@joshuamcqueen I got it working. There was a conflict around character encoding, and I also had to reference the sqlite3 modules in my external Python directory because my Splunk installation is missing the dbapi2 module. I thought I would mention that I used a module in my app to add to the sys.path so that it could find the sqlite modules, and alter the DATABASES setting so that the default Splunk application doesn't have to be modified. If you want to know more for your blog post, let me know. 🙂 ... View more

@joshuamcqueen Are you certain that copying the sqlite3 SO was the only thing you needed to do? I tried it and had no luck whatsoever. I even downloaded the Python 2.7.5 source and compiled it to get the same SO as the Splunk version of Python would expect. No luck. I'm a little frustrated that we get access to Django, but no access to databases. I guess I'll just write JSON files to the file system. ... View more

Nice. Thanks! ... View more

Yeah, %e is just one of those weird ones. It works for me. I say try it, and if it doesn't, fall back on %d. %Y will give you a 4-digit year (it's near the bottom on that link). ... View more

Hmm. Unexpected. Well, you can counter that by using an eval before the table command: ... | eval Time=strftime(_time,"%a %b %e") | table Time,"TotalEmailsToSend: <registrar>",... Then you can format your time however you please. A guide to strftime strings can be found at http://strftime.org/ ... View more

When charts switched from default Flash to JSChart, I think they lost the fieldColors ability. Related question and documentation. If you're OK with your chart using Flash, just specify the FlashChart module for that chart. ... View more

Gotcha. Sorry, needed to read a little closer. You'll have to spell out all the column names, but the table command should still do what you're looking for: ... | table _time,"TotalEmailsToSend: <registrar>","TotalEmailsSent: <registrar>",... Casing and spaces matter. ... View more

Yeah, I noticed that the splunkbase comment stripped the backslashes off those inner quotation marks. I'll update the original answer. Glad you got it working. 🙂 Oh, if you schedule that search, you'll need to save the map's search off as its own saved search (see http://splunk-base.splunk.com/answers/27658/map-command-breaks-when-scheduled). ... View more

Oh, nice. You might be able to use a transaction to do that, depending on how many other events you expect to have with that IP. I'm going to guess you'll want to do this for more than one IP address, so it's probably better to go the map route: | map search="\"User Authentication\" IP=$dest_IP$" | fields username You can replace that "User Authentication" bit with whatever search will identify those types of events. The magic in map is the $variable$ part. Let me know if this works and I'll update the answer. ... View more

Try ... | timechart limit=3 span=1m count by host useother=F | eval Time=strftime(_time,"%H:%M:%S") | table Time,* Use of convert is considered deprecated, so the eval will accomplish the same thing, then table will reorder the columns. ... View more

Just wanted to highlight the fact that the key here is saving a search for the map command to use. Variable names inside a string disappear when run by the scheduler. ... View more