I installed your app on a SHC with SAML (ADFS) configured. When executing | samlpull, I get an error. Inside log, I see: 11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py': Traceback (most recent call last): 11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py': File ".../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py", line 33, in <module> 11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py': expected_saml_groups = saml_utils.pull_remote_saml() 11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py': File ".../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml_utils.py", line 47, in pull_remote_saml 11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py': if not authorization_conf_url.startswith("https"): 11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py': AttributeError: 'NoneType' object has no attribute 'startswith' ... View more

Hello @starcher Are you planning to upgrade you app to support Python 3 / Splunk 8.x.x ? It would be great. Thanks. ... View more

Hello, I already know how to statically rewrite the index value based on a sourcetype. Typically using something similar to: https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev But I have today a slightly more complex need. events are generated on a HF as following: - index = prefix-environment-default - sourcetype = (5 different values) per sourcetype, I need to rewrite the index as following: - if sourcetype = sourcetype1 then "default" suffix in index name should be replaced by something else specific to this index - but (this is the part I have not find how to manage yet)... the first part of the original index name should be changed... especially, the middle part (environment) will vary and should remain intact. is it possible to apply kind of regex/sed to capture the "default" suffix and replace it by the suffix that match a given sourcetype ? Then I would duplicate the transform to have one per sourcetype Thanks. ... View more

Hello, I have several critical UF/HF that providing equivalent service in a load-balanced topology. I would like to leverage deployment server / client feature to push the configuration to them, but would like to control when a given DS client will really download/apply the config. For example, I have 3 nodes acting as load-balanced HTTP Event Collector. I would like to trigger the update through DS of one node, wait the node to apply the change, before proceeding with others. Questions : - is it possible to disable automatic config update of a given instance (Splunk Enterprise or UF) - then is there a command that can be run locally or remotely to trigger the usual DS client refresh on-demand/manually Thanks. ... View more

Hello, It looks Maps+ expects a final table output with one unit count per row. What if I have events to be displayed with an Amount field where I want to display the cumulated amount per location for a given period... I am not sure how I can write the final table to be compatible with Maps+ | stats sum(Amount) by City, Longitude, Latitude (...) | table ??? ... View more

Hello, Is it possible to use following syntax: |savedsearch mysearch replace_me="value" AND having the search run as admin (or any other account) in a dashboard I know how to do each one but can find a way to get both at same time. My use case is to grant end users to enable end users to make search with placeholder without having to grant them access to the underlying index. For instance, it could be | savedsearch "Get Stats about this host" host=SERVER1 Regards. ... View more