Apps can be archived due to inactivity or per developer request. Since the last update of that app was 5 years ago, I'm assuming it was the former.  Note that most of the suggestions in this (16-year-old) topic are considered dangerous in modern Splunk Enterprise and Splunk Cloud. The supported solution is to bundle your app's dependencies in the /bin directory of your app. Do not modify the version of Python shipped with Splunk; do not do on-stack compilation of assets your app needs; do not attempt to establish virtualization environments; etc.  ... View more

Two small points:  1. I would avoid the usage of the /lib directory in app code. It was intended to work around an issue that no longer exists (outside of persistent custom REST endpoints) and causes additional issues for extension points that distribute resources to search peers (i.e. certain types of custom search commands and external lookups) - you will need to update .conf files to make sure that the /lib directory is distributed correctly. There are no advantages to using /lib over /bin and /bin is automatically distributed to search peers as required.  2. Similarly, the guidance to do import manipulation using sys.path.insert is also outdated, as it does not prevent import collisions within the context of persistent custom REST endpoints).    e: In the context of a scripted input it shouldn't matter either way. I just want to make sure it's understood where the /lib guidance came from and why it is out of date today.  I'm working to get the old guidance removed from dev.splunk.com and examples on github - appreciate your patience in the meantime.  ... View more

We've added documentation to dev.splunk.com to cover Custom REST Endpoints.   (apologies for thread necromancy but this is still one of the top hits on gsearch for this topic somehow, 14 years later)  ... View more

This is now documented on dev.splunk.com: https://dev.splunk.com/enterprise/reference/modinputs/modinputsmanagerxml/ (sorry for the thread necromancy but I like to leave notes for others who stumble across the same questions) ... View more

Right, I have to say I agree with you there and would recommend voting on these Ideas in order to raise awareness of the limitation.  e: to expand on that - the issue with even the solution I mentioned is that you would need to retroactively apply the *.meta access control approach to each existing and future secret on your deployment in order to actually address the use case  in the OP.  ... View more

I'm not sure you'd be able to prevent the user from having the ability to view the secret at *all*, but you can get more granular than just all-or-nothing with `list_storage_passwords`. I just answered a similar question here with some details that might help you out: https://community.splunk.com/t5/Splunk-Dev/What-are-secret-storage-permissions-requirements/m-p/670685/highlight/true#M11281 ... View more

Hey @lremember - you'll need to reach out to splunkbase-admin@splunk.com for help with ownership transfers for Splunkbase listings.  ... View more

My understanding is that credentials created by POST request to the `storage/passwords` endpoint end up encrypted in `passwords.conf`, where they are treated like any other knowledge object. By default they will be accessible to any user with the `admin_all_objects` or `list_storage_passwords` capabilities, but you should be able to perform more granular access control via `metadata/local.meta` like with any other knowledge object in Splunk. This would allow admins to lock down access to specific credentials with more specificity (or, if you're building this app yourself, you could use the app's setup page where configuration is performed to complete this additional step).  I believe that this app includes functionality for managing permissions on existing secrets as described above: REST storage/passwords Manager for Splunk ... View more

Hi @cplunk - the support email address for Splunkbase-related enquiries is: splunkbase-admin@splunk.com  The display name for your app is tied to whichever Splunk.com user account is the "owner" of the app listing.  I think your options for changing this are either:  create a new Splunk.com account to own your app listing and ask splunkbase-admin@splunk.com to transfer ownership update the information on your Splunk.com account (which might require contacting Splunk Support?)  ... View more

Hi @nithesh - since your original post, we've released updates to the Splunk AppInspect API that refined the behavior of this check. If you are still having issues, please reach out to appinspect@splunk.com and we'll help investigate.  ... View more

You may find our documentation on custom search commands helpful: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/ This topic includes some useful information on building different types of custom search commands as well as links to examples. ... View more

We recently added a page to the Custom Search Commands manual on dev.splunk.com that might have some of the information you're looking for: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/nonpythonscscs ... View more

Documentation on these limitations can be found here: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud And in case you haven't done this before, the link to file a case with Splunk Support can be found here: https://splunkcommunities.force.com/customers/home/home.jsp ... View more

Actually, you'll need to file a case with Splunk Support using the Support portal. You can learn more on this page: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud ... View more

Hi @altink - I think the app you're using here is Hurricane Labs' AppInspect App for Splunk. This app is built by Hurricane Labs, not Splunk, and is also not supported by that developer per the Splunkbase listing.  However, that app leverages the Splunk AppInspect API under the hood. Can you please send your app to the AppInspect API directly so we can make sure the issue is coming from the API itself?  ... View more

We have added official documentation on this topic to dev.splunk.com: https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtoworkwithusersroles/ ... View more

Hey @helge - I spoke to the development team and a fix for this has already been merged and should be released with the next Splunk Enterprise and Splunk Cloud releases.  ... View more

Hey @arthur - unfortunately this development pattern is not permitted in Splunk Cloud (and enforced by AppInspect). ... View more

Thread necromancy I know, but this answer still pops up on the first page of Google results.  If you are trying to set the earliest/latest time in SimpleXML, you need to use either a relative time or Unix epoch time - the date format as described in the original solution does not work afaik. This is documented here: https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#search If you are trying to set earliest/latest using SPL, I think yannk's answer is still correct and the reference on this page is correct: https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Specifytimemodifiersinyoursearch#Specify_relative_time_ranges_in_your_search ... View more

This worked perfectly, thanks 🙂  ... View more

Splunk Cloud Trials, specifically, do not allow for the installation of private apps in the same way that you can on a paid Splunk Cloud deployment. Sorry about that.  If you need a more advanced Splunk Cloud deployment for evaluation, please reach out to the Splunk Sales team.  ... View more

Sorry for the thread necromancy, but we have solved issues with custom search commands hanging or crashing when sent multi-byte characters with an SDK update. This should be resolved in versions of the Splunk SDK for Python 1.6.15 and above.  ... View more

Cloud Vetting is the process of review, including manual code review, that Splunk uses to determine if a Splunk app is fit for installation on a Splunk Cloud deployment. AppInspect is a static analysis tool that we use as part of the Cloud Vetting process and is available to you, the developer, for validating apps before uploading them to Splunkbase or to your own Splunk Cloud or Splunk Enterprise deployments.  AppInspect has the ability to flag specific patterns in a Splunk app as, among other things, "success", "fail", or "manual_check". When an app is run against the "cloud" tag  in the AppInspect API, if: no checks return "fail" or "manual_check", then the app is approved for Splunk Cloud automatically any checks return "fail", then the app is rejected and cannot be installed in Splunk Cloud no checks return "fail" but any checks return "manual_check" then the app must go through the full manual Cloud Vetting process As you're building your Splunk app, I would recommend submitting the app package to the AppInspect API during development and paying close attention to any "manual_check" results. If you have questions about any results that aren't answered by the documentation, you can always reach out to us at appinspect@splunk.com  ... View more

By "above" I meant "fk319 's post" - sorry.  ... View more

In addition to the above, I would recommend updating to 1.6.14+ of the Splunk Enterprise SDK for Python, since there are specific fixes for custom search commands in that version.  ... View more