About chli_splunk

chli_splunk · ‎10-17-2018

Did you get some exceptions? Can you post your codes with counters? Any results when you test your codes in AoB? Thanks.

chli_splunk · ‎10-17-2018

Seems like Splunk will use the same icon in both Splunkbase and data input UI. Unfortunately we cannot fix it in AoB sorry about that.

chli_splunk · ‎10-17-2018

This modular input is not supposed to run manually. Please go to AoB validation page, and follow http://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/Validate

chli_splunk · ‎10-17-2018

You can only import addon packages which are exported from AoB before. If you download an addon from splunkbase or create your own addon, you cannot import it to AoB. Then you have to recreate it in AoB thru UI.

chli_splunk · ‎10-17-2018

addevent() only accepts string as a param instead of JSON. If it's a valid JSON, Splunk should be able to extract events automatically. If it's not, please try to add KV_MODE=json in your props.conf under the sourcetype stanza.

chli_splunk · ‎10-16-2018

Usually when we got a big json, especially it's a list, we should iterate each element and call addevent() in a loop. However, if you want to compose a big event with all the elements, it's fine, Splunk will extract fields automatically only if it's a valid JSON.

chli_splunk · ‎09-06-2018

Need to add sourcetype in your event like {"event":"testing", "sourcetype": "st"}

chli_splunk · ‎08-09-2018

Sorry AoB havent supported this feature yet. Currently you have to hardcode values for a dropdown component in UI, rather than getting indexers during run-time by some Python codes.

chli_splunk · ‎07-03-2018

AoB leverages the splunk.com authentication to login app certification. Do you mind to create an JIRA? Then I can ask app cert team to check if your username exists in their list. Thanks.

chli_splunk · ‎06-12-2018

Good to know CIM fixed that issue.

chli_splunk · ‎06-11-2018

This is the known issue of CIM app. AoB requires some fields such as "comments", and CIM app added them from 7.x. However, if there are some customized contents in local folder, it will rollback to the version which doesn't contain these fields. Seems like CIM app has inconsistent behavior between frontend & backend codes.

chli_splunk · ‎06-01-2018

The data input configuration UI framework has both frontend components and backend rest endpoints. It's not easy to figure out a quick solution by "hacking" existing framework, otherwise it's more like a feature request.

chli_splunk · ‎05-31-2018

Currently it's not possible since AoB is leveraging another component to render data input configuration UI.

chli_splunk · ‎05-08-2018

Seems like globalConfig.json file is missing in your app. Please check the path: $SPLUNK_HOME/etc/apps/{APP_NAME}/appserver/static/js/build/globalConfig.json Maybe you can rebuild it and try again.

chli_splunk · ‎04-30-2018

Technically yes. But if your new input has different parameters or settings, you have to update some files manually including inputs.conf.spec, inputs.conf, restmap.conf, py files etc. You can refer the templates in AoB to see how to apply different settings to the code generation: $SPLUNK_HONE/etc/apps/splunk_app_addon-builder/bin/ta_gnerator/resources Use AoB to build another addon is highly recommended, since it's not easy to do everything manually.

chli_splunk · ‎04-30-2018

AoB developed a toolchain as Python libs for you. If you want to invoke some functions outside of AoB, please copy all the py files under "bin" folder to another Splunk app. Otherwise you have to figure out the callstacks by yourself.

chli_splunk · ‎04-23-2018

You can try to edit your data input in AoB and save again. Just add a parameter in UI, save it, and remove this parameter. I tried it works.

chli_splunk · ‎04-21-2018

AoB needs some specific fields to parse the CIM. Please make sure your CIM is the latest version. Also there is a known issue from CIM app - when you customized some data models thru CIM UI, some fields are removed automatically, which may cause same issue in AoB. So please remove everything in "local" folder and install latest CIM app. Thanks.

chli_splunk · ‎04-03-2018

Yes ------------

chli_splunk · ‎04-03-2018

AoB uses another configuration UI rather than Splunk setup XML. You can create a Python based modular input, and drag & drop some UI components in the wizard. More details please see http://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/ConfigureDataCollectionAdvanced

chli_splunk · ‎04-03-2018

Current version 2.2.0 doesn't support this. However, it's on our feature list.

chli_splunk · ‎04-03-2018

Yes this is a bug. We already had a bug reported in AoB.

chli_splunk · ‎03-08-2018

OK, it's not about KVStore then. Maybe we need more info about AoB version, logs or diags...

chli_splunk · ‎03-08-2018

Can you find "kvStoreStatus" field?

chli_splunk · ‎03-08-2018

How about remove "| grep kvstore"? Can you get some info?

Posts	90
Solutions	10
Karma Given	3
Karma Received	21
Member Since	‎09-21-2014

Online Status	Offline
Date Last Visited	‎08-28-2023 01:04 PM

Re: Splunk Add-on Builder: Can you help me with Sp...

Re: In Splunk Add on Builder theme, can you help m...

Re: Add-on Builder Blank Screen and Argument valid...

Re: Can you help me with the following import erro...

Re: Splunk Add-on Builder: when exporting JSON for...

Re: Splunk Add-on Builder: when exporting JSON for...

Re: HTTP event collector -- error with data format...

Re: Splunk addon builder - How to create an input ...

Re: My Splunk userid doesn't work with Add-On Buil...

Re: Accelerating Datamodel Breaks Datamodel mappin...

Re: Accelerating Datamodel Breaks Datamodel mappin...

Re: how execute command at backend from a external...

Re: how execute command at backend from a external...

Re: App-BUilder "Config not found" error?

Re: how to test add-on-builder python code from re...

Re: how to test add-on-builder python code from re...

Re: REST ERROR 404 splunktaucclib/rest_handler/han...

Re: Why splunk add-on builder is showing error( t...

Re: Support cron expressions for intervals

Re: Are there examples for creating a custom setti...

Re: oauth with Splunk Add-on Builder

Re: Support cron expressions for intervals

Re: Error when importing Add-on in Add-on Builder

Re: Error when importing Add-on in Add-on Builder

Re: Error when importing Add-on in Add-on Builder

Join the Conversation