I'd use splunk app PDI : https://splunkbase.splunk.com/app/1901/ Or the latest Splunk data stream processing : https://www.splunk.com/en_us/software/stream-processing.html ... View more

hello, i see 3 ways to achieve it : a/The first method i suggested indeed needs the eventgen app you mentionned. if you want your user to use the GUI to upload the sample, i'd simply create a 2nd (standalone) app : that will use eventgen : mysampleapp-local-eventgen.conf mysampleapp-samples-mysample.txt this way your users upload 3 apps : originalapp, eventgen, mysampleapp b/simply put the file on github, and ask people to use the gui : settings->add data, and select your sourcetype. (this requires a small knowledge on Splunk) c/without eventgen : create a simple app containing inputs.conf, your file, indexes.conf, so that it indexes the file when app is installed. the app would contain an indexes.conf to put the file in a new index, and to not mess with their existing indexes. if you do this i recommend you warn the user that this will create a new index, and index the file.: your app contains : mysimpleapp-local-inputs.conf [monitor:///$SPLUNK_HOME/etc/apps/mysimpleapp/samples/mysample.txt] sourcetype=xy index=toto disabled=0 (note, if you are willing to do a good job : add two stanza, one for unix, 1 for windows) for the indexes.conf stanza : simply declare a new index ... View more

a/look at this app : https://splunkbase.splunk.com/app/4030/ if it does not fit your need : b/ One workaround is to use a css for printing, using very thick borders : example of css : @media print { td.range-severe { box-shadow: inset 0 0 0 1000px darkred !important; color: #eee !important; -webkit-print-color-adjust: exact !important; } } working example with this app, containing the js and css, and a dashboard : https://github.com/simondev65/tableprintpdf look for the dashboard inside, export to pdf using your browser : print->pdf. (not the export to pdf within splunk). (this example is courtesy of @dveuve_splunk ) ... View more

please modify the answer : today the password is SPLUNK-{instanceID} as described in AWS marketplace, usage page ... View more

FYI, in my case Chrome was behaving weirdly. using firefox solved the issue ... View more

Hi, looks like a good use case for localize + map command, as you want to pass the earliest and latest for each result: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Localize (look at the examples in the doc) ... View more

Olivier : to complete micahkemp answer : 1. can you share your inputs and props config using btool ? (ec : command to list props is : ./splunk cmd btool props list ) 2.please do check internal log for fragmentation to validate that splunk is splitting events and not something else in the chain (a syslog server could split for example) : search for index=_internal sourcetype=splunkd truncating. ... View more

thanks for the kml link! ... View more

Thanks, why not just downloading the kml version from your link ? Can you share your kml ? ... View more

idea 1 : use the json tool app https://splunkbase.splunk.com/app/3540/ (note, i haven't tried it, but seems to do the job) idea 2 : use SPL to create a new field containing the entire line into JSON format, and pass this field to sns alert this uses foreach command, index=xx | eval message="{" | foreach * [eval message=if("< >"="message", message, message. " \"". "< >" . "\" : \"".< >."\", ")] | eval message=rtrim(message, " ,")| eval message=message." }" -- then finally pass the field message : $result.message$ to sns alert ... View more

The app for salesforce is now available on prem : https://splunkbase.splunk.com/app/3549/ ... View more

My GUESS is : no it's not possible, If the goal is to enrich with region : the solution is to create a simple lookup containing the match (3 column : region, departement, dept_code, and apply this lookup before the geom command See : https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html ... View more

You asked the same question earlier, please first check the answer i gave here : https://answers.splunk.com/answers/489292/edit-search-mrsparkleexposedjsbuilddashboardspagej.html ... View more

see this discussion for complete details : https://answers.splunk.com/answers/345407/hide-create-new-dashboard-button.html ... View more

and % are 2 different things : % are used for date formatting, see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables % is not a wildcard. for wildcard see : https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Wildcards ... View more

Splunk Single instance ? not possible. you need this architecture: http://docs.splunk.com/Documentation/AddOns/released/VMW/Installationoverview ... View more

Have you followed the addon docs specified in the "details" part of splunkbase ? : http://docs.splunk.com/Documentation/AddOns/released/VMW/About and also the doc from vmware app : http://docs.splunk.com/Documentation/VMW I also recommend you watch this video : youtube Unlike other apps, this app requires a good understanding of Splunk, so i'd recommend : 1/you have time to learn: read all this, take a class. 2/you don't have time : onboard an expert, he will set this up for you quickly. ... View more