We recently added a page to the Custom Search Commands manual on dev.splunk.com that might have some of the information you're looking for: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/nonpythonscscs ... View more

Documentation on these limitations can be found here: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud And in case you haven't done this before, the link to file a case with Splunk Support can be found here: https://splunkcommunities.force.com/customers/home/home.jsp ... View more

Actually, you'll need to file a case with Splunk Support using the Support portal. You can learn more on this page: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud ... View more

Hi @altink - I think the app you're using here is Hurricane Labs' AppInspect App for Splunk. This app is built by Hurricane Labs, not Splunk, and is also not supported by that developer per the Splunkbase listing.  However, that app leverages the Splunk AppInspect API under the hood. Can you please send your app to the AppInspect API directly so we can make sure the issue is coming from the API itself?  ... View more

We have added official documentation on this topic to dev.splunk.com: https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtoworkwithusersroles/ ... View more

Hey @helge - I spoke to the development team and a fix for this has already been merged and should be released with the next Splunk Enterprise and Splunk Cloud releases.  ... View more

Hey @arthur - unfortunately this development pattern is not permitted in Splunk Cloud (and enforced by AppInspect). ... View more

Thread necromancy I know, but this answer still pops up on the first page of Google results.  If you are trying to set the earliest/latest time in SimpleXML, you need to use either a relative time or Unix epoch time - the date format as described in the original solution does not work afaik. This is documented here: https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#search If you are trying to set earliest/latest using SPL, I think yannk's answer is still correct and the reference on this page is correct: https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Specifytimemodifiersinyoursearch#Specify_relative_time_ranges_in_your_search ... View more

This worked perfectly, thanks 🙂  ... View more

Splunk Cloud Trials, specifically, do not allow for the installation of private apps in the same way that you can on a paid Splunk Cloud deployment. Sorry about that.  If you need a more advanced Splunk Cloud deployment for evaluation, please reach out to the Splunk Sales team.  ... View more

Sorry for the thread necromancy, but we have solved issues with custom search commands hanging or crashing when sent multi-byte characters with an SDK update. This should be resolved in versions of the Splunk SDK for Python 1.6.15 and above.  ... View more

Cloud Vetting is the process of review, including manual code review, that Splunk uses to determine if a Splunk app is fit for installation on a Splunk Cloud deployment. AppInspect is a static analysis tool that we use as part of the Cloud Vetting process and is available to you, the developer, for validating apps before uploading them to Splunkbase or to your own Splunk Cloud or Splunk Enterprise deployments.  AppInspect has the ability to flag specific patterns in a Splunk app as, among other things, "success", "fail", or "manual_check". When an app is run against the "cloud" tag  in the AppInspect API, if: no checks return "fail" or "manual_check", then the app is approved for Splunk Cloud automatically any checks return "fail", then the app is rejected and cannot be installed in Splunk Cloud no checks return "fail" but any checks return "manual_check" then the app must go through the full manual Cloud Vetting process As you're building your Splunk app, I would recommend submitting the app package to the AppInspect API during development and paying close attention to any "manual_check" results. If you have questions about any results that aren't answered by the documentation, you can always reach out to us at appinspect@splunk.com  ... View more

By "above" I meant "fk319 's post" - sorry.  ... View more

In addition to the above, I would recommend updating to 1.6.14+ of the Splunk Enterprise SDK for Python, since there are specific fixes for custom search commands in that version.  ... View more

It would help to know a little more about the features used in your app, but some general advice would be:  One key thing is to ensure that any configuration file changes made in your app are done via the REST API so that they are synchronized across the cluster. For example, if your application code needs to change configurations, this should be done via the API instead of by changing local .conf files directly.  You can also use Splunk AppInspect to check for known issues in your app - there are several checks relating to clustered deployments.  ... View more

Hi @mbachhav - there is a more detailed example with some additional functionality for checking the values of different configuration stanzas available in this example app: https://github.com/splunk/splunk-app-examples/blob/master/case_studies/weather_app_example/appserver/static/javascript/views/splunk_helpers.js Because the logic in setup pages is controlled by JS, you can use that code to determine whether a configuration parameter has already been set and if so display the existing setting or a default.  ... View more

@breid1313  I would recommend referencing this example: https://github.com/splunk/splunk-app-examples/tree/master/case_studies/weather_app_example (don't forget the configuration steps specified in the root README file)  You might be hitting a promisify bug in the JS code - we've fixed that in the weather_app_example, so please refer to that until we can roll out a fix for the Developer Guidance - Setup View app.  ... View more

Interesting... this is on the read of the password in the custom search command after it has been configured? Are you running the search from the context of the weather example, or from the search and reporting app?  One additional app that might help you debug issues with secret storage is REST storage/passwords Manager for Splunk. This app is a great example of how to work with the storage/passwords endpoint and is useful for troubleshooting permissions mismatches between apps.  ... View more

Shot in the dark, but I just posted an answer over here that might be what you're looking for: https://community.splunk.com/t5/Splunk-Enterprise/Event-annotation-for-the-min-and-max-value-of-a-field/m-p/526088#M3918 Basically I'm using a secondary annotation search for my chart to pull out the max timespan value (probably a better way to do this...) and then showing an annotation for the max value on my chart with some flavor text.  ... View more