This approach is expensive and might not work when dealing with millions of events. Thanks. ... View more

I tested it seems to do the work. ... View more

We use a SVN repository to document all our Splunk queries we have in production. ... View more

Thanks Mario. Master head: Version 4.3 Indexer: Version 4.2.1 The search command is just a WEB REST call then the result set is presented to the user. This Web REST call can only be executed in the DMZ environment "The indexer is found in this environment". That is why, I need to exclude the indexers that cannot access this network. ... View more

Thanks for your answer but the solution of the problem is not about sub-search it is about how to exclude "blacklist" splunk indexers from a custom search command for distributed search. ... View more

Thanks. I follow your instructions. I am able to run the command from the master head. When I run the command, it is executed and the pick fields are found in splunk UI but the query keeps running. If I run the command in the indexer the command completes without problem, the pick fields are found in splunk UI but I do not see any events. I can see the event if I use: |search_commnad|table *. If I remove streaming no problem in the local indexer. What could be wrong? commands.conf [cimidxfeed] filename = cim_idx.py generating = true maxinputs = 1 supports_rawargs = true streaming = true ... View more

Thanks. It worked. How can I control the replication from the Master head to the indexers? There are a set of indexers that I do not want to have the custom search commands ... View more

Script example customsearch.py: import urllib2, sys,csv,time from lxml import etree import splunk.Intersplunk as si host = ['host1.net','host2.net'] for s in host: url = "http://" + s + ":8080/rex/administration?files_used=true" #print(url) results = [] now = str(int(time.mktime(time.gmtime()))) try: f = urllib2.urlopen(url) doc = etree.XML(f.read()) one = doc.xpath("//str[@name='LINEUP']/text()") two = doc.xpath("//str[@name='LINEAR']/text()") three = doc.xpath("//str[@name='BITSET']/text()") results.append({'_time' : now,'qe_host' : s,'Stack' : 'cim','Status' : 'up','LINEUP' : one,'LINEAR' : two,'BITSET' : three}) si.outputResults(results) except urllib2.URLError, e: results.append({'_time' : 'now','qe_host' : s,'Stack' : 'cim','Status' : 'down','LINEUP' : '','LINEAR' : '','BITSET' : ''}) si.outputResults(results) f.close() commands.conf [customsearch] filename = customsearch.py generating = true maxinputs = 1 ... View more

http://splunk-base.splunk.com/answers/7909/where-is-the-python-api-for-splunkintersplunk ... View more

Thanks. Solved by using as example: /opt/splunk/etc/apps/search/bin/google.py ... View more

I am getting the result set from a REST API call as shown in the script I presented. I am not indexing the result set. I just need to know from this script example, how to converted to a custom search command. ... View more

Get the result set of an xml file. I have the script I presented in the initial post. I am able to print the results. I need to get these results from splunk by executing the script as a custom search. For example: |uat_qe_feed The result of this search command is the result of the last line of my phyton script: print(date('%Y-%m-%d %H:%M:%S') + " " + "qe_host=" + s + " " + "Stack=uat" + " " + "LOCATION="+ r[1].text + " " + "NUMBER="+ r[2].text + " " + "MAP="+ r[3].text + " " + "SET="+ r[4].text) What should I add in my code so this script can be called as a search command ... View more

i knew about the links and I was not able to make it work. I just need a single example from the code I presented to have a start up.. ... View more

That is the first thing I did but it did not work. Thanks. ... View more

A summary index will solve this problem. http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Usesummaryindexing Lp ... View more

I do not know the content of your log events, Can you try this query? sourcetype=json event=delivered |stats count as DLVRD by userid | appendcols [search sourcetype=json event=spamreport AND (ip="74.63.194.91" OR ip="74.63.194.94") | stats count as SPMRPTS by userid | eval SPMRPTS=count/2]| eval PercentSpam=SPMRPTS/DLVRD |table userid, DLVRD, SPMRPTS, PercentSpam Thanks, Lp ... View more

I would recommend to use |dbinspect See the example presented in the next answer. ... View more

You have to run the command locally. You can create a script to collect this data or login each indexer to run the command via its web interface. ... View more

you can use: |dbinspect index=name_of_your_index state=warm Example for the main index: |dbinspect index=main state=warm Make sure to select "all time" as your time period in your query. for more information take a look at the dbinspect command. Once, you are familiar with the dbinspect command, you would be able to use it to obtain the result set you are looking for. This is an example: |dbinspect index=main|convert timeformat=""%m/%d/%Y:%H:%M:%S"" mktime(earliestTime) as earliestTime|convert timeformat=""%m/%d/%Y:%H:%M:%S"" mktime(latestTime) as latestTime|stats min(earliestTime) as earliestTime max(latestTime) as latestTime sum(sizeOnDiskMB) as sizeOnDiskMB dc(path) as NumberOfBuckets by state|eval diff_seconds=(latestTime-earliestTime)/3600|eval earliestTime=strftime(earliestTime,"%m/%d/%Y:%H:%M:%S")|eval latestTime=strftime(latestTime,"%m/%d/%Y:%H:%M:%S") The result set for this query is something like this: state earliestTime latestTime sizeOnDiskMB NumberOfBuckets hot 09/15/2006:18:47:20 03/24/2012:12:00:00 10043.741711 10 warm 02/19/2012:00:00:01 03/21/2012:03:59:00 92646.695278 20 cold 01/03/2006:16:35:20 02/27/2012:17:00:00 204971.245710 586 I prefer to use the dbinspect command. It offers precise information about the state of the buckets found in each index. Regards, Lp ... View more