I'm trying to create a custom alert action, but I'm seeing an error in the splunkd.log . WARN sendmodalert - action=myapp - Unable to find alert action script for action="myapp" in app="myapp_alerts" What is the best way to troubleshoot this? Thanks ... View more

Hey all, I would like to automatically apply some logic to the end of any alert which will help guide users to snap to a particular timeframe around an event (without having to rely on SID lifespan or generated links). What I'm waiting to do -- I'm wanting to expose epoch times for earliest and latest that user can just paste into the a search to snap to the same time period. The logic I'm wanting to postpend is this- | addinfo | rename info_sid AS _info_sid | rename info_max_time AS _info_max_time | rename info_min_time AS _info_min_time | rename info_search_time AS _info_search_time I'm testing this on Splunk 6.3 -- if I append this manually to a search, it works, but I would like to hide this logic from the end users. Any suggestions? At the end of the day I would like to print something similar to this in the generated email message: earliest=$result._info_min_time$ latest=$result._info_max_time$ Which would produce something like this: earliest=1445285820.000 latest=1445285881.137 The following isn't in the correct timestamp format for users to be able to cut and paste into the searches: Report started : $job.earliestTime$ Report finished : $job.latestTime$ as it shows up like: Report started : 2015-10-19T20:17:00.000+00:00 Report finished : 2015-10-19T20:18:01.939+00:00 Thanks ... View more

(Using Splunk6) Does any one know if Splunk can do something similar to this <fieldset autoRun="false" submitButton="true"> <input type="text" token="earliest"> <label>earliest time</label> <default>now</default> </input> <input type="text" token="latest"> <label>latest time</label> <default>now</default> </input> </fieldset> I'm wanting to not use a timepicker, but instead, give them two text boxes where they can specify a date range. Everytime I try to supply values I get: Invalid earliest_time Except if I enter 0 for earliest and now for latest. I've tried both $earliest$> $latest$ and then also earliest=$earliest$ latest=$latest$ in the search Thanks ... View more

Does anyone know if it is possible to reference the value of a transaction? For instance transaction account startswith="event_type=login" endswith="event_type=logout" At this point I should have events encapsulating full user sessions (per account). Can I reference the value of a transaction? Ideally I'd like to do something like rex field=transaction mode=sed "s/oldvalue/newvalue/g" without have to do this on the _raw prior to the transaction. Thanks greatly ... View more

Can Splunk DB Connect be deployed to a forwarder (with a bundled java executable) or does it need to run off a search head? ... View more

I have an issue where we have a sourcetype that we want to remove a transform (on the indexer) that drops some data (but only for a specific host wildcard pattern). I've been tasked with keeping the same sourcetype name, but not applying the transforms to outputs from a series of hosts. We already use a props [Host: ] stanza for timezones. Is there a simple way to keep the same sourcetype, but force inputs from a particular host pattern to follow a different set of transforms? Preferrably a host (and sourcetype) specific transform. Thanks ... View more

What are the recommended Perfmon counters and procedures to properly and fully populate this app? 1)I am manually running the LookupManagement - Build searches. Should some of these builds be should be saved searches and run on intervals? 2) When I goto the summary page, I notice that no data is being shown because some of the searches reference counter="undefined" , but in my case the counter is always defined. I'm looking for some best practices tips and guidelines here. Thanks ... View more

I'm trying to get the Splunk_for_SQLServer app to work. I notice that some of my powershell scripts are executing, but some are not. The powershell app offers a really nice sourcetype=Powershell:ScriptExecutionErrorRecord field. Below is the error I'm seeing; I'm at a loss of what it would complain about GetDirectoryRoot. Does anyone have any experience with this error, or have some tips to better debug this? The host is Windows Server 2008 R2 Enterprise. Thanks ParentIdentity="3e7a6cdb-5689-4227-9f10-b2764696858b" ErrorIndex="0" ErrorMessage="Exception calling "GetDirectoryRoot" with "1" argument(s): "The path is not of a legal form."" PositionMessage="At C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-SQLServer\bin\Common.psm1:217 char:5 + $LVM = [IO.Directory]::GetDirectoryRoot($_.PrimaryFilePath) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" CategoryInfo="NotSpecified: (:) [], MethodInvocationException" FullyQualifiedErrorId="ArgumentException" Exception="System.Management.Automation.MethodInvocationException: Exception calling "GetDirectoryRoot" with "1" argument(s): "The path is not of a legal form." ---> System.ArgumentException: The path is not of a legal form. at System.IO.Path.NormalizePath(String path, Boolean fullCheck, Int32 maxPathLength, Boolean expandShortPaths) at System.IO.Directory.GetDirectoryRoot(String path) at CallSite.Target(Closure , CallSite , RuntimeType , Object ) --- End of inner exception stack trace --- at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception) at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.Interpreter.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.LightLambda.RunVoid1[T0](T0 arg0) at System.Management.Automation.ScriptBlock.InvokeWithPipeImpl(Boolean createLocalScope, ErrorHandlingBehavior errorHandlingBehavior, Object dollarUnder, Object input, Object scriptThis, Pipe outputPipe, InvocationInfo invocationInfo, Object[] args) at System.Management.Automation.ScriptBlock.<>c__DisplayClass4.<InvokeWithPipe>b__2() at System.Management.Automation.Runspaces.RunspaceBase.RunActionIfNoRunningPipelinesWithThreadCheck(Action action) at System.Management.Automation.ScriptBlock.InvokeWithPipe(Boolean useLocalScope, ErrorHandlingBehavior errorHandlingBehavior, Object dollarUnder, Object input, Object scriptThis, Pipe outputPipe, InvocationInfo invocationInfo, Object[] args) at System.Management.Automation.ScriptBlock.InvokeUsingCmdlet(Cmdlet contextCmdlet, Boolean useLocalScope, ErrorHandlingBehavior errorHandlingBehavior, Object dollarUnder, Object input, Object scriptThis, Object[] args) at Microsoft.PowerShell.Commands.ForEachObjectCommand.ProcessRecord() at System.Management.Automation.CommandProcessor.ProcessRecord()" InnerException="System.ArgumentException: The path is not of a legal form. at System.IO.Path.NormalizePath(String path, Boolean fullCheck, Int32 maxPathLength, Boolean expandShortPaths) at System.IO.Directory.GetDirectoryRoot(String path) at CallSite.Target(Closure , CallSite , RuntimeType , Object )" index = mssql source = Powershell sourcetype = Powershell:ScriptExecutionErrorRecord ... View more