To the WebTools dev @jkat54 , would it be possible to upload and use your webtools add-on in Splunk Cloud ITSI? ... View more

Hi I have a inherited a KPI that monitors disk space in ITSI, the search works fine and returns a results when the thresholds are breached however the episodes continue even when the server is in maintenance mode. I think I know why but don't yet know how to work around it. This is the KPI search: | mstats avg(LogicalDisk.%_Free_Space) as "logicaldisk_free_space" avg(PhysicalDisk.%_Disk_Read_Time) as "physicaldisk_read_time" avg(PhysicalDisk.%_Disk_Write_Time) as "physicaldisk_write_time" avg(Network_Interface.Packets_Received/sec) as "network_packets_received_per_second" avg(Network_Interface.Packets_Sent/sec) as "network_packets_sent_per_second" avg(Network_Interface.Bytes_Received/sec) as "network_bytes_received_per_second" avg(Network_Interface.Bytes_Sent/sec) as "network_bytes_sent_per_second" avg(Network_Interface.Packets_Outbound_Errors) as "network_packets_outbound_errors" WHERE `sai_metrics_indexes` AND instance!=_Total instance!=P: by host,instance span=30s | eval host_dev=host . ":" . instance | eval "physicaldisk_total_time" = physicaldisk_read_time + physicaldisk_write_time | eval "network_packets_total_per_second" = network_packets_received_per_second + network_packets_sent_per_second | eval "network_mbs_total_per_second" = (network_bytes_received_per_second + network_bytes_sent_per_second)/1000000   The Threshold field is logical_free_space The Split by field is host_dev which as you can see combines the host name with the disk device like this HOST1234:C: The data is filtered by service with the host field The result in the service analyser looks good Problem is with the Entity Name now being HOSTNAME:C: when the HOST is put into maintenance this KPI keeps creating episodes. Can someone help me with a practical way to do this and still use maintenance mode successfully? Cheers ... View more

I have installed NLP Text Analytics and the other supporting apps. The app is working fine on an identical search head but not this new search head. The only difference is that the new search head needs to go via a proxy to get to the internet. I am getting the following error when I search: sourcetype=aws:firehose:json Attributes.postCallSurvey_feedback="*" Agent.Username="*" | eval customerName='Attributes.customerName',postCallSurvey='Attributes.postCallSurvey_feedback' | spath InitiationMethod | search InitiationMethod=INBOUND OR InitiationMethod=CALLBACK | table postCallSurvey | vader textfield=postCallSurvey full_output=t | stats avg(sentiment) AS sentiment 4 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors. [ip-10-7-0-188] LookupError at "/opt/splunk/var/run/searchpeers/ip-10-7-2-136-1569282229/apps/nlp-text-analytics/bin/nltk/data.py", line 675 : ********************************************************************** Resource vader_lexicon not found. Please use the NLTK Downloader to obtain the resource: >>> import nltk >>> nltk.download('vader_lexicon')  Searched in: - '/root/nltk_data' - '/usr/share/nltk_data' - '/usr/local/share/nltk_data' - '/usr/lib/nltk_data' - '/usr/local/lib/nltk_data' - '/opt/splunk/nltk_data' - '/opt/splunk/share/nltk_data' - '/opt/splunk/lib/nltk_data' - '/opt/splunk/etc/apps/nlp-text-analytics/bin/nltk_data' - u'' ********************************************************************** There are 4 errors identical and the IP address at the start are indexers in our cluster. I have been able to successfully run the downloader and all the nltk_data libraries are installed. python -m nltk.downloader all ... View more

I'm using the Maps+ for Splunk app and have the visualisations working fine. I am trying now to use a custom overlay kml/kmz file created from within Google Earth app. From the maps+ instructions on how to do this: Overlays Add custom overlays to the map. The first release implements a KML or KMZ overlay feature. If you have existing KML/KMZ files that define features (polyline, polygons, whatever) you can now leverage them to overlay these features on the map. KML/KMZ Overlay Copy any KML or KMZ files into the following directory $SPLUNK_HOME/etc/apps/leaflet_maps_app/appserver/static/visualizations/leaflet_maps/contrib/kml Click Format and selct the Overlays tab. Enter a comma separated list of filenames that you uploaded to the above directory. File order dictates feature layering - e.g., file1.kml renders beneath file2.kml file1.kml,file2.kmz The files will be asynchronously loaded when the map is rendered. Did this and can't see the overlay in the map at all after browser refresh Anyone who has done this successfully or has some clue where to start troubleshooting your help would be greatly appreciated For completeness I also tried this location for the files apps/leaflet_maps_app/appserver/static/visualizations/maps-plus/contrib/kml ... View more