Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About pmeyerson
pmeyerson
Path Finder
Member since:
08-29-2013
05-02-2024
Community Statistics
| Posts | 50 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 5 |
| Member Since | 08-29-2013 |
Activity Feed
- Posted Re: How to read stanza from local app.conf pragmatically in a modular input python? on Splunk Dev. 05-02-2024 11:51 AM
- Karma Re: How to get encrypted password fields during modular input parameters validation? for gjanders. 12-23-2020 06:27 AM
- Posted trying to add export/inspect/open in search options, resultsLinkView on Splunk Dev. 12-22-2020 08:54 PM
- Posted Re: Issue while using multiple dropdown option in Splunk Add on builder using REST API option. on All Apps and Add-ons. 08-13-2020 09:06 PM
- Posted Re: REST Response Handler in Addon Builder. on All Apps and Add-ons. 07-30-2020 06:56 PM
- Posted Re: How to get encrypted password fields during modular input parameters validation? on All Apps and Add-ons. 07-30-2020 06:51 PM
- Got Karma for Re: time-based lookups and kvstore. 06-19-2020 11:41 AM
- Karma Re: calendar heatmap viz force value=0 different color? for niketn. 06-05-2020 12:49 AM
- Got Karma for Re: Trying to get SNMP data into Splunk.... 06-05-2020 12:48 AM
- Got Karma for Re: Trying to get SNMP data into Splunk.... 06-05-2020 12:48 AM
- Got Karma for Re: Trying to get SNMP data into Splunk.... 06-05-2020 12:48 AM
- Karma Re: time-based lookups and kvstore for skalliger. 06-05-2020 12:47 AM
- Karma Ever wonder which dashboards are being used and what users are using them? for MattZerfas. 06-05-2020 12:47 AM
- Karma Re: Ever wonder which dashboards are being used and what users are using them? for MattZerfas. 06-05-2020 12:47 AM
- Got Karma for Re: SMI error converting MIB to Python egg. 06-05-2020 12:46 AM
- Karma Re: What about LDAP in an HA setup? for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: using UTF-8 files for CSV lookup for jkat54. 06-05-2020 12:45 AM
- Karma Example Of Chart Overlay ? for john_loch. 06-05-2020 12:45 AM
- Posted Re: time-based lookups and kvstore on Splunk Search. 02-10-2020 01:22 PM
- Posted custom generating command 'Command xxx appears to be statically configured for search command protocol version 1' on Splunk Search. 09-21-2019 05:26 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-02-2024
11:51 AM
Your custom modular input script class should inherit from splunklib.modularinput But you cannot access the service object in __init__, only in stream_events() onwards as thats when your code receives the payload from Splunk to construct the Service object. You can use service object at the beginning of your stream_events(inputs, ew): stanza = self.service.confs["app"] https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtocreatemodpy/ https://docs.splunk.com/DocumentationStatic/PythonSDK/2.0.1/modularinput.html#splunklib.modularinput.Script
... View more
12-22-2020
08:54 PM
I have a dashboard using a custom splunk web framework view which displays some stuff and a tableview of search results. This works great. I am trying to add the "ResultsLinkView" so that users can export these search results and am running into issues. The docs reference a "controlpanel" element the ResultsLinkView should be tied to, but I'm not sure how to translate that reference into what I have to work with in my code. I dont understand how to tie together the ResultsLinkView to a TableView... or is this the wrong approach? With the below, I see the table view results, and the links for the ResultsLinkView are present but disabled, even if I mouse over. <form script="test.js">
<label>Report</label>
<row>
<panel>
<html>
<h3>TEST</h3>
<div id="dummy_table"></div>
<div id="dummy_resultslink"></div>
</html>
</panel>
</row>
</form> require([
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/resultslinkview",
"splunkjs/mvc/simplexml/ready!"
], function(
$,
mvc,
SearchManager,
TableView,
ResultsLinkView
) {
var dummysearch = new SearchManager({
id: "dummysearch",
search: mvc.tokenSafe('|makeresults |eval stuff="dummy"'),
autostart: "false",
preview: false,
cache: true
});
tvdummy= new TableView({
id: "dummytable",
el: $("#dummy_table"),
managerid: "dummysearch"
}).render();
var resultsLink = new ResultsLinkView({
id: "resultsLink",
managerid: "dummytable",
el: $("#dummy_resultslink")
});
resultsLink.render().$el.appendTo($("dummy_resultslink"));
}); if i change var resultsLink = new ResultsLinkView({
...
el: $("#dummy_table")
});
resultsLink.render().$el.appendTo($("dummy_table"));
}); then I don't see any search results. Appreciate any suggestions, TIA
... View more
Labels
- Labels:
-
Splunk Web Framework
-
SplunkJS
08-13-2020
09:06 PM
Hi raunaka1, I think you can do this to see how the data is being passed to your add on code: 1: set app log level in app setup, say debug. in the validate_input(), add at the top: loglevel=helper.get_log_level() helper.set_log_level(loglevel) helper.log_debug("input received={}".format(str(definition.parameters))) # set log level as you wish definition.parameters should be a dict with all your parameters, so you should see what is getting passed in. If its a param you added manually after exporting from AOB, you'll need to add it in a bunch of places within your project code.
... View more
07-30-2020
06:56 PM
You can bring all the data in, and | dedup your search in Splunk, or use some custom python code with Add-On Builder... its not "out of the box" per se, but add-on builder would allow you to setup that customization yourself.
... View more
07-30-2020
06:51 PM
From what I understand, if you just mark it as a password type input, it does not actually store the input encrypted in passwords.conf, just masks it on the screen. What worked for me is setting up a global account (checkbox in add-on builder), this gives us a way to enter a username and password, which are then encrypted in passwords.conf. To retreive, use helper.get_arg("credential_name"), where credential_name is what you call the input where the user selects which credential to use. HTH
... View more
02-10-2020
01:22 PM
1 Karma
Thank you @skalliger!!
I also dropped some feedback on https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Defineatime-basedlookupinSplunkWeb so hopefully that will help as well.
... View more
09-21-2019
05:26 PM
I am attempting to use custom generating command protocol version 2, but my command seems to be detected as version 1 still.
commands.conf:
[datascrape] filename = xxx.py
chunked = true
xxx.py:
@Configuration(type='events') class
xxxCommand(GeneratingCommand):
...
def generate(self):
... yield xxx
... self.finish()
...
@staticmethod
def foo():
Even if I replace the commands.conf config with the specified version 1 arguments, I still get the error message, even after splunk restarts.
Thanks for any pointers
... View more
09-29-2018
04:53 PM
Do you have any idea on which (if any) subscriptions this feature is included in? I'm having a tough time understanding how all the different o365+azure -> splunk options are priced from the msft side.
Wasn't sure if you uncovered anything while looking into this option.
... View more
04-30-2018
11:06 AM
Right thanks, I did make sure to copy all of the files under /bin and subdirectories as well. Is calling the python file matching the input name field in AOB a correct way to invoke?
... View more
04-29-2018
07:34 PM
Or should this work pretty effortlessly?
Guess I could install splunk on my dev too!
... View more
04-29-2018
07:33 PM
Is there a way to invoke the collect_events() method in an add on that is using the add-on-builder template and has been copied to a remote dev workstation?
I installed the splunk-sdk using pip, updated my service.connect() to specifiy the remote host, and set the log context to log to my local directory instead of /opt/splunk/var/log which does not exist.
I try to run the main python file that matches the input name (without the input_module in the name), but it seems to just hang and not log anything. The input_module_*.py seems to exit immediately. Any suggestions would be great.
... View more
04-29-2018
06:56 PM
If above doesn't work, I exported by add-on from the builder then created a new add-on builder project and copied all my files back in.
... View more
04-24-2018
08:16 AM
on review this was the step that seemed to fix the issue, I think I didn't realize I was having more disk space issues.
... View more
04-22-2018
07:35 PM
I think you are asking for this:
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_id.7D.2Fsummary
see: search/jobs/{search_id}/search.log
... View more
04-22-2018
01:43 PM
I am writing an app with the add-on-builder and started getting error below.
It seems related to https://answers.splunk.com/answers/636852/why-is-the-gui-not-loading-and-throwing-this-error.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev ?
Anyway to regenerate or fix the spec files mentioned in the linked post? I think the last changes I made were changing from a lookup csv to a kvstore.
TIA
04-22-2018 16:26:30.833 -0400 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n
File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 130, in init\n
hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 594, in execute\n
if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n
File "/opt/splunk/etc/apps/TA-amp-inventory/bin/ta_amp_inventory/splunk_aoblib/rest_migration.py", line 38, in handleList\n
AdminExternalHandler.handleList(self, confInfo)\n
File "/opt/splunk/etc/apps/TA-amp-inventory/bin/ta_amp_inventory/splunktaucclib/rest_handler/admin_external.py", line 40, in wrapper\n
for entity in result:\n
File "/opt/splunk/etc/apps/TA-amp-inventory/bin/ta_amp_inventory/splunktaucclib/rest_handler/handler.py", line 118, in wrapper\n
raise RestError(exc.status, exc.message)\nRestError: REST Error [404]: Not Found -- HTTP 404 Not Found -- {"messages":[{"type":"ERROR","text":"Not Found"}]}\n
... View more
04-22-2018
01:35 PM
Can you clarify "stop the instance"? You mean the "is enabled?" checkbox in the app setup?
I actually got a save failed error, I'll try to re-install the app this week.
Encountered the following error while trying to update: Splunkd daemon is not responding: (u"Error connecting to /servicesNS/nobody/TA-eStreamer/apps/local/TA-eStreamer/setup: ('The read operation timed out',)",)
... View more
04-12-2018
05:45 PM
Hi - I have a button click action in a 3rd party system to launch a new browser window to my splunk instance. I can tweak the search. If I created a tokenized dashboard, is it possible to drive the tokens from the URL into the dashboard somehow?
To clarify, I am not trying to pull the dash results into the 3rd party app - the app is launching a window and I am seeing the dashboard in splunk directly, with details provided by the third party.
Thanks for any pointers!
... View more
04-09-2018
08:47 AM
Oh, thats very helpful to know, thanks. Yeah this is my test splunk server and I blew the disk space at one point, I'll give that a try.
... View more
03-27-2018
08:22 AM
I received input on the encore dashboard for a day and then it stopped processing. I see this frequently in the estreamer.log file:
2018-03-27 11:16:35,058 estreamer.client INFO Process handler state is Error.
2018-03-27 11:16:35,058 estreamer.monitor INFO Running. 0 subscribed; 0 handled;
2018-03-27 11:16:35,501 estreamer.client INFO Stopping...
2018-03-27 11:16:36,145 estreamer.subscriber INFO Stop message received
2018-03-27 11:16:36,146 estreamer.subscriber INFO Waiting for messageQueue to clear...
2018-03-27 11:16:36,146 estreamer.subscriber INFO Exiting
2018-03-27 11:16:36,146 estreamer.client INFO Process 19018 (subscriber) exit code: 0
2018-03-27 11:16:36,146 estreamer.handler INFO Stop message received
2018-03-27 11:16:36,146 estreamer.handler INFO Exiting
2018-03-27 11:16:36,147 estreamer.client INFO Process 19017 (handler) exit code: 0
2018-03-27 11:16:36,147 estreamer.monitor INFO Stopping Monitor.
2018-03-27 11:16:36,308 estreamer.client INFO Goodbye
2018-03-27 11:16:37,863 estreamer.client INFO eNcore version: 3.0.0
2018-03-27 11:16:37,864 estreamer.client INFO Python version: 2.7.13 (default, Apr 16 2017, 01:25:17) \n[GCC 5.3.0]
2018-03-27 11:16:37,864 estreamer.client INFO Platform version: Linux-4.4.0-116-generic-x86_64-with-debian-stretch-sid
2018-03-27 11:16:37,864 estreamer.client INFO Starting client (pid=25163).
2018-03-27 11:16:37,864 estreamer.client INFO Sha256: xxxxx
2018-03-27 11:16:37,865 Diagnostics INFO Check certificate
2018-03-27 11:16:37,865 Diagnostics INFO Creating connection
2018-03-27 11:16:37,865 estreamer.connection INFO Connecting to xxxxx:8302
2018-03-27 11:16:37,865 estreamer.connection INFO Using TLS v1.2
2018-03-27 11:16:38,108 Diagnostics INFO Creating request message
2018-03-27 11:16:38,108 Diagnostics INFO Request message=zzzzz
2018-03-27 11:16:38,109 Diagnostics INFO Sending request message
2018-03-27 11:16:38,109 Diagnostics INFO Receiving response message
2018-03-27 11:16:38,130 Diagnostics INFO Response message=zzzzzz
2018-03-27 11:16:38,131 Diagnostics INFO Streaming info response
2018-03-27 11:16:38,131 Diagnostics INFO Connection successful
2018-03-27 11:16:38,132 estreamer.monitor INFO Starting Monitor.
2018-03-27 11:16:38,132 estreamer.metadata.cache INFO Loading cache from /opt/splunk/etc/apps/TA-eStreamer/bin/encore/xxxxx-8302_cache.dat
2018-03-27 11:16:38,133 estreamer.subscriber INFO Starting Subscriber.
2018-03-27 11:16:38,133 estreamer.connection INFO Connecting to xxxxx:8302
2018-03-27 11:16:38,134 estreamer.connection INFO Using TLS v1.2
2018-03-27 11:16:38,135 estreamer.monitor INFO Starting. 0 subscribed; 0 handled;
2018-03-27 11:16:38,417 estreamer.handler ERROR ValueError: insecure string pickle\nTraceback (most recent call last):\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/handler.py", line 116, in start\n self.output = estreamer.outputters.Manager( outputters, self.settings )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/outputters/manager.py", line 36, in init\n self.cache.load()\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/metadata/cache.py", line 532, in load\n data = cPickle.load( cacheFile )\nValueError: insecure string pickle\n
2018-03-27 11:16:38,418 estreamer.handler INFO Error state. Clearing queue
2018-03-27 11:16:38,619 estreamer.bookmark INFO Opening bookmark file /opt/splunk/etc/apps/TA-eStreamer/bin/encore/xxxxx-8302_bookmark.dat.
2018-03-27 11:16:38,620 estreamer.settings.settings INFO Timestamp: Start = 2 (Bookmark = 1521499872)
2018-03-27 11:16:38,623 estreamer.subscriber INFO EventStreamRequestMessage: 00010002000000085ab03ee048900061
2018-03-27 11:16:38,623 estreamer.bookmark INFO Opening bookmark file /opt/splunk/etc/apps/TA-eStreamer/bin/encore/xxxxx-8302_bookmark.dat.
2018-03-27 11:16:38,623 estreamer.settings.settings INFO Timestamp: Start = 2 (Bookmark = 1521499872)
2018-03-27 11:16:38,623 estreamer.subscriber INFO StreamingRequestMessage: zzzzz
Looking for some troubleshooting assistance.
... View more
02-16-2018
07:11 PM
EDIT: check the Splidgets apps on splunkbase too! https://splunkbase.splunk.com/app/3648/
https://splunkbase.splunk.com/app/3647/ May give some hints if it doesn't solve your problem.
Also saw this blogpost on using dashboards to update a kvstore: https://www.hurricanelabs.com/splunk-tutorials/building-a-crud-dashboard-utilizing-a-kv-store-in-splunk-part-1
Just saw this, someone wrote a way to connect to splunk using the SDK, from within a jupyter notebook. Maybe this is what you're looking for. https://github.com/dformoso/splunk-jupyter
... View more
01-04-2018
02:00 PM
Is there a way to force one of the color bins to be for 0 value? Or some other splunk ninja magic to gray out those days on the calendar heatmap? The data has high spikes and many 0s. | timechart span=1d limit=0 count by status. I have some days with low values that get colored the same as 0. Splunk 6.6.2. Thanks for any suggestions.
... View more
12-21-2017
06:30 AM
thanks, I misread the input page and didn't understand that, thanks!
... View more
12-20-2017
02:24 PM
I am trying out the rest_ta and having an issue trying to use a GET request with a multi-value argument.
The argument I want to pass is, "return_fields=comment,network"
I tried escaping with " or ', and also tried passing return_fields twice, one for each argument value. The first value was then dropped.
If I try to use "return_fields=comment,network" as either an url argument or http header property, I get the below error:
12-20-2017 17:17:12.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" http_header_propertys = dict((k.strip(), v.strip()) for k,v in
12-20-2017 17:17:12.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" ValueError: need more than 1 value to unpack
Can anyone point me in the right direction here? Is there some different escape format or do I need to head down a different direction? Appreciate any suggestions - just getting started with rest calls.
... View more
11-06-2017
11:56 AM
Wow, i tried generating the default flow with this generator tool and that is not being picked up either. I tried running the configuration script again but that didnt help... guess i need to move to the app with the purchase required or the stream app support mentioned. Appreciate all your suggestions.
... View more
11-06-2017
06:40 AM
Thats a great suggestion, thanks very much.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-02-2024
03:11 PM
|
