I just stumbled over the same issue. The reason why it fails is because the eval command json_extract expects a FIELD as the first argument. So when you run ...| eval extract_cities = json_extract(cities) | table extract_cities it evaluates the content of a field named "cities", which does not exist. Hence no results. Just try ...| eval extract_cities = json_extract(_raw) | table extract_cities and it will work. ... View more

Hi, I tested with another java Version, i.e. the Oracle java 8 java version "1.8.0_241" Java(TM) SE Runtime Environment (build 1.8.0_241-b07) Java HotSpot(TM) 64-Bit Server VM (build 25.241-b07, mixed mode) This now works, no more error messages, and Episodes are now grouped I guess it a problem of splunk parsing the java version string correctly hth Jan ... View more

I see similar problems: When opening an existing or adding a new Aggregation Policy, I get: Java version installed on this search head does not support Aggregation Policies, Java version 1.8 or greater is required. I can still define Aggregation policies, but notable events are not beeing grouped into episodes This is on splunk 8.0.1, ITSI 4.4.1 on a linux machine running this java version: openjdk version "11.0.6" 2020-01-14 OpenJDK Runtime Environment (build 11.0.6+10-post-Debian-1deb10u1) OpenJDK 64-Bit Server VM (build 11.0.6+10-post-Debian-1deb10u1, mixed mode, sharing) MLTK 5.0.0 is installed and python.version=python3 According to the ITSI 4.4.1docs, this should all be fine ... View more

Should this be tagged "python3"? General question would be: Will there be a python3/splunk8 compatible version of add-on builder? ... View more

I too see these messages since upgrading to ITSI 4.3 yesterday They are coming from a bunch of itsi related scripts: (numbers are counts for the last 60 minutes) /opt/splunk/etc/apps/SA-ITOA/bin/itsi_backup_restore.py 2199 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_backfill.py 295 /opt/splunk/etc/apps/SA-ITOA/bin/maintenance_minder.py 61 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_entity_exchange_consumer.py 12 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_age_kpi_alert_value_cache.py 4 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_service_template_update_scheduler.py 4 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_user_access_init.py 4 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_notable_event_archive.py 1 /opt/splunk/etc/apps/SA-ITOA/bin/itsi_scheduled_backup_caller.py 1 as far as I unserstand, they stem from python scripts that issues these warnings whenever insucure requests are beeing made (verify=false) through urllib3 (?) Probably benign because intended, still annoying. would be interesting how to get rid of them ... View more

Hi is this app still supposed to work? I got it running on my phone, it changes colors upon shaking, displays g-data and connects to the correct splunk HEC port. However, it does not seem to send any data over. I verified with wireshark, there is no token nor data exchanged with the splunk server I have tried to set [httpServer] crossOriginSharingPolicy = "*" x_frame_options_sameorigin = false in system/local/server.conf and [settings] x_frame_options_sameorigin = false in web.conf, but it does not help Any ideas what might be wrong? Thanks Jan PS: Regarding the "sameorigin" option: - I am not sure if it is necessary at all, it is not stated in the README of the app, its just a try - it does not seem to work anyhow, X-Frame-Options: SAMEORIGIN is still set in server responses ... View more