Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About terminaloutcome
terminaloutcome
Path Finder
Member since:
02-27-2019
02-19-2026
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 6 |
| Member Since | 2019-02-27 |
Activity Feed
- Got Karma for Re: Does Splunk support IMDSv2 EC2 instances?. 04-07-2026 08:27 PM
- Got Karma for Re: Does Splunk support IMDSv2 EC2 instances?. 04-06-2026 03:24 PM
- Got Karma for Re: Are you ready for TLS 1.3 adoption?. 11-26-2025 10:30 AM
- Posted Re: Are you ready for TLS 1.3 adoption? on Monitoring Splunk. 09-20-2025 04:39 PM
- Karma Re: Can I add python modules to the Splunk environment? for thellmann. 05-07-2025 06:24 PM
- Posted Re: ssl module is not available on Getting Data In. 08-01-2024 03:35 AM
- Posted Re: Does Splunk support IMDSv2 EC2 instances? on All Apps and Add-ons. 03-26-2024 04:09 PM
- Karma Re: "ModuleNotFoundError: No module named 'syslog'" error on running python script for richgalloway. 12-01-2022 01:38 PM
- Posted Re: "ModuleNotFoundError: No module named 'syslog'" error on running python script on Splunk Dev. 12-01-2022 01:15 PM
- Got Karma for Re: ssl module is not available. 11-10-2022 06:07 AM
- Posted Re: Best way to extract _raw to a host OS of a SH programatically on Splunk Search. 05-05-2022 04:13 PM
- Tagged Re: Best way to extract _raw to a host OS of a SH programatically on Splunk Search. 05-05-2022 04:13 PM
- Posted Re: How can I change the sort order of data in a Trellis chart? on Dashboards & Visualizations. 09-05-2021 10:21 PM
- Got Karma for Re: subsearch result as source. 08-16-2021 06:15 AM
- Posted Re: subsearch result as source on Splunk Search. 08-14-2021 06:10 AM
- Posted Re: subsearch result as source on Splunk Search. 08-14-2021 05:57 AM
- Posted Splunk App for Content Packs 1.1.0 fails to install invalid app contents on All Apps and Add-ons. 06-24-2021 05:11 PM
- Tagged Splunk App for Content Packs 1.1.0 fails to install invalid app contents on All Apps and Add-ons. 06-24-2021 05:11 PM
- Posted Re: ssl module is not available on Getting Data In. 04-02-2021 12:41 AM
- Karma Re: Installation of Splunk Dashboards App (Beta) from "Browse more apps" interface in Splunk doesn't work. for emeelan_splunk. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-20-2025
04:39 PM
1 Karma
TLS compression has provided significant benefits for clients in their link loads, so it's important that compression levels are maintained. Can you please explain this line from the "compressed" stanza from outputs.conf? (Mainly the bold part) A value of "true" means the receiver communicates with the forwarder in
compressed format for TLS/SSL forwarding if either
'useClientSSLCompression' has a value of "false" or the TLS/SSL
connection does not use 'zlib' compression. I can't find any reference to zlib compression settings, so if/when TLS1.3 comes along it'd be good to be able to understand the implications. Thanks!
... View more
08-01-2024
03:35 AM
If that's core functionality throwing that error then contact support. If it's a third-party app they shouldn't be trying to use python code that attempts to access that module, basically... there's ways to make requests to URLs without calling it directly.
... View more
03-26-2024
04:09 PM
2 Karma
For future-folk finding this thread, IMDSv2 support was added in 8.1.5, the config's under the imds stanza in server.conf. Set it like this, have an instance role for access to s3 and smartstore will Just Work™: [imds] imds_version = v2
... View more
12-01-2022
01:15 PM
At that point you're either importing modules across python versions or running a non-standard interpreter, both of which are unsupported and asking for trouble. I'd definitely recommend @richgalloway 's suggestion of having the package in the app's path.
... View more
05-05-2022
04:13 PM
I've got example code here for running searches - using the latest splunklib and JSONReader you can dump at high speed to disk. https://github.com/yaleman/splunk-sdk-games/blob/main/write_raw_json.py
... View more
- Tags:
- python
09-05-2021
10:21 PM
There's another option that works if you're looking to do some simple sorting. | makeresults
| eval name="Alice,Bob,Frank,Steve"
| makemv delim="," name
| mvexpand name
| eval fakenumber=len(name)
| eval sorted_name=if(name=="Frank"," Frank",name)
| eval sorted_name=if(sorted_name=="Steve"," Steve",sorted_name)
| stats max(fakenumber) as namelen by sorted_name It'll put the trellis in the order of Steve, Frank, Alice, Bob. There's two spaces before "Steve" and one before "Frank"
... View more
08-14-2021
06:10 AM
That's curious, I don't need the explicit "| fields source" in multiple tests on my 8.2.x environment... I know I missed the "as source" in my original response, then quickly edited it 🙂
... View more
08-14-2021
05:57 AM
1 Karma
How about this? I don't have a windows machine to try but it works on test data: index=foo [ | tstats latest(source) as source where index=foo ]
... View more
06-24-2021
05:11 PM
When trying to install this app on 8.2.0 (or 8.2.1) I get the following error: There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and DA-ITSI-CP-microsoft-exchange This happens when uploading the downloaded .spl file or installing it automatically from the integrated installer.
... View more
Labels
- Labels:
-
installation
-
troubleshooting
04-02-2021
12:41 AM
1 Karma
I'm having the same issue and not sure why, did you get to the bottom of it?
... View more
06-03-2020
12:30 AM
Same, on 8.0.1.
... View more
06-02-2020
10:03 PM
For people searching for the setting, it's hostname = <your hostname> in alert_actions.conf - https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf#GLOBAL_SETTINGS
... View more
05-14-2020
06:57 PM
What'd you end up doing to fix this? I've got the same problem and can't work it out 😞
... View more
11-04-2019
01:11 PM
Looks like you've included multiple apps in the package - this error appears when installing:
Invalid app contents: archive contains more than one immediate subdirectory: and splunk-dashboard-app
... View more
10-23-2019
04:38 AM
Instead of wasting admin's time in their dev environment, throwing a load of weird page errors and having an utterly broken interface (CSS won't load, etc) why not just state in the documentation that it requires a full license to install and use?
It's not stated anywhere that it's a requirement, and I had to dig into index=_internal log_level=ERROR source="/opt/splunk/var/log/splunk/splunk_app_cloudgateway.log" to find the issue.
2019-10-23 21:24:39,035 ERROR [subscription_clean_up_modular_input.app] [subscription_clean_up_modular_input] [do_run] [21134] Failure encountered while running Subscription Clean Up
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/subscription_clean_up_modular_input.py", line 51, in do_run
subscription_clean_up.run()
File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/subscriptions/subscription_clean_up.py", line 36, in run
users = get_all_users(self.session_key) + ['nobody']
File "/opt/splunk/etc/apps/splunk_app_cloudgateway/bin/spacebridgeapp/rest/services/splunk_service.py", line 87, in get_all_users
raiseAllErrors=True
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 533, in simpleRequest
raise splunk.LicenseRestriction
LicenseRestriction: [HTTP 402] Current license does not allow the requested action
... View more
02-27-2019
03:28 PM
1 Karma
We've run pretty high queue sizes in the order of multiple gigabytes - but if you've got regular massive queues instead of short-term spikes you're probably focusing on the wrong problem. Ensure that you've sized your servers appropriately for the load, and tune the processing path to make sure you're not unnecessarily holding up data.
... View more
02-27-2019
03:24 PM
If the queue's blocking it'll drop traffic - index=_internal Metrics blocked=true NOT StreamedSearch | table _time, host, name, max_size_kb, current_size_kb is a starter search for showing where Splunk knows it's blocking.
To monitor UDP queue headroom, I use index=_internal Metrics group=queue NOT StreamedSearch name=udp* | eval headroom=max_size_kb-current_size_kb | timechart avg(headroom) by host
... View more
02-27-2019
03:17 PM
You'll want to check the logs on dcaovsg013 because it's returning 500 errors ( actual_response_code=500 ) because of reason: non-zero pending job - there's probably some outstanding issue or load on that machine.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-19-2026
04:20 PM
|
Karma given to
