Hello, I have created a custom alert action app as specified in the Splunk development documentation. I also created another more basic app to test and am still having the same issue. The issue is that the custom alert action ui params are not saving. If I manually add the action.testalert.param.subject to the entry in savedseraches.conf it will get passed to my script, but when I save the parmas from the UI they do not get back to the config file. alert_actions.conf   [testalert] is_custom = 1 label = Test Alert payload_format = json # A default param param.foo = Bar     The alert action UI   <splunk-control-group label="Subject"> <splunk-text-input name="action.testalert.param.subject" id="subject"> </splunk-text-input> </splunk-control-group>     I have tried including a savedsearches.conf.spec to define the custom param with no effect and have also attempted changing the permissions/exports in default.meta with no success. Any idea what is going on? ... View more

Hello, I am working with some apache logs that can go through one or more proxies, when a request go through a proxy a X-forwarded-for header is added. The problem is that the apache logs show the client IP as the last address the request came from. The logs do however add the X-forwarded-for entries to the end of the log entry if they exist. What I need to do is get the clientip field updated via transforms to the correct address so that the web analytics app gets the correct data. The following search shows an example of the goal. index=weblogs | rex field=other "^(?<first_forward>[0-9\.]+)" | eval clientip=coalesce(first_forward, clientip) The other field is already extracted and contains a comma separated list of the X-forwarded-for headers. I see two options on how to solve this, unless there is some magic way to do evals in transforms/props. 1) I could create a regex to extract the values in transforms, but not sure how to coalesce them in transforms/props. 2) Create a macro that does the job, but then I would need to update every search in the app and this would make updating the app lame. Any ideas? ... View more

I have an alert that triggers a script, in the script I am opening (or trying to) open the results csv via %SPLUNK_ARG_8% (This is a windows system). However this file is compressed with gz. Is there a way to configure splunk to provide the results as an uncompressed csv? ... View more

Does the rest API give access to information regarding clients talking to a deployment server like the ./splunk list deploy-clients command at the CLI can? ... View more

I am using a deployment server to push out a config to several universal forwarders (version 6.1.1) on windows, everything seems to be working fine but the whitelist part. inputs.conf: [WinEventLog:Security] disabled = 0 whitelist = 508,510,576 I have also tried the following whitelist configs: whitelist1 = 508,510,576 whitelist = 508|510|576 Nothing seems to work, I am seeing all the event IDs coming through to my indexer. ... View more

I am using a deployment server to push out an "app" that has an input.conf file and output.conf file in the local directory of the app. The app is being pushed out to the clients and the configs look fine; however the config does not seem to be applied. I have a feeling I need to restart the Splunk Forwarder service, but there must be a way to automate this. Having to restart the service on the many servers this app applies to seems silly. Any suggestions? ... View more