@PavelP yes ,"update any thing" - update any row or even any filed value in the file not only beginning or end of file. one more query -; is there any way we can delete previous records before re ingesting updated file?because every time when file is updated records are increasing in splunk index which is not looking the optimal solution. ... View more

@PavelP thanks for this solution , One problem with this approach is that splunk will re ingest the complete file then ingest the changed row. Is there any way to stop re-ingesting the complete file? looking for your comments on this ... View more

we are using the maps plus to visualize the location of alert happened . So in the dashboard user can select the incident id from a drop down and the relevant locations get populated on the map. The issue that I am facing is that when a new token value is selected from the drop down the new markers are getting rendered on top of previously rendered markers. so here we have two markers the previous one and the current one. It works fine if we refresh the browser window after selecting the new token value from the drop down. I don't know whether this issue is related with Splunk or maps+. Any help would be really appreciated. Splunk version:6.6.3 Maps plus version: 2.0.7 ... View more

glad to hear that it work fine 🙂 ... View more

It define the lifespan of triggered Alert basically how long you can access the result of triggered alert. Please refer this document https://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/Updatealerts for better understanding. ... View more

Hi @niketnilay , Could you please suggest me what are the changes required in sendemail.py. If we click on "Visit Dashboard" it will open dashboard, like we have "View results " in alert mail email which redirect to result of that particular alert. here "Visit Dashboard" -->http://localhost:8000/en-US/app/myApp/last1hr. I have tried this: In the message body of Alert Mail configuration I have added this Message: Dashboard :http://localhost:8000/en-US/app/myApp/last1hr <link>http://localhost:8000/en-US/app/myApp/last1hr </link> Visit Dashboard I am able to get the link and its also redirecting to desired path also but I want this link should be hidden within "Visit Dashboard" . Please help me to find the solution of this problem. ... View more

Must it be in that path? ans:Yes,I have a python file which also reading this CSV file. So its very difficult to me to change the location of CSV File. Please check this link(https://www.hurricanelabs.com/splunk-tutorials/building-a-crud-dashboard-utilizing-a-kv-store-in-splunk-part-2) as a reference for KV store lookup CRUD oprations. ... View more

Thanks @nickhillscpl for your reply,Here CSV file is not a lookup file. The CSV file is stored at C:\Program Files\Splunk\etc\apps\myApp\bin and I want to know ,if I update this file(CSV) the same needs to be reflected in KV store lookup also or If I update KV store lookup the same thing also updated in CSV file. ... View more

already assigned schedule_rtsearch but still I am not able to get real time alert. ... View more

Hi somesoni, the above search is giving an error as ->"Error in 'eval' command: The arguments to the 'case' function are invalid." ... View more

Hi gcusello , Thanks for the reply . I have configured a search in a similar manner as yours using subsearches and append but i think this search format is taking a longer time or so. due to which my searches are getting skipped and an error of "The maximum number of concurrent running jobs for this historical scheduled search on this instance has been reached", concurrency_category="historical_scheduled" is coming. how should i go with it?? ... View more

ctime isnt working ..error is->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key).". please help ... View more

can you please help me how to do it ... View more

Convert ctime is not working.Error is ->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key)." ... View more