Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About damiko
damiko
Communicator
Member since:
02-26-2019
09-08-2021
Community Statistics
| Posts | 49 |
| Solutions | 0 |
| Karma Given | 27 |
| Karma Received | 4 |
| Member Since | 02-26-2019 |
Activity Feed
- Posted Splunk App for Infrastructure doesn't detect entities on All Apps and Add-ons. 09-23-2020 11:53 PM
- Tagged Splunk App for Infrastructure doesn't detect entities on All Apps and Add-ons. 09-23-2020 11:53 PM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Running php script in alert with adding results as arguments for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: Index buckets configuration using time for woodcock. 06-05-2020 12:50 AM
- Karma Re: Index buckets configuration using time for adonio. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 |
09-23-2020
11:53 PM
Hi hi ninjas! My windows hosts don't appear as Entities in Investigation dashboard. I'm getting events and metrics from those hosts, but app doesn't recognize them. What I've done so far: 1. Installed SAI app and addon 2. Followed the easy installation guide in Add data settings and got the command to run on the hosts 3. Run the command in powershell, it has installed UF with pre-configured inputs.conf. little preview of it: # *** Configure Metrics & Logs collected ***
[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 60
object = Processor
mode = single
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
index = em_metrics
_meta = os::"Microsoft Windows Server 2012 R2 Standard" os_version::6.3.9600 ip::"192.168.10.225" entity_type::Windows_Host 4. Splunk instance is receiving metrics and events(app, sec and system) from the host, but host is not recognized in SAI. It still shows that I have 0 entities. Btw: I've single instance deployment of Splunk.
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
03-05-2020
02:28 AM
I forgot to mention. My panels have Cyrillic fonts. Therefore when I'm using Smart Export out-of-the-box, without any changes, it has problem with extracting text.
... View more
03-05-2020
01:14 AM
Hi Ninjas! Do you know how to change text size in export > pdf? I have a dashboard with 4 panels, 2 of them are choropleth maps with legends (Regions on the map). When I export dashboard, text size in those panels is huge, it's covering the whole map. Therefore I wanted to know, if it's possible to change the size of the text.
... View more
Labels
- Labels:
-
PDF
02-25-2020
10:15 PM
No worries, I forgot to add params in alert_action.conf. It's working now
... View more
02-25-2020
05:23 AM
It's in my search query. I've added them in |table command. Mb I need to add them in alert_action.conf? result.description and etc
... View more
02-24-2020
09:38 PM
Hey, @manjunathmeti ! I've got a problem, can't add new fields to script. Below is changes I made in your code and Errors I'm getting in _internal
for row in rows:
inputs = "'%s | %s | %s | %s | %s | %s | %s'" % (trigger_date, row['status'], row['uri_path'], row['_raw'], row['description'], row['ftime'], row['service'])
command = "%s %s %s" % ("/usr/bin/php", "/opt/splunk/etc/apps/alert_action_php/bin/my_script.php", inputs)
... View more
02-24-2020
04:01 AM
Nevermind, I've deleted spaces on each row. Now it's WORKING! Great! Thank you @manjunathmeti
What changes I could make in your python code to add more fields?
... View more
02-24-2020
02:27 AM
changed code in my_script.py. However still blank fields.
from _internal: 02-24-2020 16:23:30.752 +0600 INFO sendmodalert - action=my_script - Alert action script completed in duration=7905 ms with exit code=0
... View more
02-24-2020
01:34 AM
Yeah this works when I'm running it from cmd line.
Any method to troubleshoot my alert?
... View more
02-24-2020
12:15 AM
Yes it does. My search initially had this query with | table status, uri_path, _raw
Please check below
P.S.
Still getting only trigger_date
... View more
02-23-2020
10:40 PM
Ok, they gave me an access to their portal.
It's receiving data!, but only trigger_date.
... View more
02-23-2020
10:15 PM
Not working they say, well I get the message in the search
02-24-2020 12:11:10.666 +0600 INFO sendmodalert - Invoking modular alert action=Splunk_integration for search="Damir_php_test" sid="scheduler_admin_YWxlcnRfYWN0aW9uX3BocA_RMD5f6cda7d30fd7e0b1_at_1582524660_62268" in app="alert_action_php" owner="admin" type="saved"
Which means that alert executed correctly, right?
What might be the issue then?
... View more
02-23-2020
08:44 PM
Hello manjunathmeti! I've created a python script with your code. Updated alert_actions.conf as you said but now I'm getting this Warn below. I guess it can't find a script to execute. May be I forgot to add a line in alert_action.conf?
02-24-2020 10:37:06.409 +0600 WARN sendmodalert - action=Splunk_integration - Unable to find alert action script for action="Splunk_integration" in app="alert_action_php"
Below is my_script.py and alert_action.conf
... View more
02-22-2020
12:30 AM
Thank you manjunathmeti. The environment where I was testing it is blocked on weekend, I'll try your python method on Monday. Have a good weekend 🙂
... View more
02-20-2020
08:34 PM
Thanks, script is working, but data being send is incorrect. Instead of sending Token values it sends Token text string.
3rd party is receiving it as text: $trigger_date$ $result.field1$ $result.field2$ $result._raw$.
Please see pic below and don't get your attention on 2 trigger.dates, it's my mistake 🙂
... View more
02-20-2020
04:29 AM
Cool, I've got events which show success results. Now I'm waiting for a response from Devs.
... View more
02-20-2020
04:07 AM
/opt/splunk/etc/apps/alert_action/bin/my_script.php - my script path looks like this.
Script is executable. I've added to metadata. Still the same Error.
... View more
02-20-2020
03:24 AM
Tried with adding full path to alert.execute.cmd = /opt/splunk/etc/apps/myapp/bin/script.php
And just adding as you said alert.execute.cmd = php
No use, same Errors
pls check the pic
... View more
02-20-2020
02:48 AM
Here is the result. Same error every alert
02-20-2020 16:38:04.787 +0600 ERROR sendmodalert - action=Splunk_integration - Failed to find alert.execute.cmd "/path/to/php".
... View more
02-20-2020
02:00 AM
Did everything step by step as in your instruction, people on the other side (3rd party app), who are waiting for script results, said it didn't trigger.
For clarification: script is not mine, but I have to run it with arguments. It works when I run it from Command line like this: php my_script.php "test1 | test2 | test3 | test4"
... View more
02-20-2020
01:04 AM
Hey, thank you. I didn't finish setting yet, wanted to ask you: Where do I put savedsearches.conf?
Or should I change current savedsearches.conf?
... View more
02-19-2020
08:46 PM
Hello Ninjas!
I need help with setting an alert which triggers a php script with results. This script should pass the results to 3rd party system.
For example: script.php "date | field1 | field 2 | _raw "
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-08-2021
11:02 AM
|
Karma given to
| User | Karma Count |
|---|---|
| 16 | |
| 1 | |
| 2 | |
| 1 | |
| 1 |
