Is it possible to extend the export capabilities from splunk, in order to export to other formats : - export all _raw events to zip format - export xml fields to zip file with xml files... Is it possible to write some function that the standard ui can use ? ... View more

I've added some elements with sideview to my view, and now I'm unable to edit it through sideview anymore, its not possible to select elements for edit/delete Correction : it works under Firefox, not Chrome 37.0.2062.124 m <view isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html"> <label>Durchlaufzeiten Datenabrufen</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> </module> <module name="HTML" layoutPanel="viewHeader"> <param name="html"><![CDATA[ <h1>Durchlaufzeit zwischen DatenAbrufenAnfrage und DatenAbrufenAntwort</h1> DatenAbrufenAntwort.WeitereDaten="true" werden ignoriert, da diese die gleiche LogID haben, deswegen kann man die Durchlaufzeit nicht pro Anfrage berechnen ]]></param> <module name="URLLoader" autoRun="True"> <param name="keepURLUpdated">True</param> <module name="Pulldown"> <param name="label">Plattform</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="label">test</param> <param name="value">t_kihub</param> </list> <list> <param name="label">inte</param> <param name="value">i_kihub</param> </list> <list> <param name="selected">true</param> <param name="label">prod</param> <param name="value">p_kihub</param> </list> </param> <param name="name">plattform</param> <module name="Search"> <param name="search"><![CDATA[ | dbquery p_cusmdm-cusmdm12 "SELECT distinct ps_senderkennung as partner FROM PVService pv JOIN CODEZENTRAL c ON c.CD_ID=PV.CD_KIHUBSYSTEM WHERE lower(substr(C.CD_WERT,7,1)) || '_kihub'='$plattform$' ORDER BY ps_senderkennung" ]]></param> <module name="Pulldown"> <param name="valueField">PARTNER</param> <param name="float">left</param> <param name="name">partner</param> <param name="staticOptions"> <list> <param name="value">*</param> </list> </param> <module name="Pulldown"> <param name="label">Dienst</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="value">ans</param> </list> <list> <param name="value">dfi</param> </list> <list> <param name="value">aus</param> </list> <list> <param name="selected">true</param> <param name="value">*</param> </list> </param> <param name="name">dienst</param> <module name="TimeRangePicker"> <param name="default">Last 60 minutes</param> <module name="Button"> <param name="allowAutoSubmit">False</param> <module name="Search"> <param name="search"><![CDATA[ index=$plattform$ partner=$partner$ dienst=$dienst$ resource="datenabrufen.xml" | fields - _raw | fields logID,_time,partner,dienst,channel,messageType,DatenAbrufenAntwort.WeitereDaten | rename DatenAbrufenAntwort.WeitereDaten as WeitereDaten | eval Anfrage_time=case(messageType="DatenAbrufenAnfrage",_time) | eval Antwort_time=case(messageType="DatenAbrufenAntwort",_time) | stats min(Anfrage_time) as Anfrage_time, max(Antwort_time) as Antwort_time,c(eval(WeitereDaten="true")) as WeitereDaten by partner,dienst,channel,logID | search WeitereDaten=* | eval timeDiff=round(Antwort_time - Anfrage_time,0) | eval _time=Anfrage_time | convert ctime(Anfrage_time) as Anfrage, ctime(Antwort_time) as Antwort ]]></param> <module name="JobProgressIndicator" layoutPanel="panel_row1_col1" /> <module name="Pulldown" layoutPanel="panel_row1_col1" group="Filter"> <param name="group">Filter</param> <param name="label">Partner</param> <param name="postProcess">$postProcess$ | dedup partner | sort partner</param> <param name="valueField">partner</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="selected">true</param> <param name="value">*</param> </list> </param> <param name="name">F_partner</param> <module name="Pulldown"> <param name="labelField">dienst</param> <param name="valueField">dienst</param> <param name="postProcess">$postProcess$ | dedup dienst | sort dienst</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="selected">true</param> <param name="value">*</param> </list> </param> <param name="label">Dienst</param> <param name="name">F_dienst</param> <module name="Pulldown"> <param name="label">Channel</param> <param name="valueField">channel</param> <param name="staticOptions"> <list> <param name="selected">true</param> <param name="value">*</param> </list> </param> <param name="postProcess">$postProcess$ | dedup channel | sort channel</param> <param name="name">F_channel</param> <module name="PostProcess" layoutPanel="panel_row3_col1" group="Daten"> <param name="group">Daten</param> <param name="search"><![CDATA[ search partner=$F_partner$ dienst=$F_dienst$ channel=$F_channel$ | sort - timeDiff | eval actions="" | eval endTime=Antwort_time + 100 | rename Anfrage_time as startTime | table _time,partner,dienst,channel,Anfrage,Antwort,timeDiff,logID,actions,startTime,endTime ]]></param> <module name="Pager"> <module name="Table"> <param name="hiddenFields">startTime,endTime,plattform</param> <module name="Button" group="row.fields.actions"> <param name="group">row.fields.actions</param> <module name="Redirector"> <param name="popup">True</param> <param name="url">cus5_vdv_other-all_messages?plattform=$plattform$&amp;partner=$row.fields.partner$&amp;dienst=$row.fields.dienst$&amp;channel=$row.fields.channel$&amp;logID=$row.fields.logID$&amp;earliest=$row.fields.startTime$&amp;latest=$row.fields.endTime$&amp;autorun=True</param> <param name="windowFeatures">resizable=yes,status=yes,scrollbars=yes,toolbar=yes</param> </module> </module> </module> </module> </module> <module name="PostProcess" layoutPanel="panel_row2_col1"> <param name="search"><![CDATA[ | search partner=$F_partner$ dienst=$F_dienst$ channel=$F_channel$ | timechart span=5m max(timeDiff) as max, min(timeDiff) as min, avg(timeDiff) as avg | eval avg=round(avg,2) ]]></param> <module name="HiddenChartFormatter"> <param name="chartTitle">Durchlaufzeit Statistik (5 Minuten)</param> <param name="chart">line</param> <module name="JSChart" /> </module> </module> <module name="PostProcess" layoutPanel="panel_row2_col2"> <param name="search"><![CDATA[ | search partner=$F_partner$ dienst=$F_dienst$ channel=$F_channel$ | timechart span=5m avg(timeDiff) as avg by partner | eval avg=round(avg,2) ]]></param> <module name="HiddenChartFormatter"> <param name="chartTitle">Durchlaufzeit bei Partner</param> <param name="chart">line</param> <module name="JSChart" /> </module> </module> <module name="PostProcess" layoutPanel="panel_row2_col1"> <param name="search"><![CDATA[ | search partner=$F_partner$ dienst=$F_dienst$ channel=$F_channel$ | timechart span=5m max(timeDiff) as max by dienst | eval max=round(avg,2) ]]></param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chartTitle">Max Durchlaufzeit bei Dienst</param> <module name="JSChart" /> </module> </module> <module name="PostProcess" layoutPanel="panel_row2_col2"> <param name="search"><![CDATA[ | search partner=$F_partner$ dienst=$F_dienst$ channel=$F_channel$ | timechart span=5m max(timeDiff) as max by channel | eval max=round(avg,2) ]]></param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chartTitle">Max Durchlaufzeit bei Channel</param> <module name="JSChart" /> </module> </module> </module> </module> </module> <module name="SearchControls"> <param name="sections">export print jobControls</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view> ... View more

I've made a scripted alert in python, and put it in py app directory .../splunk/etc/apps/myapp/bin/scripts/scripted_alert.py in .../splunk/var/log/splunk/python.log I see that it has been triggered with the correct path, and parameters : 2014-08-22 14:37:01,178 INFO ['.../splunk/etc/apps/myapp/bin/scripts/scripted_alert.py', '1', '| stats c | eval ... When I try to execute it with .../splunk/bin/splunk cmd python .../splunk/etc/apps/myapp/bin/scripts/scripted_alert.py' with all the parameters from the python.log, it is working... It seems that splunk is not taking the python interpreter ? But in my file header I have #!.../splunk/bin/python # -*- coding: utf-8 -*- (... is a substitution / I'm using Splunk 5.0.5) ... View more

I have several pulldowns, with default value "*", when I launch the view for the first time, and run the search with all pulldown having default value to "*", the query works but if I look to the search element with "runtime debug" I see that all pulldowns $foo$ were not substituted with they default value "*" so I have uri='baseurl///' instead of uri='baseurl/*/*/*' if I click a second time without changing anything, the query doesn't work and the $foo$ are still not substituted. if I click manually on the * value from each pulldown, it is the working... I use Sideviews 3.2.6 on 5.0.5 <view isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html"> <label>IHS (WAS Loadbalancer)</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> </module> <module name="URLLoader" layoutPanel="splSearchControls-inline" autoRun="True"> <param name="keepURLUpdated">True</param> <module name="HTML" layoutPanel="viewHeader"> <param name="html"><![CDATA[ <h1>IHS access combined logs (Loadbalancer Websphere)</h1> <p><ul> <li>Anfragen vom Partner (SBB als Server)</li> <li>Zeitgesteuerte Abrufen vom Jobmanager (status, abos, datenbereit)</li> </ul> </p> ]]></param> <module name="Pulldown" layoutPanel="panel_row1_col1" group="HauptSuche"> <param name="label">Plattform</param> <param name="float">left</param> <param name="template">$value$</param> <param name="group">HauptSuche</param> <param name="label">Plattform</param> <param name="name">plattform</param> <param name="staticOptions"> <list> <param name="value">ihst70a</param> <param name="label">test</param> </list> <list> <param name="value">ihsi70a</param> <param name="label">inte</param> </list> <list> <param name="selected">true</param> <param name="value">ihsp70a</param> <param name="label">prod</param> </list> </param> <module name="Search" > <param name="search"><![CDATA[ | dbquery p_cusmdm-cusmdm12 "SELECT distinct ps_senderkennung as partner FROM PVService pv JOIN CODEZENTRAL c ON c.CD_ID=PV.CD_KIHUBSYSTEM WHERE lower(substr(C.CD_WERT,7,1)) =substr('$plattform$',4,1)" ORDER BY ps_senderkennung ]]></param> <module name="Pulldown"> <param name="valueField">PARTNER</param> <param name="name">partner</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="value">*</param> <param name="label">*</param> </list> <list> <param name="value">tech</param> </list> </param> <param name="label">Partner</param> <param name="valueField">PARTNER</param> <module name="Pulldown"> <param name="float">left</param> <param name="name">dienst</param> <param name="label">Dienst</param> <param name="staticOptions"> <list> <param name="value">*</param> </list> <list> <param name="value">dfi</param> </list> <list> <param name="value">ans</param> </list> <list> <param name="value">aus</param> </list> <list> <param name="value">inbound</param> </list> <list> <param name="value">outbound</param> </list> </param> <param name="float">left</param> <module name="Pulldown"> <param name="label">resource</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="selected">true</param> <param name="value">*</param> </list> <list> <param name="value">aboverwalten</param> </list> <list> <param name="value">datenabrufen</param> </list> <list> <param name="value">datenbereit</param> </list> <list> <param name="value">sendAboAnfragen</param> </list> <list> <param name="value">sendPartnerUpdates</param> </list> <list> <param name="value">sendStatusAnfrage</param> </list> <list> <param name="value">status</param> </list> </param> <param name="name">resource</param> <module name="TextField"> <param name="width">40px</param> <param name="label">status</param> <param name="float">left</param> <param name="name">status</param> <param name="default">*</param> <module name="Checkbox"> <param name="offValue">status=*</param> <param name="label">Status!=200</param> <param name="float">left</param> <param name="name">statusNot200</param> <param name="onValue">status!=200</param> <param name="checked">True</param> <module name="TextField"> <param name="width">80px</param> <param name="default">*</param> <param name="label">clientIP</param> <param name="float">left</param> <param name="name">clientip</param> <module name="TextField"> <param name="label">Freie Suche</param> <param name="label">Freie Suche</param> <param name="float">left</param> <param name="name">freeSearch</param> <module name="TimeRangePicker"> <param name="default">Today</param> <module name="Button"> <param name="allowAutoSubmit">False</param> <param name="label">Search</param> <module name="Search" layoutPanel="panel_row2_col1" group="Access Combined"> <param name="group">Access Combined</param> <param name="search"><![CDATA[ index=$plattform$ uri="/kihub/kivdv/$partner$/$dienst$/$resource$*" status="$status$" $statusNot200$ clientip="$clientip$" $freeSearch$| rex field=uri "/kihub/kivdv/(?P<partner>\w+)/(?P<dienst>\w+)/(?P<resource>\w+)" | table _time,partner,dienst,resource,status,uri,clientip,method,version,bytes ]]></param> <module name="SearchControls"> <param name="sections">jobControls export </param> <param name="jobControls"> finalize cancel</param> </module> <module name="JobProgressIndicator"> </module> <module name="HTML"> <param name="html"><![CDATA[ <br> $results.eventCount$ / $results.resultCount$ $results.timeRange.label$ ]]></param> <module name="Pulldown"> <param name="postProcess">$postProcess$ | dedup partner| sort partner</param> <param name="label">partner</param> <param name="float">left</param> <param name="valueField">partner</param> <param name="staticOptions"> <list> <param name="selected">*</param> <param name="value">*</param> <param name="label">*</param> </list> </param> <param name="postProcess">$postProcess$ | dedup dienst | sort dienst</param> <param name="name">partner</param> <module name="Pulldown"> <param name="staticOptions"> <list> <param name="value"> *</param> <param name="label">*</param> </list> </param> <param name="postProcess">$postProcess$ | dedup dienst | sort dienst</param> <param name="name">dienst</param> <param name="valueField">dienst</param> <param name="staticOptions"> <list> <param name="value"> *</param> <param name="label">*</param> </list> </param> <param name="label">dienst</param> <param name="float">left</param> <module name="Pulldown"> <param name="staticOptions"> <list> <param name="selected">true</param> <param name="value">*</param> </list> </param> <param name="name">resource</param> <param name="label">resource</param> <param name="valueField">resource</param> <param name="postProcess">$postProcess$ | dedup resource | sort resource</param> <param name="float">left</param> <module name="Pulldown"> <param name="valueField">status</param> <param name="postProcess">$postProcess$ | dedup status | sort status</param> <param name="staticOptions"> <list> <param name="selected">*</param> <param name="value">*</param> <param name="label">*</param> </list> </param> <param name="valueField">status</param> <param name="label">status</param> <param name="float">left</param> <param name="name">status</param> <module name="Checkbox"> <param name="offValue">status=*</param> <param name="name">F_not200</param> <param name="float">left</param> <param name="label">Status!=200</param> <param name="onValue">status!=200</param> <module name="PostProcess" group="Meldungen"> <param name="group">Meldungen</param> <param name="search"><![CDATA[ search partner=$partner$ dienst=$dienst$ resource="$resource$" status="$status$" $F_not200$ | table _time,partner,dienst,resource,status,method,version,bytes,uri,* ]]></param> <module name="Pager"> <param name="count">20</param> <module name="Table"> <param name="hiddenFields">logID,logID2</param> </module> </module> <module name="PostProcess" layoutPanel="panel_row5_col1" group="Stats over partner by status"> <param name="group">Stats over partner by status</param> <param name="search"><![CDATA[ $postProcess$ | chart c as anzahl over partner by status ]]></param> <module name="HiddenChartFormatter"> <param name="chart.stackMode">stacked</param> <param name="chart">column</param> <module name="JSChart" /> </module> </module> <module name="PostProcess" layoutPanel="panel_row4_col1" group="Timechart by partner"> <param name="group">Timechart by partner</param> <param name="search"><![CDATA[ $postProcess$ | timechart c as anzahl by partner ]]></param> <module name="HiddenChartFormatter"> <param name="chart.stackMode">stacked</param> <param name="chart">column</param> <module name="JSChart" /> </module> </module> <module name="PostProcess" layoutPanel="panel_row3_col1" group="Timechart by Status"> <param name="group">Timechart by Status</param> <param name="search"><![CDATA[ $postProcess$ | timechart c by status ]]></param> <module name="HiddenChartFormatter"> <param name="chart">column</param> <param name="chart.stackMode">stacked</param> <module name="JSChart" /> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view> ... View more