Sorry I have no current plans to upgrade this add-on ... View more

I think that you will find this blog really useful for trying to achieve what you are looking for: https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-clara-fication-transpose-xyseries-untable-and-more.html ... View more

that would work. Just bear in mind that only relying on that one field as your condition will fail if you create an alert which does not send an email ... View more

I'd take a look at your REST results and see which fields in action.* are the safest to work with for you. Unfortunately there isnt a field which states THIS IS AN ALERT. There really should be given the UI has such a clear separation between Alerts and Reports and the architecture behind the scenes stores the config in the same place... but that's another conversation for another time 😀 ... View more

Assuming you're joining on requested_conten and not requested_content something along the lines of lookup vanity.csv requested_conten OUTPUT url as requested_content if the question contains a typo then you can easily modify the lookup command to fit your needs. Check out the documentation for lookup here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/lookup  ... View more

You can break this down into 3 parts part 1 > run the inputlookup part 2 > run your search to get the values you dont already have you seem to have done this already but you just need to do it in the same search. Either a union or inputlookup > append [search] will work. Just make sure that your results contain the output from the lookup furst then you need to merge the two results together stats first("Column 2") as "Column 2"  by "Column 1". This will update the rows which do not contain a value in column 2 but will leave the current values as-is. Then you just need to run an outputlookup for the lookup file and you're done.   ... View more

I think it's likely to be due to a missing input or something. If the UI isnt particularly clear as to whats missing then I would raise a support ticket as a bug. however I would check in the search.log first to see what the error is.  ... View more

I would probably investigate what the output of that stats command is and confirm that you have still the right amount of results for the tables. It wouldnt surprise me if you lose values due to the fact that all the values are the same. Additionally, xyseries will also merge results if they are exactly the same.  ... View more

Documentation relating to the join command can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Join   for further assistance here, we really need to see a snapshot of the logs and what you're trying to do. It may be that there's also an answer within this site already so please check there 😊 ... View more

This is probably an issue with your own machine permissions, rather than a splunk issue. I would check your file permissions within your own windows OS to see what is happening  ... View more

You can edit the table in the UI editor and select the column header for some coloration options.   They are a little on the limited side but as far as I know, thats the best option there is. When you have selected a coloration, I would check the xml in the back to see whether there's further control within the table for extra params. The docs here may also be of use: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference ... View more

Take a look in the search.log (accessed via the job inspector). That error usually happens when something happens in a python scripted search command and that log usually contains the reason for failure. ... View more

Sorry I dont think there much else I would be able to assist with. I would suggest that if you need further guidance, to speak to your local account manager and support team who may be able to speak to you in further detail.  Your other option is to reach out to a partner and see what they can offer. ... View more

The ports for splunk cloud change depending on whether its a managed service or not. I would advise you check out the doc here: https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/UsetheHTTPEventCollector for more information ... View more

Are there some screenshots you could provide to show what you are trying to do? from how I understand, you are trying to change the dropdown of an input within a set of dashboards. however I would just name the dropdown as required for each dashboard. If you need the name to change, then control the value with a token, depending on how you want to show it. The splunk dashboard examples app may have some content within which should help (https://splunkbase.splunk.com/app/1603/) ... View more

I would suggest running the search in smaller batches. there are many reasons why you could have a failure however the likelihood is that the returning message is just too large to handle. If you're looking for 7 days worth of data, run 7 separate queries over a day each and then stitch the output together outside of Slpu ... View more

To my knowledge, you would have use REST and POST to the conf-inputs/[stanza] endpoint. I havent done this myself however I would imagine that the change wouldnt take effect until the next time splunk is restarted. You may get away with a restart of splunkd but I wouldnt be able to say for sure  https://docs.splunk.com/Documentation/Splunk/7.2.6/RESTREF/RESTconf#configs.2Fconf-.7Bfile.7D.2F.7Bname.7D ... View more

You should be able to use the alert_condition field for for this. Check out the link here for more info on the endpoint 🙂 ... View more

it looks like you may be trying to run before you can walk. It looks like you have setup your HEC endpoint, however the first thing I would do is look at trying to send a test message to it from the same box using a script. The error also indicates it could be to do with the content sent through. Either the message could be too large (fairly common with xml, which this looks like it is) or there's something within. if possible I would look to try and restructure the data sent through to Splunk so the message is easier to work with when inside of Splunk.  ... View more

You can merge the two regex strings together for this   rex field=msg "BAN: (?<BAN>\w+)"   - space between colon and var value rex field=msg ",ban:(?<BAN>\w+)" - prefixed comma, no space between colon and var value   can just become rex field=msg "(BAN|,ban): ?(?<BAN>'w+)"   The first part is a grouped OR statement specifying that the string must be either BAN or ,ban. The second change is the ? after space. this indicates the space is optional. Please make sure, however, that this pattern does in fact work with your data and I would advise running a test set in something like regex101 ... View more

Version 1.2 of the gitlab TA has been upgraded to get job data from GitLab ... View more

Hi @hijacob This TA will collect job status as part of the GitLab:Job sourcetype. The result is stored in the status field within the returned json message. you can always check the _internal index for MsgID="JOBLPST" to confirm that the api is being hit, providing the logging level is set to debug! It's worthwhile noting that this functionality was introduced as part of v1.2.0. If you are using an older version, please upgrade your TA. Thanks Tom ... View more

Sorry, for some reason it was taken off my answer. https://docs.splunk.com/Documentation/Splunk/latest/Viz/Chartcontrols ... View more

Take a look here. There are examples within demonstrating the behaviour I believe you are after ... View more