The closest question I came to is this one, but it's not quite there (and it's old). I have a saved search - actually an alert, with actions - that I want to pass dynamic SPL into. You can do this with dashboards and tokens, of course, but I'm specifically looking for an alert that I'm executing over the API. So I may request something like this over the API: https://splunk.mycompany.com:8089/en-US/app/myApp/search?s=%2FservicesNS%2Fnobody%2FmyApp%2Fsaved%2Fsearches%2FmySearch&ExecID=12345 Where the saved search has something like "Execution_ID=$ExecID$" in it - just like you would when requesting a dashboard. The value for $ExecID$ is unique and populating a lookup table for this simple need seems like serious overkill - and it probab;y doesn't even accomplish what I need. I hope this is written clearly enough. I'm 99% sure it can't be done, but it's been a few years since that last question, and, as noted, it's not really a match, anyway. Thanks. ... View more

We log Puppet facts in a large JSON payload, and I want to combine the values of all fields matching a wildcarded expression into a single field to process further. A given server may have any number of IP addresses associated with it, eg: networking.interfaces.eth0.ip networking.interfaces.eth1.ip networking.interfaces.eth1:1.ip networking.interfaces.eth1:10.ip networking.interfaces.eth1:11.ip networking.interfaces.eth1:12.ip networking.interfaces.eth1:13.ip networking.interfaces.eth1:14.ip networking.interfaces.eth1:15.ip networking.interfaces.eth1:16.ip networking.interfaces.eth1:17.ip networking.interfaces.eth1:2.ip networking.interfaces.eth1:3.ip networking.interfaces.eth1:4.ip networking.interfaces.eth1:5.ip networking.interfaces.eth1:6.ip networking.interfaces.eth1:7.ip networking.interfaces.eth1:8.ip networking.interfaces.eth1:9.ip Where each of these fields is an IP address, I'd like to append them into a single field; I've tried this with coalesce, but that doesn't support wildcards; mvappend... just doesn't seem to do anything, or perhaps I'm just using it incorrectly with foreach. tl;dr: given a variable number of fields networking.interfaces.*.ip, how do I concatenate them all into delimited field ip_addresses, a la '10.11.12.13 | 10.11.12.14 | 10.11.12.15 | ...' ? Thanks. ... View more

I'm trying to list names and ID all the saved searches in a given app by specifying the app in my HTTP request, like so: curl -Lsk -H "Authorization: Bearer ${LONG_TOKEN}" -d "output_mode=json" -X GET "https://MyServer:8089/servicesNS/-/MyTeam/saved/searches?count=-1" | ~/jq '.entry[] | {name, value: .id}' (I'm using JQ to filter out the fields I want) But I can see clearly that this is returning results from all apps. Here's a snippet: { "name": "Top Container Memory Usage", "value": "https://MyServer:8089/servicesNS/nobody/Splunk_TA_k8s/saved/searches/Top%20Container%20Memory%20Usage" } { "name": "TU_MyTeam_Tools_Alert", "value": "https://MyServer:8089/servicesNS/nobody/MyTeam/saved/searches/TU_MyTeam_Tools_Alert" } { "name": "Utils - Top REST actions", "value": "https://MyServer:8089/servicesNS/nobody/SA-Utils/saved/searches/Utils%20-%20Top%20REST%20actions" } Given app "MyTeam," how do I request a list of saved searches from that app, and that app only? Thanks. ... View more

Hiya, I swear I knew how to do this without macros, which seem like overkill, but I've lost it. Here's a simple example - define a field and expand that, so my search uses the value of that field: eval hostname=server1| search host=%{hostname} I've tried the usual shell and python syntax for variables as well as Splunk's token syntax , search host=$hostname$, but I'm getting zero results across the board, because it;s searching for the literal string. What do I need to do to expand that "hostname" variable/field? Thanks. ... View more

Heya, I've looked around Answers for a similar problem, but haven't found one yet (edit: I know it seems to be a common problem, but let's say I haven't found a scenario like mine, or an answer). I'm sure this is something really simple that I've done wrong, and it's nagging at me. I have a simple search that I've plugged into the postprocessing example from the Splunk 6.x Dashboards templates. Here's an excerpt: <label>CIP Application Metrics</label> <description>Each panel post processes the base search through a separate search pipeline.</description> <searchTemplate>index=main eventtype=cip-prd layer7_app="CIP"</searchTemplate> <snip fieldset/timepicker stuff/> <row> <panel> <chart> <title>Inbound Connections</title> <searchPostProcess>timechart span=1m sum(cip_inbound_connections_http) by host | fillnull value=0</searchPostProcess> <option name="charting.chart">line</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">logarithmic</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> </chart> </panel> When the dashboards run, it returns "no results" in all of the panels I've created with their specific search criteria and timecharts. I can't upload a screenshot, because I have insufficient karma (doh). But when I "open the search" in a new window from that dashboard panel, the search performs as expected. I have three timechart lines showing the connections by host over the specified period. This isn't a huge result set - maybe a total of 180 records per hour. There shouldn't be gaps, because each field should return a "0" rather than a null, but I added a fillnull to be extra sure. Is there something really embarrassing that I'm missing, here? I'm using Splunk 6.1.2, and the 6.1 template. I'm not using SideView, unless that's somehow bundled into the dashboard templates. I'd be grateful for a nudge in the right direction. ... View more

I'm working on a script to go with some Splunk alerts, and the CSV generated has a line break right in the middle of the "_si" field: _bkt,_cd,_indextime,_raw,_serial,_si,_sourcetype... main~2177~FDEAEF09-6590-4DEE-AE2F-1863332506D8,2177:295465158,1397158816,Apr 10 14:40:15 chmgl9mn15 nmunnel: multipathd: mark as failed,0,chmgl9mn10 main,syslog... So, for some reason, this space between "chmgl9mn10 main" becomes a line-break, which is messing up the data (and script). Splunk doesn't appear to break the spaces in other fields, so maybe it's something weird about that specific "_si" key. Have any of you seen this before? Is there something I can do that doesn't involve fragile regex kludges in my script? Thanks very much. ... View more