Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About stuartidelta01
stuartidelta01
Path Finder
Member since:
04-08-2012
10-21-2025
Community Statistics
| Posts | 22 |
| Solutions | 2 |
| Karma Given | 3 |
| Karma Received | 14 |
| Member Since | 04-08-2012 |
Activity Feed
- Posted Re: How to insert ESCU detections via REST API into Splunk ESS? on Splunk Enterprise Security. 10-21-2025 04:24 PM
- Karma Re: How to insert ESCU detections via REST API into Splunk ESS? for livehybrid. 10-21-2025 04:16 PM
- Got Karma for Re: Does the Splunk MINT SDK support iOS 14?. 11-25-2020 02:43 AM
- Posted Re: Does the Splunk MINT SDK support iOS 14? on All Apps and Add-ons. 11-25-2020 01:56 AM
- Got Karma for Does the Splunk MINT SDK support iOS 14?. 11-24-2020 04:24 PM
- Posted Does the Splunk MINT SDK support iOS 14? on All Apps and Add-ons. 10-09-2020 02:31 AM
- Tagged Does the Splunk MINT SDK support iOS 14? on All Apps and Add-ons. 10-09-2020 02:31 AM
- Tagged Does the Splunk MINT SDK support iOS 14? on All Apps and Add-ons. 10-09-2020 02:31 AM
- Tagged Does the Splunk MINT SDK support iOS 14? on All Apps and Add-ons. 10-09-2020 02:31 AM
- Karma Re: Geeting error in Splunk Appinspect :- Check that python version is python3 for executables in restmap.conf. for vsheshadri_splu. 06-05-2020 12:51 AM
- Got Karma for Re: Is there a way to add an extra row based on a pre-defined list of stores if the stores don't exist in the search results?. 06-05-2020 12:50 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Which High Availability(HA) solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there more information about how to take advantage of an education credit announced at .conf2016 keynote?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there more information about how to take advantage of an education credit announced at .conf2016 keynote?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 7 | |||
| 0 |
10-21-2025
04:24 PM
Thanks! is_scheduled=1 helped me solve one of two missing pieces trying to create an ITSI Entity Import saved search. The other part of the puzzle is that this line in savedsearches.conf action.itsi_import_objects = 1 translates to this for the REST API call: -d actions="itsi_import_objects" As you said... WHY?!? (what else was I going to do with the last 4 hours)
... View more
11-25-2020
01:56 AM
1 Karma
Thanks for your input - I did do that (contact Splunk rep): I also noticed MINT is now listed as a legacy product: https://docs.splunk.com/Documentation/Legacy I expect that this means there won't be any iOS 14 support I'm told that there will be a new product in this space, most likely within the Splunk APM tooling - next year
... View more
10-09-2020
02:31 AM
1 Karma
Documentation states that the latest supported version is iOS 13: https://docs.splunk.com/Documentation/MintIOSSDK/5.2.x/DevGuide/Requirementsandinstallation Other crash analytics type products tend to state things like: "supports iOS 10+" - so wondering if this is: - just a documentation update required - whether it probably works fine but Splunk need to complete testing before they will support it - the SDK needs an update before it will support iOS 14
... View more
Labels
- Labels:
-
development
06-01-2020
04:42 PM
Just managed to get the add-on through the app inspect phase. I had trouble connecting to the app inspect REST API for a couple of days and I think this error was confusing things. Thanks for your help - I'm will uptick your answer below as the restmap.conf above is now working OK for me.
... View more
05-29-2020
02:31 AM
restmap.conf - note that I have modified this to add the python.version lines, the add-on builder does not include this by default. Both setups return the error as per original post
(Update - this now works OK for me)
[admin:TA_add_on_for_carbon_intensity]
match = /
members = TA_add_on_for_carbon_intensity_settings, TA_add_on_for_carbon_intensity_generation, TA_add_on_for_carbon_intensity_regional, TA_add_on_for_carbon_intensity_intensity
[admin_external:TA_add_on_for_carbon_intensity_settings]
handlertype = python
python.version=python3
handlerfile = TA_add_on_for_carbon_intensity_rh_settings.py
handleractions = edit, list
[admin_external:TA_add_on_for_carbon_intensity_generation]
handlertype = python
python.version=python3
handlerfile = TA_add_on_for_carbon_intensity_rh_generation.py
handleractions = edit, list, remove, create
[admin_external:TA_add_on_for_carbon_intensity_regional]
handlertype = python
python.version=python3
handlerfile = TA_add_on_for_carbon_intensity_rh_regional.py
handleractions = edit, list, remove, create
[admin_external:TA_add_on_for_carbon_intensity_intensity]
handlertype = python
python.version=python3
handlerfile = TA_add_on_for_carbon_intensity_rh_intensity.py
handleractions = edit, list, remove, create
... View more
05-28-2020
04:30 PM
I am also getting this issue running splunk 8.04 and add-on builder v3.0.1. I'm developing an add-on that makes some very simple REST API calls (add-on works fine).
I also changed the global python.version to be python3 in server.conf as well as adding python.version=python3 entries in each of the scripts defined in restmap.conf. I still get the error when running "validate" in the add-on builder (which runs appinspect).
I tested another REST based add-on that previously passed appinspect. It now fails with the same error. This add-on is already on splunkbase and is showing the "AppInspect passed" badge:
https://splunkbase.splunk.com/app/4976/
Looking at this page, the entry near the top suggests appInspect was updated 28th April
https://dev.splunk.com/enterprise/docs/releaseapps/appinspect/appinspectreferencetopics/splunkappinspectcheck
I'm going to email a link to this ticket to the app inspect email address to raise awareness. You should add the "appinspect" tag to this ticket if you can.
... View more
01-24-2020
03:25 PM
This helped me understand the issue I had - thanks. Then I found this and was able to remove the newline characters entirely:
https://answers.splunk.com/answers/111206/can-i-remove-blank-lines-in-my-event.html
... View more
06-17-2019
03:54 PM
1 Karma
Add a lookup file - stores.csv - that just lists you store numbers.
then use:
|inputlookup stores.csv | join Store type=outer [search <your-search>] | fillnull
The following search worked for me (I added a csv list of dummy hostname + one that matched my local server name into hosts_text.csv)
|inputlookup hosts_test.csv|join hostname type=outer [search index=_internal |stats count by host|rename host as hostname] | fillnull
Example hosts_test.csv for above search:
hostname
myserver
localhost
notaserver
Results:
count hostname
4845 myserver
0 localhost
0 notaserver
... View more
12-05-2018
12:11 PM
Try this:
index=_internal host=<insert-your-ITSI-host(s)> source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" uri=*SA-ITOA/itoa_interface*
|timechart span=1d dc(user) as users
... View more
12-05-2018
11:38 AM
(1) You need to carry forward _time from your stats command if you plan to use a timechart afterwards - in the example below I use "earliest(_time) as _time" to achieve this - this associates the event with the time it started
(2) Use range(_time) to calculate a duration
index=myindex action=\*action*
|stats earliest(_time) as _time range(_time) as duration by uniqueId user host
|timechart span=5m avg(duration) as avgDuration dc(uniqeId) as Sessions
You will probably then find that the two series on the timechart operate on different scales - use the overlay control in the timechart to allow one of the series to be represented differently. e.g. set the timechart to an area chart and then use overlay controls to set the pairedEvents series to be a line on that chart. Click on the option to allow it to have it's own scale, which will appear on the right hand side of the chart.
You may want to create a new field called durationMS and use that instead for a nicer output, e.g.
eval durationMS = duration * 1000
then avg(durationMS) in the timechart
... View more
11-28-2018
03:47 PM
Note that this is now possible in Splunk 7.2 with the new ingest eval capability.
You can, for instance, apply the eval sha512 function to a field to create a new field:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Data/IngestEval
... View more
02-20-2018
08:37 AM
7 Karma
As per this presentation from .conf 2017: DB Connect is back and it is better than ever :
"No out-of-the-box-solution for HA"
I am interested in finding out which HA solutions people are deploying to protect against a single point of failure on the heavy forwarder that is running DB Connect?
... View more
01-29-2018
05:20 AM
Hi - please email the developer address listed on splunkbase and I'll send you the latest version of the app.
... View more
01-03-2018
05:16 AM
Hi - I am the author of the add-on.
As you have pointed out the current version of the add-on only supports a single URI and therefore a single datapower device.
Can you contact me via the link on splunkbase so that I can understand your requirements and hopefully offer a solution.
... View more
11-01-2017
04:59 PM
In the current version (4.4) - open the Splunk Add-On for AWS:
Inputs -> Create New Input -> Cloudwatch
Name=whatever-you-want e.g. AWS ALB
Account=select the account - you have already setup
Assume Role = leave blank or use role if this is your method
AWS Regions = select one or more regions as required
Click on "Edit in Advanced Mode"
Remove all the exising namespaces
Click Add Namespace
Type: AWS/ApplicationELB and hit Enter
The dimensions and metrics should now update to reflect the dimensions of this namespace
You can modify these as required or leave them as is
Click OK
Set your desired destination index
Set your polling interval and period - Cloudwatch updates these metrics every 60 seconds so you could go for 60 and 60 for these to get the finest level of detail
Hit Save
After a few minutes your index should be populated with the metrics.
General Note:
Some of the cloudwatch namespaces appear by default when you select New Input - Cloudwatch (e.g. EC2,
Many more are available when you click on Add namespace and start typing
Some are not there at all and you have to define them yourself
The AWS CloudWatch metrics reference helps:
http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CW_Support_For_AWS.html
... View more
10-05-2017
11:46 AM
If you plan to use the add-on for Tomcat then as well as log data you have the option of making a JMX connection to pull in various metrics relating to the runtime. Add-ons can save you a lot of time and it's generally worth checking them out if there is one for the technology you are trying to splunk.
https://splunkbase.splunk.com/app/2911/
The release notes in the docs state that the Add-On is supported on Windows.
So, as per the comments above - yes, you can ingest Tomcat data into a Windows hosted Splunk server.
... View more
07-13-2017
03:24 AM
docs link doesn't work (because of the comma) - here's one that does, for the latest version at this point in time:
http://docs.splunk.com/Documentation/Splunk/6.6.2/Viz/ChartConfigurationReference
... View more
03-31-2017
02:10 PM
Thanks Damien - that works 🙂
... View more
03-31-2017
06:52 AM
I am trying to perform a JNDI lookup over SSL to Tibco EMS using the JMS Modular Input. Everything works OK for a non-SSL JNDI lookup and I am also able to create an SSL queue connection (based on an SSL connection factory - when using a non-SSL lookup).
External to Splunk and the JMS TA the following Java code successfully performs a JNDI lookup over SSL:
Properties props = new Properties();
props.put(Context.INITIAL_CONTEXT_FACTORY, "com.tibco.tibjms.naming.TibjmsInitialContextFactory");
props.put(Context.PROVIDER_URL, "tibjmsnaming://localhost:7243");
//SSL JNDI Lookup
props.put(com.tibco.tibjms.naming.TibjmsContext.SECURITY_PROTOCOL,"ssl");
props.put(com.tibco.tibjms.naming.TibjmsContext.SSL_ENABLE_VERIFY_HOST, new Boolean("false"));
...
InitialContext context = new InitialContext(props);
QueueConnectionFactory qconFactory = (QueueConnectionFactory)context.lookup("SplunkConnectionFactory");
All attempts to recreate this setup in the JMS TA (through user_jndi_properties) result in the following error being logged:
03-31-2017 14:18:12.850 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/:splunk : Error connecting : javax.naming.ServiceUnavailableException: Failed to query JNDI: Failed to connect to the server at tcp://localhost:7243 [Root exception is javax.jms.JMSException: Failed to connect to the server at tcp://localhost:7243]
The inputs.conf below shows the setup, all of the commented out user_jndi_properties have been attempted resulting in the same error:
[jms://queue/:splunk]
browse_mode = stats
browse_queue_only = 0
durable = 0
hec_batch_mode = 0
hec_https = 0
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkConnectionFactory
jndi_initialcontext_factory = com.tibco.tibjms.naming.TibjmsInitialContextFactory
jndi_provider_url = tibjmsnaming://localhost:7243
output_type = stdout
sourcetype = jms_test
strip_newlines = 1
#user_jndi_properties = com.tibco.tibjms.naming.TibjmsContext.SECURITY_PROTOCOL="ssl",com.tibco.tibjms.naming.TibjmsContext.SSL_ENABLE_VERIFY_HOST=new Boolean("false")
#user_jndi_properties = com.tibco.tibjms.naming.TibjmsContext.SECURITY_PROTOCOL="ssl",com.tibco.tibjms.naming.TibjmsContext.SSL_ENABLE_VERIFY_HOST="new Boolean("false")"
#user_jndi_properties = com.tibco.tibjms.naming.TibjmsContext.SECURITY_PROTOCOL="ssl",com.tibco.tibjms.naming.TibjmsContext.SSL_ENABLE_VERIFY_HOST="false"
user_jndi_properties = com.tibco.tibjms.naming.TibjmsContext.SECURITY_PROTOCOL="ssl"
I have had a look at the source code for the JMS TA and can see where these properties are set - though I'd need to create a working dev environment and step through the code to see why the above fails. Any help appreciated..
... View more
10-09-2016
11:48 PM
1 Karma
Partners received a link last week to the site that has been setup for this and we are waiting on a unique code (presumably everyone will get their own unique code). This is the latest info I received from splunk education (received at the weekend):
"You will be getting an email in the next few days that details everything about the offer."
So, hopefully this week. For info - I was asking about how to transfer credits between employees, so that should be detailed in the email too.
... View more
10-03-2016
08:14 AM
3 Karma
For those interested in certification - Power User and Admin certification is free to those who have taken the necessary courses. You just email in to Splunk when you are ready to take the exam. They are both online, open book tests but you do need to know your stuff in order to get through all the questions in time (you won't be able able to look everything up) - keep docs.splunk.com close by and it'd also help if you had a splunk install to double check things during the exam.
Splunk Certified Power User Track: http://www.splunk.com/view/education/SP-CAAAAH9
Splunk Certified Admin: http://www.splunk.com/view/SP-CAAAJER
Drill down to see the fees and schedules for each of the courses required.
Beyond that you can do Splunk Architect - there is a $1000 charge for this exam (it's 24 hours and uses multiple AWS instances which you have to configure & build a solution on).
Good luck!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-21-2025
04:16 PM
|
Karma from
