When metrics are involved it's more than just defining the sourcetype. Standard fields need to be defined to play well with metrics store. http://docs.splunk.com/Documentation/Splunk/7.2.1/Metrics/L2MOverview ... View more

Hey there yes we are specifying the index _internal when we query. ... View more

The issue with using DS on a default splunk app is that if you remvoe the app from the DS, it also removes it from the splunk server, therefore causing integirty issues and messages. I have played some and there is a eay to enable to HEC via rest call and then you just need to deploy the tokens I guess... I am still experimenting myself and will let you know! ... View more

I have tried this to no avail, it enabelss HEC but the tokens do not show up. Plus doing this you cannot retract the app, it creates splunk integrity issues. Any other thougths? ... View more

So I must be missing something here: local[~/tmp/service_now] $ curl -k -u admin:password -H "Content-Type: application/json" -X POST -d @users.json https://splunk:8089/services/authentication/users <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Cannot perform action "POST" without a target name to act on.</msg> </messages> </response> local[~/tmp/service_now] $ curl -k -u admin:jonesville -H "Content-Type: application/json" -X POST -d @users.json https://splunk:8089/services/authentication/users <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Cannot perform action "POST" without a target name to act on.</msg> </messages> </response> local[~/tmp/service_now] $ cat users.json { "name": "brent", "roles": ["admin"], "password": "cvftrsdsalle" } This is not working. ... View more

Tyler, Thank you for the response. I will do some testing and let you know. Thanks! ... View more

My playbook is as follows: --- - hosts: splunk tasks: - uri: url: https://localhost:8089/services/authentication/users follow_redirects: all method: POST return_content: yes timeout: 5 status_code: 400,404,500,-1 body_format: json body: "{{ lookup('file','user.json') }}" user: admin validate_certs: no password: NotMyPassword register: X - debug: msg="{{ X.status }}" With supporting users file being: { "user": "brent", "password": "nowayposted", "roles": [ "admin","user" ] } When I run it I get the following: local[~/git/splunk-build] $ ansible-playbook -i "splunk," -u root post.yml PLAY [splunk] *************************************************************************************************************************************************************************************************************************************** TASK [Gathering Facts] ****************************************************************************************************************************************************************************************************************************** ok: [splunk] TASK [uri] ****************************************************************************************************************************************************************************************************************************************** ok: [splunk] TASK [debug] **************************************************************************************************************************************************************************************************************************************** ok: [splunk] => { "msg": { "cache_control": "no-store, no-cache, must-revalidate, max-age=0", "changed": false, "connection": "Close", "content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<response>\n <messages>\n <msg type=\"ERROR\">Cannot perform action \"POST\" without a target name to act on.</msg>\n </messages>\n</response>\n", "content_length": "179", "content_type": "text/xml; charset=UTF-8", "date": "Sat, 21 Apr 2018 00:02:22 GMT", "expires": "Thu, 26 Oct 1978 00:00:00 GMT", "failed": false, "msg": "HTTP Error 400: Bad Request", "redirected": false, "server": "Splunkd", "status": 400, "url": "https://localhost:8089/services/authentication/users", "vary": "Cookie, Authorization", "x_content_type_options": "nosniff", "x_frame_options": "SAMEORIGIN" } } PLAY RECAP ****************************************************************************************************************************************************************************************************************************************** splunk : ok=3 changed=0 unreachable=0 failed=0 I also approched it by going to the REST API directly and it does not seem to accept JSON as body input. So until I can get that to work I doubt Ansible will be able to do this. There is a whole other way to just use the command ansible module and call curl... Not for the purist though but it works like a charm. ... View more

Thank you for the response and I have seen that. Do you know why there is a leading [ and a trailing ] on every event? It is supposed to be JSON output but it actually isn't valid. I have to: index=main | rex "[(?P.*)]" | spath input=json to get this to parse correctly. I am able to easily get logs into Splunk just need to know how to remove the ^[ and the ]$. ... View more