This has been tested on Red Hat Enterprise Linux 5.5, 64 bit. It would probably work even easier on Ubuntu Lucid, for obvious reasons. If anyone has any suggestions for changes (especially if you know where to get the files below without stripping things out of DEBs) please comment! (If you know where to get the proper files for your distro, feel free to use that if you can find the exact packages - MySQLdb requires libmysqlclient version 16, not 15 which comes with many distros. RPMs may be able to be found online; it looks like http://rpmfind.net/linux/RPM/ may have a version 16 from OpenSUSE. I did not test the file from the package listed there.) Installing MySQLdb 1.2.2 python library on RHEL 64bit server, using Ubuntu parts 1. Download libmysqlclient16 DEB package from http://packages.ubuntu.com/lucid/amd64/libmysqlclient16/download 2. Use Windows 7-Zip (or any other method you can) to pull data.tar.gz/usr/lib/libmysqlclient_r.so.16.0.0 from the DEB file 3. Rename libmysqlclient_r.so.16.0.0 to libmysqlclient_r.so.16 4. Put the libmysqlclient_r.so.16 file in $SPLUNK_HOME/lib/ 5. Download python-mysqldb DEB from http://packages.ubuntu.com/lucid/amd64/python-mysqldb/download 6. Use Windows 7-Zip (or any other method you can) to pull data.tar.gz from the DEB 7. Put the data.tar.gz/usr/lib/pyshared/python2.6/_mysql.so file in $SPLUNK_HOME/lib/python2.6/ 8. Put the data.tar.gz/usr/share/pyshared/_mysql_exceptions.py file in $SPLUNK_HOME/lib/python2.6/ 9. Put the data.tar.gz/usr/share/pyshared/MySQLdb/ folder in $SPLUNK_HOME/lib/python2.6/site-packages/ The python MySQLdb module is now installed in Splunk's python. Now you can write scripts like the following MySQLdb-based search script: import csv,sys import MySQLdb #Define database connection, get cursor db = MySQLdb.connect(host='ho.st.name',user='username',passwd='password',db='database') cu = db.cursor(MySQLdb.cursors.DictCursor) #Define output objects header = ['input','output'] csv.writer(sys.stdout).writerow(header) w = csv.DictWriter(sys.stdout, header) #Query database for results result = {} result['input'] = sys.argv[1] cu.execute("SELECT output FROM table WHERE id='%s'" % db.escape_string(result['input'])) qr = cu.fetchall() #Output results if qr == None: result['output'] = "None" w.writerow(result) else: for row in qr: result['output'] = row['output'] w.writerow(result) ... View more

I couldn't find it on docs or Answers, but you can get a man-page style listing of the module by doing the following: $SPLUNK_HOME/bin/splunk cmd python (in python interpreter) import splunk.Intersplunk help(splunk.Intersplunk) (when done, press q to exit the help screen, and ctrl-D or ctrl-Z to exit python) ... View more

Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue. Bug SPL-34570 filed and support says will be fixed in 4.1.6. ... View more

Turns out it was weird because I was running stuff on a summary index that had been populated by sistats . I thought you had to populate a summary index with sistats, but it turns out that's only if you plan to do the exact stats query when looking at the summary index. My workaround was to use the fields Duration, fields.. to kick out some prsrvd_* fields that were messing with the functionality of stats. ... View more

Figured it out: | streamstats range(_time) as Duration window=2 Makes a handy Duration field, for each event giving the time between it and the event after it. Does what I need it to! ... View more

You're thinking about it too hard. By using | sistats count by host, source, sourcetype before, just write a search that is index=summary ... | stats count by orig_host, orig_source, orig_sourcetype, field1, field2 and it will just work. The count will be there and you can sum it up from there. (Remember host, source, and sourcetype are rewritten when summarized, so use the orig_ fields.) ... View more