how do i set the logging level if i use the splunk.minining.dcutils? Is it possible to do it from within the python script or is it done in some config file? import splunk.mining.dcutils as dcu logger = dcu.getLogger() The Root-level logger has this method avail import logging logger = logging.getLogger() # Root-level logger Set level of logger source. Use debug for development time options, then bump it up to logging.INFO after your script is working well to avoid excessive logging. logger.setLevel(logging.INFO) ... View more

I like splunk's pivot table capabilities and am wondering if its possible to use a scheduled search within a dataset. You may ask, why not drop in the full query from the scheduled search into the datamodel then accelerate it. I've had issues with the accelerated data model consuming too much resource in the past and am trying to avoid it by using scheduled search to ensure it runs specific time at specific intervals. In going this route, I am missing out on the pivot UI ... View more

Is there a way to get list of scheduled report and get the following: 1) when report was last ran, 2) display number of rows returned per report? ... View more

My sandbox splunk instance crashed and I am not able to restore the data. I need to restore my Splunk HEC tokens and settings. Whenever I try to create a new HEC token, Splunk generates a random HEC token id. How do i create a new HEC token with a predefined token id of my choice? Is it possible to do this through a curl command? If so can you provide instructions or example? ... View more

When creating reports or alerts (Under Setting > Searches, Reports, and Alerts), is it still possible to create RSS? There use to be a checkbox for "Add to RSS" in previous versions of splunk, but I don't see it available anymore - or maybe i've missed it. ... View more

I'm currently having issue getting this app (https://splunkbase.splunk.com/app/1438/) to work. According to the page, it listed as compatible with Splunk Versions: 6.5, 6.4, 6.3. Can anyone confirm its working for them on Splunk version 6.6+ or latest version of Splunk? ... View more

The code below has the drilldown setup to display panel4 when i click on panel3, and will only hide panel4 if i click on a link from panel4. How do I change it so that when i click on panel3 it will either show or hide panel4 depending on the state of panel4. For example if i click on panel3 and panel 4 is currently displaying, it will hide. If i click on panel3 again, it should now display the hidden panel4. <row> <panel> <title>Panel 3 </title> <single> <search> <query>|gentimes start=-1 | eval temp="Panel 3" | table temp</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">all</option> <drilldown> <condition match="boolPanel4 = true"> <set token="boolPanel4">true</set> </condition> <condition> <unset token="boolPanel4"></unset> </condition> </drilldown> </single> </panel> <panel rejects="$boolPanel4$"> <title>Panel 4</title> <single> <search> <query>|gentimes start=-1 | eval temp="Panel 4" | table temp</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">all</option> <drilldown> <set token="boolPanel4">true</set> </drilldown> </single> </panel> </row> ... View more

Is there a way to view a splunk query directly as a CVS? In reviewing the REST API the curl command below gets me the output as CSV curl -k -u userABC:pass#### https://splunk.server:8089/services/search/jobs/1488985371.7077_D6AE46D6-FC4C-48A5-9F24-7912363C18D1/results/ -d output_mode=csv --get when i copy and past the URL (https://splunk.server:8089/services/search/jobs/1488985371.7077_D6AE46D6-FC4C-48A5-9F24-7912363C18D1/results/) into a browser, it displays it as an xml. Is there a way to display this URL as a csv in a browser? ... View more