About araitz

araitz · ‎06-16-2014

Not easily. To be honest, I don't think that this setting existed when I created the initial app. There is some setting posted to the search/jobs API that enables that functionality, but I can't even figure out what that setting is: http://docs.splunk.com/Documentation/Splunk/6.1.1/RESTAPI/RESTsearch#POST_search.2Fjobs

araitz · ‎06-06-2014

Let me know what that setting is, I haven't seen any bug on this. If you let me know I'll try to ensure this gets addressed.

araitz · ‎06-06-2014

Yes, this is how you would have to change it for all apps. I read your question as referring to "an app". I guess "an app" was the search app. As you found, dashboard.css is only relevant for single apps, and moreover is only loaded by Simple XML pages.

araitz · ‎06-06-2014

Unclear why, but there is no way to do this in Simple XML. Here's a gross hack that will hide the navbar, put this in your_app/appserver/static/dashboard.css: .navbar { display: none; } Clever folks will be able to make it visible again if they really want to with their browser developer tools.

araitz · ‎06-05-2014

Have any of your alerts fired? You can check by going to Activity > Triggered Alerts.

araitz · ‎06-05-2014

I would recommend using the categories and groups feature built in to the app if you want to summarize. After you set up the category and groups, you'll use the category and group fields rather than the host field.

araitz · ‎06-04-2014

Per http://docs.splunk.com/Documentation/UnixApp/latest/User/First-timeconfiguration#Settings:_Categories Use the Settings: Categories page to add host categories and groups. When you make these changes, the Splunk App for Unix and Linux writes them to $SPLUNK_HOME/etc/apps/SA-nix/lookups/dropdowns.csv. As such, you can just have your script populate this file directly, maintaining the same column names, column order, etc.

araitz · ‎06-04-2014

hcpr - you should open a support case. We can't recreate that behavior, and haven't seen that with any of the other customers using the add-on. My guess is that something somewhere else on the system is clobbering your configuration.

araitz · ‎05-28-2014

Can you answer my other question regarding the nature of your deployment (HF or UF, TA on indexers or not)?

araitz · ‎05-28-2014

That sounds like a lot of changes. You might be best off submitting a support case so that Splunk support can take a look at a diag file.

araitz · ‎05-27-2014

Can you confirm that you have the following in default/props.conf? [opsec] SHOULD_LINEMERGE = false TIME_PREFIX = time= TIME_FORMAT = %d%b%Y %H:%M:%S KV_MODE = none Can you confirm that you have deployed the add-on on a Heavy Forwarder and/or have the add-on installed on your indexer(s)? The above lines will handle time parsing, either on a HF or on your indexers. I suspect something is wrong with your configuration - maybe you manually altered the sourcetype, or the props.conf entry?

araitz · ‎05-22-2014

The app depends on the presence of the SA and TA because those add-ons contain important search-time knowledge such as event types, macros, field extractions, and saved searches.

araitz · ‎05-22-2014

This is by design. The unix app uses a TA and SA for knowledge objects. If you don't want users to be able to see the searches in the SA, change the permissions on the SA, but of course the users won't be able to access the unix app either, so you should make sure they don't have permission to that app either.

araitz · ‎05-19-2014

Looks like there are actually two actions, both implemented at the collection layer: https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/_reload https://localhost:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/restart According to the docs, I think you want to POST to the restart endpoint.

araitz · ‎05-16-2014

Real-time outputs are in part scripted inputs. Since you are familiar with the REST API, you are ahead of the game. Try POSTing to this endpoint: https://af-yolo.sv.splunk.com:8089/servicesNS/nobody/SplunkRealTimeOutput/data/inputs/script/your\_realtime\_output\/_reload

araitz · ‎05-15-2014

Does this work? | where like(model,"%U%") | where showroom=show

araitz · ‎05-14-2014

Check out rarsan's blog on the subject: http://blogs.splunk.com/2013/10/17/still-using-3rd-party-web-analytics-providers-build-your-own-using-splunk/

araitz · ‎05-14-2014

paging bwooden

araitz · ‎05-13-2014

Can you provide a referent to NT Epoch? Not sure which epoch time you are referring to.

araitz · ‎05-13-2014

You probably need to go in and re-authenticate to your distributed search peers via Settings > Distributed environment > Distributed search > Search peers. If you see an authentication failed message, click on the failed hosts and enter a valid admin user and password.

araitz · ‎05-09-2014

This picture is hanging on the 2nd floor of Splunk HQ:

araitz · ‎05-08-2014

Someone should fix that DHCP app...

araitz · ‎05-08-2014

Thanks, that's an interesting resolution. When I get a chance, I'll see if that is viable for all the platforms that we support with the TA.

araitz · ‎05-08-2014

Nice tip! Sorry it doesn't quite work correctly for you guys through the UI-based app install.

araitz · ‎05-07-2014

Great to hear!

Posts	938
Solutions	212
Karma Given	702
Karma Received	792
Member Since	‎01-16-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Too many results returned

Excel Export - "Possible typo in stanza"

Splunk Web - How to disable tracebacks?

What is the difference between the "Splunk for Uni...

Question about license usage on license slave

What does this TemplateLookupException error mean ...

Nice App! Must commend...

How do I make a view that includes the "View Resul...

How does summary indexing handle time?

How do I remediate "Nessus ID 42873"?

Re: Splunk Real-time Output app. Have to manually ...

Re: Splunk DB Connect Error - NullValuePointerExce...

Re: Remove Account Bar from Apps Splunk 6

Re: Remove Account Bar from Apps Splunk 6

Re: Alerts and Headlines don't work on App for Uni...

Re: summarizing unix app data

Re: Assign hosts a category/group automatically

Re: Splunk only partially recognizes date from OPS...

Re: Splunk only partially recognizes date from OPS...

Re: db connect giving an error: no such database a...

Re: Splunk only partially recognizes date from OPS...

Re: SA-nix - Global Searches

Re: SA-nix - Global Searches

Re: Reload realtimeoutput.conf without restarting ...

Re: Reload realtimeoutput.conf without restarting ...

Re: where clause works only with reverse logic

Re: Track a mouse clickstream on a web site

Re: How to Create Chargeback Reports in Splunk.

Re: Convert NT Epoch Time with props.conf

Re: DistributedPeerManager - Unable to distribute ...

Re: Complex Regex, HELP!

Re: After upgrading to Splunk 6.1, I have searches...

Re: setup.sh syntax errors

Re: Setup for *nix app 5.0.2 not found.

Re: Configuration of Checkpoint logs and Splunk

Join the Conversation