In case anyone runs into this old post with the same issue, I opened a support case and was informed that: the "updated" field in the API is a generic field on most Splunk APIs to track changes to configuration such as changes in permissions done from the UI. It is not an accurate method to track changes done to the lookup files themselves.  😞 ... View more

I was still having this problem in 8.0.6 despite having the the following settings set to true (was trying to view an embedded report from another Splunk server): dashboard_html_allowed_embeddable_content = true dashboard_html_allow_iframes = true What ultimately fixed it in our case was upgrading to 8.1.0 and adding the new setting dashboard_html_allowed_domains and setting the specific hostname and port (would not work with just the hostname or wildcard domain for some reason) like so: dashboard_html_allowed_domains = <hostname>.<company_domain>:8000   ... View more

If you run into this page because like me you just built a modular input using the Add-on Builder App and this seems to be the only topic on found on the issue. I would like to point out this command which helped me find (and fix) my issue. There is a developer command that can debug a modinput (documentation here) props to this post for pointing me to it.     #this will run on all modinputs if you aren't sure about your scheme $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config --debug . #otherwise just to see your scheme and input $SPLUNK_HOME/bin/splunk cmd splunkd print-modinput-config --debug <myscheme> <mystanza>       My inputs page was stuck on loading and running this showed me a missing package it was trying to load for my input command. Once I added the Python package my command was missing the message changed to "Introspection setup completed for scheme " and I was able to load the inputs page again. ... View more

Yes, AD has a "magic string" (1.2.840.113556.1.4.1941) that I go into more detail on this answer https://community.splunk.com/t5/All-Apps-and-Add-ons/How-can-I-flatten-nested-Active-Directory-group-members-for/m-p/422464/highlight/true#M51519 But here is a working search for a single user that would give the output you mentioned: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer))(cn=username))" attrs="cn,memberOf" | eval type="Direct" | rename memberOf AS Group | mvexpand Group | append [| ldapsearch search="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:cn=username,dc=amr,dc=corp,dc=mydomain,dc=com))" attrs="cn" | rename dn AS Group | table Group | eval type = "Nested" ] | filldown cn | stats values(type) AS type BY Group cn | rename cn AS User | eval type = if(match(type,"Direct"),"Direct",type) | table User Group type   ... View more

AD does have a "magic string" (1.2.840.113556.1.4.1941) you can add to get this. Using your example the SPL would look like so: index="my_index" [| ldapsearch domain="mydomain" search="(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=MY Group Name,ou=delegated,ou=groups,dc=amr,dc=corp,dc=mydomain,dc=com))" attrs="sAMAccountName" | table sAMAccountName | rename sAMAccountName as User] ...rest of search This also works in reverse say you want to get all groups including the nested groups for a user like so: | ldapsearch search="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:=cn=username,dc=amr,dc=corp,dc=mydomain,dc=com))" attrs="cn" That will give you all groups a user belongs to, but a bit tougher to single out just the nested groups: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer))(cn=username))" attrs="cn,memberOf" | append [| ldapsearch search="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:=cn=username,dc=amr,dc=corp,dc=mydomain,dc=com))" attrs="cn" | rename dn AS memberOfNested | table memberOfNested | eval cn = "username" ] | filldown memberOf | eval nested = if(match(memberOf,memberOfNested),null(),memberOfNested) | fields - memberOfNested | stats values(*) AS * BY cn The AD documentation can be seen here: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx Pay careful attention to Note 10: The string 1.2.840.113556.1.4.1941 specifies LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes. This is an extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. This reveals group nesting. It is available only on domain controllers with Windows Server 2003 SP2 or Windows Server 2008 (or above). ... View more

This is an old question but the new answer to this for anyone running into this should be in simple xml just add the attribute fields with a quoted list like so: ... <option name="drilldown">no</option> <fields>["_time","product","cost","amount","total"]</fields> ... ... View more

I had this issue and opened a support case, I was told it would be fixed in the later version but as of 3.2.0 I am still getting the same problem too. It has to do with conflicts concerning visualization apps, support thought specifically "conflict with multiple matching visualizations set to global". However just simply removing visualizations one at a time or specific visualizations doesn't necessarily fix it as I have found strange combinations of visualizations that cause the issue. Some input I can offer is that I have found in some combinations (but not all, sorry that isn't terribly helpful) these visualizations installed cause it not to work in my instance: heatmap_app horizon_chart_app horseshoe_meter_app location_tracker_app parallel_coordinates punchcard_app quick_state_app SA-graphviz sankey_diagram_app scatterplot3d_app viz_boxplot_app viz_clustermap viz_halo All that being said, it can be very painful and tedious to discover which app(s) are causing the issue in your environment. Probably the best method is a scorched earth one where you remove all visualization apps and bring back one at a time, checking the datalab results with each one... like I said painful. Though of course the ideal state would be for Splunk to fix this in DB Connect. ... View more

I so far only know of an older app that was archived which creates a text table in Slack https://splunkbase.splunk.com/app/2784/ ... View more

I have had this issue where one of the certs had expired. In $SPLUNK_HOME/etc/auth/idpCerts, splunk creates a folder called idpCertChain_1 where it breaks apart the cert you pasted (IdP certificate chains--these are the signing certs from your SSO provider--this can often be found in a metadata file from the provider or sometimes they just outright have a way for you to download it) from the setup into various certs and calls them cert_1.pem, cert_2.pem, ... etc. cert_1.pem is the root CA, cert_2.pem would be an issuing CA if applicable--if not would be the main cert from the IdP (fancy name for single sign on provider). You can check the certs out using $SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -text -in cert_1.pem to see when it expires, adding -endate will print that line last like so: $SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -text -in $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_1/cert_1.pem -enddate Updating the cert with one that was not expired fixed the issue in my case. ... View more

I added a simple solution on this quesiton that might do what you are asking for https://answers.splunk.com/answers/114331/how-to-refresh-the-panel-not-entire-dashboard.html?childToView=777615#answer-777615 ... View more

I wanted to add a new solution to this as the option refresh.auto.interval is now deprecated. There is now a child element of refresh (https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#search) to do this sort of thing. However I needed (and saw other questions) asking for a refresh button (large and obvious to end user) to refresh a single panel, I have found a way to do this with Simple XML with a single option link list input and some token management. The form.refresh is unset using the progress child element so the user can refresh over and over. Below is an example dashboard of how to do so: <form> <label>Refresh Panel Test</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="link" token="refresh"> <label></label> <choice value="Yes">Refresh?</choice> <change> <condition value="Yes"> <set token="refresh_delay">1</set> </condition> </change> </input> <table> <search> <progress> <unset token="refresh_delay"></unset> <unset token="form.refresh"></unset> </progress> <query>| tstats count where index=_internal by source host | sort -count</query> <earliest>-60m@m</earliest> <latest>now</latest> <refresh>$refresh_delay$</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> One problem with the link list input is it makes a gigantic empty space, that isn't terribly effiecient or obvious: By adding an id to the input and some css this can be fixed like so (dashboard with stylesheet and id): <form stylesheet="slim_input.css"> <label>Refresh Panel Test</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="link" token="refresh" id="slim_input> <label></label> <choice value="Yes">Refresh?</choice> <change> <condition value="Yes"> <set token="refresh_delay">1</set> </condition> </change> </input> <table> <search> <progress> <unset token="refresh_delay"></unset> <unset token="form.refresh"></unset> </progress> <query>| tstats count where index=_internal by source host | sort -count</query> <earliest>-60m@m</earliest> <latest>now</latest> <refresh>$refresh_delay$</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> Then the slim_input.css file: #slim_input { display: inline-flex; } #slim_input button { background-color: #4608A5; color: #fff } #slim_input label, #slim_input .splunk-choice-input-message{ display: none; } Now we get a nice purple button that refreshes the given panel: ... View more

The app comes already bundled with the needed files, so there should not be need to download them. The file it is looking for is found at $SPLUNK_HOME/etc/apps/nlp-text-analytics/bin/nltk_data/sentiment/vader_lexicon.zip Because the error mentions "searchpeers" it sounds to me like it is expecting to find that file on the indexer's search bundle that is distributed from the search head. That might be an incorrect assumption, but I have seen similar behavior in my environment. The app is intended to be run "locally" (i.e. --> @Configuration(local=True)) but that config doesn't seem to always be honored. See if you have any blacklists in distsearch.conf that may stop that file or directory from coming down to the indexer. UPDATE: This problem may be fixed after 7.3: Date resolved Issue number Description 2019-02-15 SPL-159461, SPL-159052 SH is not making use of the latest bundle info from the indexer, during the bundle replication. https://docs.splunk.com/Documentation/Splunk/7.3.0/ReleaseNotes/Fixedissues#Distributed_search_and_search_head_clustering_issues ... View more

The cleantext command does offer an option to remove custom stopwords using custom_stopwords=comma-seperated-list, so in your example you could add custom_stopwords="user,report,complain" as the other words are standard stopwords. Or you could remove the particular phrases before running the command. Not sure if that is what you are after. ... View more

No, not that I'm aware of but apparently user-seed.conf has been around for a long time, so I would think it should work for 6.X as well https://docs.splunk.com/Documentation/Splunk/6.0/Admin/User-seedconf ... View more

Great! Glad to hear it. ... View more

Well I'm not certain how regex is handled "under the hood" so to speak. I think nickhillscpl depiction of using job inspector is a good idea to test it, but logically a single operation has got to be more efficient then multiple (unless Splunk is combining them) and likely you are passing the load to the regex engine/module/whatever all at once. ... View more

Techinically the whole thing could be one big regex for a single filter like so: | regex AdminAccount != "^Joe$|^Mike$|^David$|^Max$|^Abe$|^Peter$|\$$|\d+$|sql|sso|admin|local service|internal|snapshots|sharepoint" But if readability counts, then maybe switch the first where statement to a search (because the IN operator is handy though where has something similar) and combine the regex expressions | search AdminAccount IN (Joe Mike David Max Peter) | regex AdminAccount != "\$$|\d+$|sql|sso|admin|local service|internal|snapshots|sharepoint" ... View more

Like richgalloway mentioned in props.conf, make sure it has set KV_MODE = json. Also make sure that each event is a complete JSON event (for example doesn't have any text written before the JSON) You could always copy a JSON line and paste it into a JSON pretty print web site to make sure they can parse it, like https://jsonformatter.org/json-pretty-print. ... View more

I don't have the exact answer but have some ideas for you to try. Depending on how authentication is setup on this Splunk server, if you did have a locally created account then username and password would certainly work but that error sounds more like that the certificate is self-signed and that your Python client doesn't recognize the CA that signed it. You could try temporarily bypass verification https://stackoverflow.com/questions/27835619/urllib-and-ssl-certificate-verify-failed-error. I would recommend trying this out first in postman like this article shows https://answers.splunk.com/answers/692463/how-to-access-splunk-api-in-postman.html (note that you put the search in the body as raw and as is). Lastly, another option is use the Splunk Python SDK instead (http://dev.splunk.com/python) which abstracts many things like this for you. ... View more

It is unclear if you are using the generating command jira to run a JQL search. An example would be something like this: | jira jqlsearch "Project=YOURPROJECT AND Resolved is EMPTY" You can also look for errors in the jira.log like so to see if that gives you any clues for problems connecting: index=_internal source=*jira.log ... View more

I experienced this too and other people mentioned it in the comments but I think it is a good idea to list it as an answer for others who have the same problem. Looks to be caused by having old versions of Splunk App for Windows Infrastructure or Splunk App for Microsoft Exchange as stated in the release notes: The Splunk Add-on for Windows 5.0.1 is not compatible with the Splunk App for Windows Infrastructure version 1.4.4 and the Splunk App for Microsoft Exchange version 3.4.4. Use the Splunk Add-on for Windows 4.8.4 if you want to use either of these apps. ... View more