About avilandau

avilandau · ‎07-27-2016

Yes, custom SPL command in python is surely an option. Will I need the Python SDK for that? Can you refer me to some exmaple or link for that?

avilandau · ‎07-27-2016

I'm storing a few credentials in Splunk keystore using setup.xml endpoint="storage/passwords". I have no problem extracting the credential in my scripted input since the session-key is sent to its stdin. However, that is not the case to search script (I think also referred custom script). My script doesn't actually perform a Splunk search like other activities related to my Splunk App, but I need the extract the password using the session key. I tested it to see what I get in stdin to experiment and I do in fact get few lines as follows, but I don't see how to get the session_key from these: splunkVersion:6.4.1 allowStream:1 keywords:%22%22 search:%7C%20script%20search_script%20%22PARAM-1%22%20PARAM-2 sid:admin__admin_VEVTVF9BVVRI__search1_1469631525.79 realtime:0 preview:0 truncated:0

avilandau · ‎07-20-2016

Thanks Damien. I'm familiar with the getcredential as I used it in my scripted inputs (though I will condition the return based on realm since I have multiple pairs stored). However, after I looked at rest.py and I need to ask: I see the snippet you sent will be put at the beginning of dorun and it creates 2 variables ( encryptedusername, encryptedpassword) which are actually the clear text but I don't see them being used later and also I'm not sure what should I put in the auth_type in the inputs.conf. I thought I could leave it as "basic" and just replace the following: #for basic and digest auth_user=config.get("auth_user") auth_password=config.get("auth_password") with #for basic and digest with stored credentials auth_user, auth_password= get_credentials(SESSION_TOKEN) since get_credentil will return exactly what I have today in inputs.conf Can you comment on that please? Thanks

avilandau · ‎07-19-2016

I'm using the "REST API Modular Input" add-on (restTA) and it works fine with authentication BASIC. However, this uses the clear password in the inputs.conf and I would like to use the encrypted credentials that I manage using my setup.xml screen in a similar way I do in my scripted inputs (where I use a the session key that Splunk send into the scripted input). Since restTA is a SPLUNK module, I would think this is possible/supported, but I could find any reference to it. If this is considered a custom handler and required a module in authhandlers.py can you describe this?

avilandau · ‎06-23-2016

After investigating more I narrowed it down and will open a different question more accurately describing the problem

avilandau · ‎06-22-2016

My end-point is a custom conf file and my entity is an existing one. I'm running 6.4.1. If I change just the user id, and don't fill in the confirm password field (the password field itself is obviously populated) I get an error the the fields don't match.

avilandau · ‎06-21-2016

I have a password field in setup.xml which provides a second confirmation field. However, the confirmation is requested also if the password field has not been touched. This means I always have to enter the password even if I just changed other fields.

avilandau · ‎06-21-2016

I'm using setup.xml for some script:// and monitor:// endpoints. I use %252F for / , %2A for * , %24 for $ , and %20 for space. All information is displayed correctly from the conf files (i.e. setup can find the entry), but when I update, I get the error of POST failure. I tested some entries with only a slash / and the save works fine, but I have some with * which I must include as well. I've also tried %252A for the * (similar to the slash), but it still failed. The few samples in the documentation show mainly the slash though there is one example with $ (they use %24 ), but even that didn't work for me. Can you advise.

avilandau · ‎03-07-2016

I just realized that adding the spath solve this problem but I'm still not sure how to break the JSON. However that should probably be a different question.

avilandau · ‎03-07-2016

I've downloaded and installed the rest-api modular input (restta). I've defined in my inputs.conf REST end point that I'm interested in which returns JSON and when I do a search and display the results in list format Splunk shows the JSON format perfectly, i.e. all json fields are display in red with full expand/collapse on any part of the Json. I believe that this indicates Splunk recognizes it as JSON since the source type is _json and the response type is json. However, when I try to do any stats on it I get "no results found". So tried the samples shown in the "analytics.usa.gov Recreated Using Splunk sample" and I have the same issue, i.e. when I search "sourcetype="json" source="rest://visits by desktop mobile tablet devices over 90 days p1d" I can see a perfect JSON breakdown but if I add stats (sourcetype="_json" source="rest://visits by desktop mobile tablet devices over 90 days p1d"| stats latest(totals.devices.desktop) I get no result found. I'm not sure what the issue is since it seems that for JSON response the default response handler is sufficient and there is no need for special handler and also the sample above doesn't mention anything else.

avilandau · ‎07-29-2015

I saw the same question before and the answer given does work, i.e. add a link to the menu as: <a href="http://HOST:8000/en-US/manager/search/apps/local/AppName/setup?action=edit">Setup</a> But I was looking more for a relative path similar to what I do for logon, e.g. <a href="../../account/logout">Logout</a> Can you advise on that relative path to the Setup screen?

avilandau · ‎04-22-2015

I guess you didn't get my point. I want to have a checkbox on the screen that control when to disable it and when to have it (i.e. I don't need to get rid of it I just need to have it dynamic per user decision).

avilandau · ‎04-22-2015

I have a dashboard (really a form) with few panels each doing a search and export and several input fields each (all set to some default so they are not always change and are ready for a search even if the user is not changing any of them). All items have searchonchange set to false so the user makes all the input before pushing submit. My goal is to enable the user to skip a few of the searches. I could hide each panel with checkbox at the top and use "depends" in the panel, but that only hides the panel. The search still runs when I click the submit. How can I disable the search itself?

avilandau · ‎02-24-2015

I was looking for the exact feature. Did you fin a way to do this?

avilandau · ‎01-29-2015

Thanks. Let me explain exactly what I need. There is no time chart involved but rather a drilldown from one table to another. The source table display multiple lines where one of the fields is a free text field consist of a single line for some records and multiple lines for some other (i.e. there could be several "new lines" embedded in this field. The source table displays only the first line of this field so I see a group of records in one page. When I click on a specific row I want to show in a second table just that record where I display in "event" format so I see all the lines of that event. The problem I have is generating the right search for the second table to produce only that row and I can do it by including the right time range. I want to take the time of the clicked record and add as minimal as possible to the "latest" so I will catch only that record. I'm using "set token" and right now I pass to 2 token. I can manually change one of them and then the search is right but I really want set them right in the first place. I will try to check what does _span give me (I'll set a token with this name and see the form.token input field to see what it is.

avilandau · ‎01-28-2015

I'm not sure this is the only way to do what I need, but this is the only thing I could think of. I have a table with multiple entries displayed and on a click, I want to drilldown to display the clicked record in more detail. The problem is that other than the time, there is nothing that uniquely identifies the event, so I pass the $row._time" to the next form both to timerange earliest and latest. However, this gives an error that latest must be greater than earliest. If I then manually change the time by adding 1 millisecond the search works okay. So 2 questions: 1 - Is there an internal key from Splunk I can use in order to uniquely identify the row so I don't need to use time range 2 - How can I pass the value of the row time + 1 millisecond (or any math for that matter). What is the format for this?

avilandau · ‎01-27-2015

I meant to write {asterisk}POC4 and it worked. The field message in a table shows the first line but that is actually better because in the table grid it is good to see all entries and for those that are multi-line the first line only thus the grid looks unified. I'll do another drilldown to get the _raw of a single multiline entry.

avilandau · ‎01-27-2015

Hold on.... I just tried profile=POC4 and I got all lines!!! I'm not sure how to explain it.

avilandau · ‎01-27-2015

When I'm doing index=myindex sourcetype=gpperror_log I get the expected result of all lines where the profile, code, and severity are displayed correctly (in table format) for all lines If I do index=myindex sourcetype=gpperror_log profile=POC4 (or even POC4*) I get only the single lines If I do index=myindex sourcetype=gpperror_log code=nnnn (where nnnn is from a multi line) I get no result found

avilandau · ‎01-27-2015

To illustrate my point: I do a search with only sourcetype so I get all lines (those that are mutli-line show only the first line in the grid) and all of the lines show the right fields. I click for drilldown (default to search for now) and if I click on the first line of a mutli line the search comes back with no result found and if I click on a single line drilldown search finds it.

Posts	30
Solutions	2
Karma Given	0
Karma Received	5
Member Since	‎12-18-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: How to get session key in a search script (| s...

How to get session key in a search script (| scrip...

Re: How to use encrypted credentials (storage/pass...

How to use encrypted credentials (storage/password...

Re: SETUP.XML URL encoding lists values and update...

Re: setup.xml password field requires confirmation...

setup.xml password field requires confirmation eve...

SETUP.XML URL encoding lists values and updates co...

Re: REST API JSON fields shown in search but searc...

REST API JSON fields shown in search but search w...

How to access the setup screen from the navigation...

Re: How to disable a search for a dashboard panel?

How to disable a search for a dashboard panel?

Re: Is it possible to create a dynamic drilldown o...

Re: How to create a drilldown to pass time to time...

How to create a drilldown to pass time to timerang...

Re: Why isn't my LINE_BREAKER configuration breaki...

Re: Why isn't my LINE_BREAKER configuration breaki...

Re: Why isn't my LINE_BREAKER configuration breaki...

Re: Why isn't my LINE_BREAKER configuration breaki...