Hello, I have a custom time range picker, which I defined in the local times.conf of my app: /opt/splunkdev2/splunk/etc/apps/FRUN/local/times.conf: ... [EVENT_20220819] header_label = UPG label = 2208 earliest_time = 20220819 latest_time = 20230217 order = 501 ... It works kind of okay, but I am not getting my label displayed when I pick the time in the dashboard, it gets translated to the date: when I choose from the picker: I will get displayed in the dashboard: What do I do wrong?   The second question would be, if there is a way to set the default of the time picker based on the dynamic fetch from the times.conf. The point is that I am updating the times.conf on daily basis at os level with crontab, then refresh the conf-times entity for the time ranges to appear in the picker. This works fine, but with the new ranges coming, I would like also to change the default for the picker in my dashboard (e.g. setting it to last time range event, being last software upgrade for instance). And the last question would be, if there is any way to make these time ranges visible only in my particular dashboard. I have set it on the App-Level, but the app has many dashboards and I do not need them there. It confuses the users. Or at least club them is a separate category like Presets2 (e.g. SoftwareUpgrades). ... View more

Hello, We have several alerts which occasionally go in status waiting (correponding jobs) and stay like that. Then the next executions of these alerts are not triggered of course, so we get quite some skipped jobs. The jobs overview states the jobs are in status "Parsing", however when I copy the corresponding search and execute in another search window it finishes quite fast.  Please see also the screenshot  below. It seems to stuck in the following part (last entries in the search.log:   .... 12-05-2022 06:40:02.915 INFO ChunkedExternProcessor [15318 searchOrchestrator] - Running process: /vol1/opt/splunkdev2/splunk/bin/python3.7 /vol1/opt/splunkdev2/splunk/etc/apps/splunk_app_db_conn       I increased all possible limits and quotas I could come up with to lift any restrictions on the concurrency, but it did not help ...   How would I investigate it further?   ... View more

Hello, I am playing with the data annotation, uploading it to my dashboard from the csv. Is it possible to have the annotation_label dynamic in a way, that I can copy the text out of it? Or perhaps even click it when it is a link ... Please see the screenshot. Regards, Kamil   ... View more

Hello, I need to execute a GET request from the Splunk search, passing the header and, this is important, be able to receive the header of the answer, not only the body (curl_message). My issue is that with the first GET request a token needs to be requested and first with this token I can proceed to the next requests (POST). This token comes however over the header and I have no impact on this. If possible I would like to stick to the SPL search, if needed I can install additional Apps, but I would like to avoid coding in Python / creating custom commands.  I tried to achieve my goal using the Webtools App, please see the code below, however there seems to be only the curl_message to be returned, not the response header. Or at least I would not know how to force the Webtools App to return it. Please advice. Kind Regards, Kamil     | makeresults count=1 | eval header="{\"x-csrf-token\":\"fetch\"}" | curl user= pass= method=get headerfield= header debug=true uri="https://myip/sap/opu/odata/sap/INBOUNDCONNECTOR/InboundAlertSet"        ... View more

Hello, I need to read the json data into the Splunk. I use the Webtools |curl for that. However at the moment I do not have access to the data from Splunk, but what I have is the data in the json form in the file. In the meantime until I get the proper access to the data per |curl, I would like to start already with writing the SPL processing it and for that I would like to read it from the file. How would I do it? How would I read the datafile in json format that I get it in one single field in Splunk, like _raw? From there I could pick it and manipulate further with spath. I do not really want to index the file, I would just like to read it into a single field, that I have the same starting situation as with the curl call. Is it possible? Kind regards, Kamil ... View more

Hello, I would like to perform the insert/update on my DB table out of the DB Connect. The corresponding db_outputs.conf looks as follow:   [Z_USERS] connection = HANA_S4_FRUN_FH1 customized_mappings = id:id:16,name:name:32,username:username:32,email:email:32 ,address.street:address_street:32, address.suite:address_suite:32, address.city:address_city:32, address.zipcode:address_zipcode:32 , address.geo.lat:address_geo_lat:32, address.geo.lng:address_geo_lng:32, phone:phone:32, website:website:32 , company.name:company_name:32, company.catchphrase:company_catchphrase:64, company.bs:company_bs:64 disabled = 0 is_saved_search = 0 scheduled = 0 table_name = Z_USERS ui_query_catalog = SAPHANADB ui_query_schema = FRX_READ_USER ui_query_table = Z_USERS using_upsert = 1 unique_key = id,name,username #interval = 40 * * * *     So my DB primary key is a combination of the id+name+username. Unfortunately it wont work. When I define the above unique_key to be only one field and of course create the underlying DB table correspondingly, it will be fine, so the issue is not laying anywhere else, it has to do definitely with the composite primary key. How would I overcome this? Is it possible? I mean one of the ideas would be to concatenate the fields of the key into an additional key, but this means changing the DB structure (additional column) and this is not always possible. So ideally the solution should be that the DB Connect is able to handle this, especially that this is not so uncommon case to have compound keys I think. Kind Regards, Kamil ... View more