your App 2) Name of the Endpoint 3) name of the function. Then it goes such like: /custom/APPNAME/ENDPOINT/FUNCTION The /custom denotes that this is a custom endpoint and is required for this to work. So if your "script" (located in $APP_HOME/appserver/controllers/ ) is called html_file.py , and the function in that file is called post_this , then your URL in the HTML dashboard will be /custom/MyAppName/html_file/post_this . Done. ... View more

Line 145 of NestClass.py, there is an assignment to zipCode . But since that item doesn't exist, it throws an error. Most likely, this is because you haven't placed a zip code into your Nest Account for that Structure. Please login to https://home.nest.com and update your profile settings to include the zip code. ... View more

It's not really, tbh. It's from years of Splunk App Dev and experimentation with other Apps and finding what works. ... View more

Yeah, don't do that. ... View more

Yes, use the $APP_HOME/local/web.conf if you didn't make the app, but use $APP_HOME/default/web.conf if this is an app you created. DO NOT USE etc/system/local ! In the example script, just copy and paste that entire thing into the controllers folder. Your bin/my_script.py steps go into the section under the def at # DO YOUR THINGS WITH THE KWARGS PASSED . Don't need to import cherrypy for this example, because I'm not using anything from cherrypy. The cherrypy in the documentation is simply stating that this endpoint is exposed via the Splunk Web Server. You will need to do a full restart (on the search head) for these changes to be picked up. A simple update won't work. Here is about as close to documentation as you will get: http://docs.splunk.com/Documentation/Splunk/6.3.2/ModuleRef/Extensiondictionary ... View more