I have the same problem.  To specify it a little further:  I am developing a custom REST Endpoint using  from splunk.persistconn.application import PersistentServerConnectionApplicationPython When I run the endpoint I get the expected result. However if I then go on to change the code, the changes sometimes impact the output and sometimes they don't no matter what I do to the code. Even if I deliberately break the code, the endpoint still works. As far as I could figure out, I have about 5-10 iterations that will impact the output, afterwards some cached version of my script seems to be executed. If I reach that point, the only thing, that makes new versions of the code show up, is restarting splunk, as initially suggested. So if there is something similar to _bump or debug/refresh for Python, that would be a HUGE help. I have experienced this behavior with Splunk 6, 7, and 8. Previous versions I have not done much development on, so I can't say. Any suggestions would be immensely appreciated.     ... View more

You can not configure the lookup through the interface since a geospatial lookup takes 2 inputs (Lat Lon) and the interface only allows for 1. I tried and confirmed the possibility to add a geospatial lookup in <yourApp>/local/data/models/<yourDataModel.json> by adding a calculated field in the calculated fields section of your datamodel like this: { "outputFields": [ { "fieldName": "<FieldName>", "owner": "<DataModelRoot>", "type": "string", "fieldSearch": "", "required": false, "multivalue": false, "hidden": false, "editable": true, "displayName": "<FieldName>", "comment": "", "lookupOutputFieldName": "featureId" } ], "calculationType": "Lookup", "lookupName": "<NameOfYourLookupAsDefinedInTransforms>", "comment": "", "lookupInputs": [ { "inputField": "gps_latitude", "lookupField": "latitude" }, { "inputField": "gps_longitude", "lookupField": "longitude" } ], "owner": "<DatamodelRoot>", "calculationID": "<someHash>", "editable": true }, This "works"... At least most of the time. We are curently seeing issues that lead to the looked up field sometimes being Null or even more weirdly, containing the name of the lookup instead of any valid output. Right now we have no explanation how this happens. There seems to be at least one other user that ran into the same problem, as seen in this question: https://answers.splunk.com/answers/688678/why-does-data-model-show-name-of-lookup-definition.html So if you try this out, I would very much like to hear what your experience was. Some kind of official statement regarding this issue would be great too. ... View more

I am using 2.0.5, this issue seems to still be open? Any info on when a new release is planned? Which capabilities need to be assigned to the alert_manager role to make it work in the meantime? (Assuming it is a capability problem) ... View more

[rest://GA] auth_type = oauth2 endpoint = https://www.googleapis.com/analytics/v3/data/ga?ids=ga%#########&start- date=30daysAgo&end-date=yesterday&metrics=ga%3Asessions&dimensions=ga%3Abrowser host = GoogleAnalytics_BrowserStats http_method = GET index = main index_error_response_codes = 1 oauth2_access_token = XXXXXX oauth2_client_id = XXXXXX oauth2_client_secret = XXXXXX oauth2_refresh_token = XXXXXXX polling_interval = * * * * * response_type = json sourcetype = json_no_timestamp sequential_mode = 1 streaming_request = 0 oauth2_refresh_url = https://accounts.google.com/o/oauth2/token sequential_stagger_time = 30 As mentioned this works when using an interval like 60 seconds but stops doing anything when set to cron. I experimented with different settings for Cron, sequential requests set to true or false and different Stagger Time values. All to no avail. ... View more

Yes I do, there are some reports and alerts running on cron, behaving exactly as expected. No, currently running single instance. ... View more

Any news on this? ... View more

Sorry took a while but here it is: 07-22-2016 08:46:29.392 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: host = XXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/22/16 8:46:29.108 AM 07-22-2016 08:46:29.108 +0200 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Starting new HTTPS connection (1): accounts.google.com host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/22/16 ` 8:46:03.946 AM 07-22-2016 08:46:03.946 +0200 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Starting new HTTPS connection (1): www.googleapis.com host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/22/16 8:45:58.783 AM 07-22-2016 08:45:58.783 +0200 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/rest_ta/bin/rest.py host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:50:44.688 AM 07-21-2016 09:50:44.688 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:50:44.151 AM 07-21-2016 09:50:44.151 +0200 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Starting new HTTPS connection (1): accounts.google.com host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:50:28.850 AM 07-21-2016 09:50:28.850 +0200 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Starting new HTTPS connection (1): www.googleapis.com host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:50:28.686 AM 07-21-2016 09:50:28.686 +0200 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/rest_ta/bin/rest.py host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:17:20.138 AM 07-21-2016 09:17:20.138 +0200 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/rest_ta/bin/rest.py host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:17:20.138 AM 07-21-2016 09:17:20.138 +0200 INFO ExecProcessor - Removing status item "/opt/splunk/etc/apps/rest_ta/bin/rest.py (rest://XXXXXXXXXX) (isModInput=yes) host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:17:20.137 AM 07-21-2016 09:17:20.137 +0200 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/rest_ta/bin/rest.py host = XXXXX source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 7/21/16 9:17:00.400 AM 07-21-2016 09:17:00.400 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" HTTP Request error: 404 Client Error: Not Found They don't seem too useful to me, but maybe they tell you something. Best regards and thanks for looking into this. ... View more

Ok, I found out, that you can get it to work if you add the Access Token to the Custom Header field as access_token=XXXXXX Of course, doing it that way, means it stops working as soon as the current access_token has become invalid, since the refresh process is not working. I would have thought that this is added to the request I am sending automatically and feel completely lost as to how I could get this to update automatically? ... View more

I already had tried that, but it only works on the X-Axis. Using strftime on the Y-Axis results in the line no longer being drawn, apparently because the values are strings after formatting them, which makes sense. Any other suggestions? ... View more

Actually I already looked at the examples, and yes there are nice ones for sparklines... However I can't find one that does anything with the sparklines boundaries. There is one in there, that uses JS to create a single progress-bar-like indicator, which is not what I am looking for. ... View more