I'm starting to experiment Splunk Web Framework. Following some tutorials, trying to tweak things here and there. One of the strange things I noticed: a documented appbar (can be true of false) property of HeaderView has no effect on the appearance - appbar is always present. Here is the beginning of my .html file: {% extends "splunkdj:base_with_basic_styles.html" %} {% load splunkmvc %} {% block content %} <div id="my-header"> {% header id="inner-header" appbar="False" %} </div> <div id="barchart"></div> <div id="message-area"></div> {% endblock content%} I tried specifying "true" and "false" as appbar values with various capitalizations - the appbar is simply always there. I know I can change that by inheriting from different base_*.html (the first line - with "extends") but then I will always have footer which I might not want, and overall I want a better degree of freedom. Any ideas? ... View more

I've just read this link: Are custom search commands truly 'streaming'? The author there claimed he created a much more 'streaming' interface than what is used by Intersplunk. Has anyone seen any such implementation? I have a command which needs to simply read the incoming events one by one (I don't even care about sending them further down the pipe) and process each event separately. This setup is working extremely slowly right now, quickly going through the events and then taking over at least a minute 'finalizing job', and sometimes outright hanging (you know when Chrome says 'The page has become unresponsive' or even switches directly to the 'Awww, snap!' page?) All I do there is call splunk.Intersplunk.getOrganizedResults() , loop for r in results: with some simple processing inside the loop, then passing the results on using splunk.Intersplunk.outputResults(results) . Is there any better approach to this task? ... View more

I'm trying to set up a scripted alert which would transform the search results and output them into a file. I tried doing so but there was no output file. I then replaced my script with echo.bat, taken from http://wiki.splunk.com/Community:TroubleshootingAlertScripts - only to find out that the 8-th parameter (the name of the file containing the search results) is not passed! I did find in the documentation that results.file is now deprecated, though :(. What could be another way of achieving what I need? I want the search results transformed into JSON (which Python should be able to do easily) and saved into a certain log file. I did see that one can call the script once per event, but that would be wasteful (we are talking about 20K events here), and I don't really know how the event itself is passed into such per-event script, if at all. ... View more

I started using pingstatus command in our application. It works great, but I do have a couple of problems: My first problem is the fact that it runs just one ping. Our networks are somewhat shaky, so running several pings and getting a package loss percentage would be great. The ideal would be to add a parameter to the command such as count=... (so that I can run it like this: pingstatus url as IP count=5 ), and get back both pingdelay and pingloss or similar. I understand that it will create delays, but I can live with it. My other problem is the pingdelay values that I'm getting: when I tested it on my Windows machine, I got all kinds of delays, usually quite small, similar to 0.000015 or even lower. However, when I moved it to the main network which consists of many (dozens to hundreds) Linux machines, most of the pingdelay values I'm getting are 0.0. Yes, that's right - a plain zero! Those which are not look like 0.00136 or so, but there are only a couple of percents of such non-zero records. What's worse - I know that I'm dealing with quite a wide network there with multiple locations and routers, so I would expect values in 20-100 ms range, not 1 ms or below. Now, for the first problem, I should probably look into pingstatus.py - but I'm far from being a Python expert, let alone Splunk Python. A push in the right direction is all I would like. For the second one: is there a big difference between Windows and Linux ping.py behavior? ... View more