About spavin

theprophet01

this is perfect, thanks @spavin !

danspav · ‎07-16-2023

Well spotted! I had a couple of variations, and left this in but you're right, the foreach isn't needed here.

orangered6000 · ‎05-15-2023

Is this better than calling the /health endpoint? Or was this answer written before that existed? IE: https://localhost:8088/services/collector/health

spavin · ‎03-30-2021

Hi all, I have recently upgraded the Splunk_TA_New_Relic to v 2.2.0 on Splunk 8.0.7. Version 2.1.0 worked fine, but after the upgrade to 2.2.0 I started getting a lot of python errors. Has anyone found this before or know a solution? I'm going to try to set the python version to use 2.7, but wondering if there is something else we need to do to get the new version up and running. Here's a sample of the python error: 2021-03-30 13:18:42,644 ERROR The script at path=/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/Splunk_TA_New_Relic_rh_new_relic_insights.py has thrown an exception=Traceback (most recent call last): File "/opt/splunk/bin/runScript.py", line 82, in <module> exec(open(REAL_SCRIPT_NAME).read()) File "<string>", line 4, in <module> File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/splunktaucclib/rest_handler/endpoint/validator.py", line 8, in <module> from past.builtins import basestring File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/past/__init__.py", line 88, in <module> from past.translation import install_hooks as autotranslate File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/past/translation/__init__.py", line 42, in <module> from lib2to3.refactor import RefactoringTool File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/lib2to3/refactor.py", line 25, in <module> from .fixer_util import find_root File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/lib2to3/fixer_util.py", line 7, in <module> from .pygram import python_symbols as syms File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/lib2to3/pygram.py", line 32, in <module> python_grammar = driver.load_packaged_grammar("lib2to3", _GRAMMAR_FILE) File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/lib2to3/pgen2/driver.py", line 156, in load_packaged_grammar return load_grammar(grammar_source) File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/lib2to3/pgen2/driver.py", line 131, in load_grammar g.load(gp) File "/opt/splunk/etc/apps/Splunk_TA_New_Relic/bin/splunk_ta_new_relic/aob_py3/lib2to3/pgen2/grammar.py", line 108, in load d = pickle.load(f) AttributeError: 'collections.OrderedDict' object has no attribute 'append' Thanks in advance.

neluvasilica · ‎02-03-2020

that worked! thank you!

to4kawa · ‎02-01-2020

Thanks @spavin JSON_TRIM_BRACES_IN_ARRAY_NAMES = <boolean> * Whether or not the JSON parser for 'INDEXED_EXTRACTIONS' strips curly braces from names of fields that are defined as arrays in JSON events. * When the JSON parser extracts fields from JSON events, by default, it extracts array field names with the curly braces that indicate they are arrays ("{}") intact. * For example, given the following partial JSON event: {"datetime":"08-20-2015 10:32:25.267 -0700","log_level":"INFO",..., data:{...,"fs_type":"ext4","mount_point":["/disk48","/disk22"],...}} Because the "mount_point" field in this event is an array of two values ("/disk48" and "/disk22"), the JSON parser sees the field as an array, and extracts it as such, including the braces that identify it as an array. The resulting field name is "data.mount_point{}"). * Set 'JSON_TRIM_BRACES_IN_ARRAY_NAMES' to "true" if you want the JSON parser to strip these curly braces from array field names. (In this example, the resulting field is instead "data.mount_point"). * CAUTION: Setting this to "true" makes array field names that are extracted at index time through the JSON parser inconsistent with search-time extraction of array field names through the 'spath' search command. * Default: false this option is useful, too.

spavin · ‎01-31-2020

Hi @ylucena, One way to filter out already defined data is to use streamstats combined with evals. First thing to do is sort the table by Host, interface, ip_address and OS. Then you can compare each row with the value of the previous row. If they are the same as the previous line, then change the value to "". |...previous search here... | sort Host, interface, ip_address, OS | streamstats current=false last(Host) as prev_host, last(interface) as prev_interface, last(ip_address) as prev_ipaddress | eval Host=if(Host==prev_host,"",Host) | eval interface=if(Host=="" AND interface == prev_interface,"",interface) | eval ip_address=if(Host=="" AND interface=="" AND ip_address==prev_ipaddress,"",ip_address) | table Host, interface, ip_address, OS Checks: This search checks the Host to see if it's the same as the last one, and if so sets it to "". Next it looks at the Interface - if the host is already set to "" and the interface is the same as the last one, then it sets the interface to "". Finally, a similar check is done for ip_address. As long as the Host and interface are blank, it will set the ip_address to "" if it's the same as the previous one. In all other cases the fields are left as-is. That results it the following: Cheers, Daniel

robjackson · ‎03-05-2020

Has this been answered? Will the splunk app support 13.1 netscaler.

vas123 · ‎04-02-2019

Thank you. It worked

raja8220 · ‎04-03-2019

Am not getting the list of the device which is not sending the logs ??

sakthiganesht · ‎03-21-2019

Thanks for all the help, the lookups are completely handled by lookup editor. The initial lookup files in the deployer are cleaned. The dynamic lookup's from external system are ftp to deployer and pushed to search head members by the deployer.

mdmaala · ‎03-06-2019

the table looks like this: | Username | Machine 1 Machine 2 I want to separate the username field into Machine1 and Machine2

woodcock · ‎11-11-2019

Like this: |makeresults | eval _raw=" _time id apiid did callerid extension_number 2019-03-02 09:42:05 533481479 vejf7t2gehtq3cttuml4 18008112345 10118997050 11111103003 2019-03-02 09:42:05 533481480 vejf7t2gehtq3cttuml4 18008112345 10118997050 11111103003 2019-03-02 09:42:05 533481481 vejf7t2gehtq3cttuml4 18008112345 10118997050 11111102000 2019-03-02 09:59:34 533489343 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:34 533489344 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111102000 2019-03-02 09:59:34 533489345 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:54 533489611 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:54 533489612 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:54 533489613 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111100063 2019-03-02 09:59:55 533489614 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111100063 2019-03-02 10:00:23 533489836 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:23 533489837 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111102000 2019-03-02 10:00:23 533489838 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:43 533489949 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:43 533489950 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:43 533489951 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111100063 2019-03-02 10:00:43 533489952 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111100063" | multikv forceheader=1 copyattrs=f | eval _time = strptime(time, "%Y-%m-%d %H:%M:%S") | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | eventstats min(id) AS min_id max(id) AS max_id | multireport [where id == min_id | table time, did, and callerid] [where id == max_id | table extension_number ] | stats values(*) AS *

tchaeunsang1 · ‎03-06-2019

Thanks a lot for your answer ! Actually I changed the bucket size to 10MB so everytime the current size reach the maxData size, hot data rolls to warm data and current size decrease by 10MB (bucket size).

niketn · ‎03-01-2019

@davidlapello, what do you want to show when all hosts have 0 count? A pie slice can not be rendered with 0 value. So you will need to clarify the intent in case all values are zero. Do you have a lookup or inventory of all hosts that can be pulled in case index does not have host data?

spavin · ‎03-05-2019

I have the same thing happening with my thawed path - it is configured as: [my_index] homePath = volume_hot:/$_index_name/db coldPath = volume_cold:/$_index_name/colddb thawedPath = $SPLUNK_DB/$_index_name/thaweddb ... The hot and cold work as intended, however the thawed db ends up in: /opt/splunk/var/lib/splunk/$_index_name/thaweddb I checked the docs for indexes.conf, and while it doesn't explicitly tell you to not use $_index_name for thawedDB path, it doesn't use it in the example (but it does for homePath/ coldPath). It says that the thawedPath should contain an absolute path that contains the thawed (resurrected) databases for the index. Of note, it mentions: We strongly recommend that you avoid the use of environment variables in index paths, aside from the possible exception of SPLUNK_DB. See homePath for the complete rationale. However, that warning is also mentioned for homePath and cold Path. For now, I'll stick to writing out the index name in the path.

Posts	30
Solutions	10
Karma Given	5
Karma Received	24
Member Since	‎11-09-2018

Online Status	Offline
Date Last Visited	3 weeks ago

Python errors when upgrading Splunk_TA_New_Relic t...

Support for Netscaler 13

Re: Is it possible to export ITSI Services?

Re: Flatten JSON associative array with variable k...

Re: How to check if an HEC is up or not before pos...

Python errors when upgrading Splunk_TA_New_Relic t...

Re: drilldown condition set token based on click.v...

Re: What will the JSON Path for breaking this JSON...

Re: Cascade Table View

Re: Support for Netscaler 13

Re: How do you group by substring of URI?

Re: How to get the non reporting device list??

Re: How do you handle a lookup in search head clus...

Re: How do you split two string values joined in o...

Re: Extract fields from multiple events based off ...

Re: Why my current index size is larger than the m...

Re: Pie Chart - shows no results found when result...

Re: index_name variable to use in all index paths