Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About avilandau
avilandau
Path Finder
Member since:
12-18-2014
06-05-2020
Community Statistics
| Posts | 30 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 12-18-2014 |
Activity Feed
- Got Karma for How to get session key in a search script (| script ) similar to the way a scripted input can?. 06-05-2020 12:48 AM
- Got Karma for How to create a drilldown to pass time to timerange.latest to a new search and adding a millisecond?. 06-05-2020 12:47 AM
- Got Karma for How to create a drilldown to pass time to timerange.latest to a new search and adding a millisecond?. 06-05-2020 12:47 AM
- Got Karma for How to create a drilldown to pass time to timerange.latest to a new search and adding a millisecond?. 06-05-2020 12:47 AM
- Got Karma for How to disable a search for a dashboard panel?. 06-05-2020 12:47 AM
- Posted Re: How to get session key in a search script (| script ) similar to the way a scripted input can? on Splunk Search. 07-27-2016 08:50 AM
- Posted How to get session key in a search script (| script ) similar to the way a scripted input can? on Splunk Search. 07-27-2016 08:08 AM
- Tagged How to get session key in a search script (| script ) similar to the way a scripted input can? on Splunk Search. 07-27-2016 08:08 AM
- Tagged How to get session key in a search script (| script ) similar to the way a scripted input can? on Splunk Search. 07-27-2016 08:08 AM
- Tagged How to get session key in a search script (| script ) similar to the way a scripted input can? on Splunk Search. 07-27-2016 08:08 AM
- Posted Re: How to use encrypted credentials (storage/passwords) in the REST API Modular Input? on All Apps and Add-ons. 07-20-2016 06:54 AM
- Posted How to use encrypted credentials (storage/passwords) in the REST API Modular Input? on All Apps and Add-ons. 07-19-2016 02:58 PM
- Tagged How to use encrypted credentials (storage/passwords) in the REST API Modular Input? on All Apps and Add-ons. 07-19-2016 02:58 PM
- Posted Re: SETUP.XML URL encoding lists values and updates correctly only if slash (/) exists, but fails to update with * or $ on Splunk Search. 06-23-2016 11:21 AM
- Posted Re: setup.xml password field requires confirmation even when the password is not changed on Security. 06-22-2016 07:16 AM
- Posted setup.xml password field requires confirmation even when the password is not changed on Security. 06-21-2016 06:18 PM
- Tagged setup.xml password field requires confirmation even when the password is not changed on Security. 06-21-2016 06:18 PM
- Tagged setup.xml password field requires confirmation even when the password is not changed on Security. 06-21-2016 06:18 PM
- Posted SETUP.XML URL encoding lists values and updates correctly only if slash (/) exists, but fails to update with * or $ on Splunk Search. 06-21-2016 05:54 PM
- Tagged SETUP.XML URL encoding lists values and updates correctly only if slash (/) exists, but fails to update with * or $ on Splunk Search. 06-21-2016 05:54 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 3 | |||
| 0 | |||
| 0 |
07-27-2016
08:50 AM
Yes, custom SPL command in python is surely an option. Will I need the Python SDK for that? Can you refer me to some exmaple or link for that?
... View more
07-27-2016
08:08 AM
1 Karma
I'm storing a few credentials in Splunk keystore using setup.xml endpoint="storage/passwords". I have no problem extracting the credential in my scripted input since the session-key is sent to its stdin. However, that is not the case to search script (I think also referred custom script). My script doesn't actually perform a Splunk search like other activities related to my Splunk App, but I need the extract the password using the session key. I tested it to see what I get in stdin to experiment and I do in fact get few lines as follows, but I don't see how to get the session_key from these:
splunkVersion:6.4.1
allowStream:1
keywords:%22%22
search:%7C%20script%20search_script%20%22PARAM-1%22%20PARAM-2
sid:admin__admin_VEVTVF9BVVRI__search1_1469631525.79
realtime:0
preview:0
truncated:0
... View more
07-20-2016
06:54 AM
Thanks Damien. I'm familiar with the get_credential as I used it in my scripted inputs (though I will condition the return based on realm since I have multiple pairs stored). However, after I looked at rest.py and I need to ask: I see the snippet you sent will be put at the beginning of do_run and it creates 2 variables ( encrypted_username, encrypted_password) which are actually the clear text but I don't see them being used later and also I'm not sure what should I put in the auth_type in the inputs.conf. I thought I could leave it as "basic" and just replace the following:
#for basic and digest
auth_user=config.get("auth_user")
auth_password=config.get("auth_password")
with
#for basic and digest with stored credentials
auth_user, auth_password= get_credentials(SESSION_TOKEN)
since get_credentil will return exactly what I have today in inputs.conf
Can you comment on that please?
Thanks
... View more
07-19-2016
02:58 PM
I'm using the "REST API Modular Input" add-on (rest_TA) and it works fine with authentication BASIC. However, this uses the clear password in the inputs.conf and I would like to use the encrypted credentials that I manage using my setup.xml screen in a similar way I do in my scripted inputs (where I use a the session key that Splunk send into the scripted input). Since rest_TA is a SPLUNK module, I would think this is possible/supported, but I could find any reference to it. If this is considered a custom handler and required a module in authhandlers.py can you describe this?
... View more
06-23-2016
11:21 AM
After investigating more I narrowed it down and will open a different question more accurately describing the problem
... View more
06-22-2016
07:16 AM
My end-point is a custom conf file and my entity is an existing one. I'm running 6.4.1. If I change just the user id, and don't fill in the confirm password field (the password field itself is obviously populated) I get an error the the fields don't match.
... View more
06-21-2016
06:18 PM
I have a password field in setup.xml which provides a second confirmation field. However, the confirmation is requested also if the password field has not been touched. This means I always have to enter the password even if I just changed other fields.
... View more
06-21-2016
05:54 PM
I'm using setup.xml for some script:// and monitor:// endpoints. I use %252F for / , %2A for * , %24 for $ , and %20 for space. All information is displayed correctly from the conf files (i.e. setup can find the entry), but when I update, I get the error of POST failure. I tested some entries with only a slash / and the save works fine, but I have some with * which I must include as well. I've also tried %252A for the * (similar to the slash), but it still failed. The few samples in the documentation show mainly the slash though there is one example with $ (they use %24 ), but even that didn't work for me.
Can you advise.
... View more
03-07-2016
03:35 PM
I just realized that adding the spath solve this problem but I'm still not sure how to break the JSON. However that should probably be a different question.
... View more
03-07-2016
02:30 PM
I've downloaded and installed the rest-api modular input (rest_ta). I've defined in my inputs.conf REST end point that I'm interested in which returns JSON and when I do a search and display the results in list format Splunk shows the JSON format perfectly, i.e. all json fields are display in red with full expand/collapse on any part of the Json. I believe that this indicates Splunk recognizes it as JSON since the source type is _json and the response type is json. However, when I try to do any stats on it I get "no results found". So tried the samples shown in the "analytics.usa.gov Recreated Using Splunk sample" and I have the same issue, i.e. when I search "sourcetype="_json" source="rest://visits by desktop mobile tablet devices over 90 days p1d" I can see a perfect JSON breakdown but if I add stats (sourcetype="_json" source="rest://visits by desktop mobile tablet devices over 90 days p1d"| stats latest(totals.devices.desktop) I get no result found. I'm not sure what the issue is since it seems that for JSON response the default response handler is sufficient and there is no need for special handler and also the sample above doesn't mention anything else.
... View more
07-29-2015
12:39 PM
I saw the same question before and the answer given does work, i.e. add a link to the menu as:
<a href="http://HOST:8000/en-US/manager/search/apps/local/AppName/setup?action=edit">Setup</a>
But I was looking more for a relative path similar to what I do for logon, e.g.
<a href="../../account/logout">Logout</a>
Can you advise on that relative path to the Setup screen?
... View more
- Tags:
- navigation
- setup
04-22-2015
03:12 PM
I guess you didn't get my point. I want to have a checkbox on the screen that control when to disable it and when to have it (i.e. I don't need to get rid of it I just need to have it dynamic per user decision).
... View more
04-22-2015
08:05 AM
1 Karma
I have a dashboard (really a form) with few panels each doing a search and export and several input fields each (all set to some default so they are not always change and are ready for a search even if the user is not changing any of them). All items have searchonchange set to false so the user makes all the input before pushing submit. My goal is to enable the user to skip a few of the searches. I could hide each panel with checkbox at the top and use "depends" in the panel, but that only hides the panel. The search still runs when I click the submit. How can I disable the search itself?
... View more
02-24-2015
10:06 AM
I was looking for the exact feature. Did you fin a way to do this?
... View more
01-29-2015
10:38 AM
Thanks. Let me explain exactly what I need. There is no time chart involved but rather a drilldown from one table to another. The source table display multiple lines where one of the fields is a free text field consist of a single line for some records and multiple lines for some other (i.e. there could be several "new lines" embedded in this field. The source table displays only the first line of this field so I see a group of records in one page. When I click on a specific row I want to show in a second table just that record where I display in "event" format so I see all the lines of that event. The problem I have is generating the right search for the second table to produce only that row and I can do it by including the right time range. I want to take the time of the clicked record and add as minimal as possible to the "latest" so I will catch only that record. I'm using "set token" and right now I pass to 2 token. I can manually change one of them and then the search is right but I really want set them right in the first place.
I will try to check what does _span give me (I'll set a token with this name and see the form.token input field to see what it is.
... View more
01-28-2015
07:49 PM
3 Karma
I'm not sure this is the only way to do what I need, but this is the only thing I could think of. I have a table with multiple entries displayed and on a click, I want to drilldown to display the clicked record in more detail. The problem is that other than the time, there is nothing that uniquely identifies the event, so I pass the $row._time" to the next form both to timerange earliest and latest. However, this gives an error that latest must be greater than earliest. If I then manually change the time by adding 1 millisecond the search works okay. So 2 questions:
1 - Is there an internal key from Splunk I can use in order to uniquely identify the row so I don't need to use time range
2 - How can I pass the value of the row time + 1 millisecond (or any math for that matter). What is the format for this?
... View more
01-27-2015
10:55 AM
I meant to write {asterisk}POC4 and it worked. The field message in a table shows the first line but that is actually better because in the table grid it is good to see all entries and for those that are multi-line the first line only thus the grid looks unified. I'll do another drilldown to get the _raw of a single multiline entry.
... View more
01-27-2015
10:26 AM
Hold on.... I just tried profile=POC4 and I got all lines!!! I'm not sure how to explain it.
... View more
01-27-2015
10:24 AM
When I'm doing
index=my_index sourcetype=gpp_error_log
I get the expected result of all lines where the profile, code, and severity are displayed correctly (in table format) for all lines
If I do
index=my_index sourcetype=gpp_error_log profile=POC4 (or even POC4*)
I get only the single lines
If I do index=my_index sourcetype=gpp_error_log code=nnnn (where nnnn is from a multi line)
I get no result found
... View more
01-27-2015
10:09 AM
To illustrate my point: I do a search with only sourcetype so I get all lines (those that are mutli-line show only the first line in the grid) and all of the lines show the right fields. I click for drilldown (default to search for now) and if I click on the first line of a mutli line the search comes back with no result found and if I click on a single line drilldown search finds it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
