About rmjohns

rmjohns · ‎05-12-2023

Surprisingly, it seems to work if I add a TIMESTAMP_FIELDS line to the bottom of the source type section like: [LOGDATA] EXTRACT-LOG = ^(?<domain>[^,]+),(?<host>[^,]+),[^,]+,[^,]+,[^,]+,(?<timezone>[^,]+),(?<sourcename>[^,]+),(?<TEXT>.+)$ TIME_FORMAT = %m/%d/%Y %H:%M:%S TIMESTAMP_FIELDS = _time, timezone Splunk must create the _time field and then update it with the timezone?

rmjohns · ‎05-12-2023

Our server is forwarding events for us and includes some extra fields at the beginning of each event. One of those fields is the timezone offset of the server. So the event might look like: domain,hostname,timezone,path,log_message Where the log_message contains a timestamp but the timestamp can be in different locations in the log_message and the timestamp can have different formats. The timestamp does not include timezone information. Splunk does a good job of finding the timestamps and creating the _time to match, but I can't figure out how to apply the timezone field. I really want to have in my props.conf to have TZ= reference the timezone field from the events: TZ=timezone but that doesn't seem to work.

rmjohns · ‎06-20-2022

As an addendum, the rest API returns the same results, which makes sense since I assume the SDK is just a wrapper for that. ie, using: curl https://splunk-dev1:8089/services/data/inputs/monitor also only returns a small subset of my expected inputs. And currently, the inputs I'm looking for are all "monitor" type of inputs.

rmjohns · ‎06-20-2022

I'm trying to do a little testing of our Splunk installation and I am looking at the Python SDK examples. I've run the inputs.py script hoping it would get me a list of all the inputs defined in our inputs.conf but it only seems to return a small subset. I don't see any logic as to why it is returning the subset it does. I get about 30 records back from inputs.py. I expect well over 100. Running "splunk btool inputs list" gives me the set I expect, but I don't want to have to run this locally. Is there any rules or restrictions to the Python SDK API to get the list of inputs? Maybe some options missing in the sample to get the defined inputs list? Thanks Rob.

rmjohns · ‎07-02-2018

We have a Dashboard panel that includes some embedded html that we are trying to enable for i18n translation. <row > <panel id="backgroundForInputText"> <html> <div id="descriptionForInputText"> <p>Filter your data queries by time range and domain</p> </div> </html> </panel> When I do the " splunk extract i18n -app " command this shows up in the messages.pot as : msgid "" "<div id=\"descriptionForInputText\"><p>Filter your data queries by " "time range and domain</p></div>" I translate these strings and generate the messages.mo file, but the changes never get picked up, they always display in the original text. All the other strings show up translated, but the embedded html sections don't. Suggestions? Thanks Rob. Addition .. Experimenting a little more, I have a single dashboard with both an input panel and an html panel <input type="text"> <label>Test1</label> </input> <panel id="backgroundForInputRadio"> <html>Test1</html> When I do the splunk extract, it shows Test1 coming from both lines. I modify the msgstr="Test2" and I can see the input box changes but the html does not. Is there a way to make this work? Splunk extracted the message from the block so it knows to look for it. Just not sure how to make it use the translation in there. Thanks Rob.

Posts	5
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎06-01-2018

Online Status	Offline
Date Last Visited	‎05-12-2023 10:39 PM

How to pull timezone from a field in each event?

Python SDK example inputs.py not returning all inp...

Translating dashboard embedded html

Re: Pulling timezone from a field in each event.

How to pull timezone from a field in each event?

Re: Python SDK example inputs.py not returning all...

Python SDK example inputs.py not returning all inp...

Translating dashboard embedded html