Hi Splunkers, I got the data from SC4S. However, I wound not get Splunk to recognize line breaks and timestamps correctly.Someone knows.😓 ... View more

Hi Splunker, I found the following abnormal problems when checking the Splunk system     04-07-2021 05:54:18.961 +0800 INFO PipelineComponent - CallbackRunnerThread is unusually busy, this may cause service delays: time_ms=0 new=0 null=0 total=2119 {'name':'DistributedRestCallerCallback','valid':'1','null':'0','last':'3','time_ms':'0'},{'name':'HTTPAuthManager:timeoutCallback','valid':'1','null':'0','last':'1','time_ms':'0'},{'name':'HttpInputMetrics:timerCallback','valid':'2','null':'0','last':'2113','time_ms':'0'},{'name':'IndexProcessor:ipCallback-0','valid':'1','null':'0','last':'6','time_ms':'0'},{'name':'MetricsManager:probeandreport','valid':'1','null':'0','last':'0','time_ms':'0'},{'name':'PullBasedPubSubSvr:timerCallback','valid':'1','null':'0','last':'2','time_ms':'0'},{'name':'ThreadedOutputProcessor:timerCallback','valid':'1','null':'0','last':'5','time_ms':'0'},{'name':'triggerCollection','valid':'2111','null':'0','last':'2118','time_ms':'0'} 04-07-2021 05:55:19.961 +0800 INFO PipelineComponent - CallbackRunnerThread is unusually busy, this may cause service delays: time_ms=0 new=0 null=0 total=2119 {'name':'DistributedRestCallerCallback','valid':'1','null':'0','last':'3','time_ms':'0'},{'name':'HTTPAuthManager:timeoutCallback','valid':'1','null':'0','last':'1','time_ms':'0'},{'name':'HttpInputMetrics:timerCallback','valid':'2','null':'0','last':'2113','time_ms':'0'},{'name':'IndexProcessor:ipCallback-0','valid':'1','null':'0','last':'6','time_ms':'0'},{'name':'MetricsManager:probeandreport','valid':'1','null':'0','last':'0','time_ms':'0'},{'name':'PullBasedPubSubSvr:timerCallback','valid':'1','null':'0','last':'2','time_ms':'0'},{'name':'ThreadedOutputProcessor:timerCallback','valid':'1','null':'0','last':'5','time_ms':'0'},{'name':'triggerCollection','valid':'2111','null':'0','last':'2118','time_ms':'0'}     I don't know what caused it.Which part should I start to find out the reason. ... View more

Hi Splunker, Today, I refer to this link https://wiki.splunk.com/Community:40GUIDevelopment  to develop the interface. I use the python library requests to upload the file, and use the CherryPy of Splunk to receive the file. But I can't receive and save the file. I printed the parameter content, but I didn't receive any parameter. Here is my code。   I use the python library requests to upload the file     def forwardFile(self, filePath, fileName, url): files = {'ufile': open(os.path.join(filePath, fileName), 'rb')} data = {'xxx':'aaa','xxdd':'bbb'} headers = {} headers["content-type"] = 'multipart/form-data' r = requests.post(url, files=files,data=data ,headers=headers, verify=False) logger.info(r)     use the CherryPy of Splunk to receive the file     @route('/:action=receive') @expose_page(must_login=False, methods=['GET','POST']) @cherrypy.expose def receive(self, **kwargs): logger.info("111") logger.info(kwargs) logger.info("222")     then i see the file web_service.log      2020-10-15 23:21:07,472 INFO [5f8868e36d107834250] <string>:68 - hello world:http://127.0.0.1 2020-10-15 23:21:07,501 INFO [5f8868e37f107d00ad0] <string>:145 - 111 2020-10-15 23:21:07,501 INFO [5f8868e37f107d00ad0] <string>:146 - {'action': 'receive'} 2020-10-15 23:21:07,501 INFO [5f8868e37f107d00ad0] <string>:147 - 222 2020-10-15 23:21:07,507 INFO [5f8868e36d107834250] <string>:79 - <Response [200]>     How to get the value of ufile ？ then i can save it. ... View more

Hi Splunkers, I'm on Splunk Enterprise 7.2.6. i launch a javascript SearchManager to show some data on console. Unfortunately it shows the data twice.i don't know why. i had saw the others answer https://answers.splunk.com/answers/659188/splunkjs-search-manager-collect-twice-same-event.html but it didn't work. help me ,thank you very much. setInterval(function () { var searchManagerInstance = MVC.Components.get("searchManager3"); if (searchManagerInstance != undefined && searchManagerInstance != null && searchManagerInstance != "") { searchManagerInstance.startSearch(); var searchResult = searchManagerInstance.data("results"); console.log(searchResult); /* searchResult.on("data", function() { console.log("Has data? ", searchResult.hasData()); console.log("Data (rows): ", searchResult.data().rows); console.log("Backbone collection: (rows) ", searchResult.collection().raw.rows); });*/ searchResult.on("data", function () { console.log("hello world"); }) }else{ var searchManager1 = new SearchManager( { id: "searchManager3", preview: "true", cache: "false", data : "results", search: "index=_internal (sourcetype=splunkd OR sourcetype=splunkd_access OR sourcetype=splunk_web_access OR sourcetype=splunkd_ui_access OR sourcetype=splunk_web_service) earliest=-5m@m latest=@m |stats count by sourcetype" } ); } },2000); ... View more

Hi Splunkers, I followed the example of "adaptive response action" in this website https://dev.splunk.com/view/enterprise-security/SP-CAAAFBH All i did was the same as this document described,when i filled splunk search box like : | makeresults | eval user="example@example.com"| sendalert haveibeenpwned param.parameter_field=user it displayed error words liked : Error in 'sendalert' command: Alert script returned error code 1. there were no debugging log here(i didnot know where to check the log). i had checked the code and config file very carefully.Had anyone encountered the above situation? if you had followed this example successfully (Can you provide your app?). i need you help ,tks. ... View more