I'm following the example provided here. https://docs.splunk.com/Documentation/Splunk/9.0.2/Workloads/AdmissionRules#Example_admission_rules search_time_range=alltime AND (NOT role=sc_admin) AND (NOT app=splunk_instance_monitoring) However when I look in the monitoring console it shows that it's blocking some things that I believe are built in searches. (we use splunk cloud) Cleanup Models For Predictive Analytics itsi_content_packs_status_update Telemetry - Inputs itsi_event_grouping Telemetry - Volume All of these things have user as "nobody". I tried to add AND (NOT user=nobody) to my workload rule, but tells me. validation failed with error=invalid value of predicate 'user' ... View more

We've started using the Splunk Connect for Kubernetes. We have a heavy forwarder setup that hosts the HEC endpoint, and forwards those logs onto the indexers. We had an issue where the indexers went down, no indication that the HEC endpoint was down though. During this time our logs from these K8 clusters are missing. Other systems that use the normal universal forwarder ended up populating the logs during down time, however the logs from those clusters did not. I'm not familiar with K8 and wasn't involved in the deployment of the Splunk Connect pieces. I'm assuming that when using an HEC, if the logs don't make it into splunk, they aren't retried or cached anywhere? Or is that some sort of setting we may have missed? Thanks for looking, Jeremiah ... View more

I'm working with the rabbitMQ API and trying to make additional requests through a custom response handler. We call the API/queues API which gives us all the queues. Then in the response handler, I'm trying to parse out the queue names and make additional requests to the api/queues/%2f/queuename api which gives detailed information regarding that queue. Here's what I have in the response handler. I've removed all the other custom response handler class examples, etc... Any assistance would be greatly appreciated. #add your custom response handler class to this module import sys import json import datetime import urlparse import requests import os.path SPLUNK_HOME = os.environ.get("SPLUNK_HOME") RESPONSE_HANDLER_INSTANCE = None SPLUNK_PORT = 8089 STANZA = None SESSION_TOKEN = None REGEX_PATTERN = None #dynamically load in any eggs in /etc/apps/snmp_ta/bin EGG_DIR = SPLUNK_HOME + "/etc/apps/rest_ta/bin/" for filename in os.listdir(EGG_DIR): if filename.endswith(".egg"): sys.path.append(EGG_DIR + filename) #the default handler , does nothing , just passes the raw output directly to STDOUT class DefaultResponseHandler: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): cookies = response_object.cookies if cookies: req_args["cookies"] = cookies print_xml_stream(raw_response_output) class vueQueuesHandler: def __init__(self,**args): self.user = args['username'] self.pw = args['password'] pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): if response_type is not None and response_type=="json": output=json.loads(raw_response_output) for x in output: session = requests.session() session.auth = (self.user, self.pw) queueName = session.get('https://rabbitvts1dev.ourdomain.com/api/queues/%2f/' + x['name'], verify=False) queueJSON = json.loads(queueName.content) queueJSON['created_at'] = str(datetime.datetime.now()) print_xml_stream(json.dumps(queueJSON)) else: pass #HELPER FUNCTIONS # prints XML stream def print_xml_stream(s): print "<stream><event unbroken=\"1\"><data>%s</data><done/></event></stream>" % encodeXMLText(s) def encodeXMLText(text): text = text.replace("&", "&amp;") text = text.replace("\"", "&quot;") text = text.replace("'", "&apos;") text = text.replace("<", "<") text = text.replace(">", ">") text = text.replace("\n", "") return text ... View more