I know this is old, but it's the first Google result. A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).   https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions ... View more

A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).   https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions ... View more

Great solution. using null or "" instead of 0 seems to exclude the need for the last mvfilter. ... View more

This answer got me in the right direction and after struggling with it for a week, the solution for me was to never call startSearch() OR finalize(). Just calling 'settings.set("search": $searchquery) ', even with autostart set to false, would start the search. Below were my steps Create SearchManager object without 'search' set. call settings.set("search" after user clicks OK on a confirmation box search:done would trigger after this even though startSearch() and finalize() were never called. ... View more

You had the right idea to post to /acl, but you need to urlencode the parameters. The following creates a new EventType then changes the permissions afterwards. There does not appear to be a way to assign the roles with the initial create method. The "/acl" link can be derived from links in the returned Stanza object. from urllib.parse import urlencode newperms = { "perms.read": "role name 1,role name 2, role name 3", "perms.write": "role name 1, role name 2", "sharing": "app", "owner": "nobody" } newet = sdk.confs["eventtypes"].create("test_event_type",sharing="app",app="custom_app") sdk.post("%s/%s" % (newet.links["alternate"], "acl"), body=urlencode(newperms))   ... View more

It looks like |mcollect is just a custom command to create metrics.csv files. The metrics documentation on importing .csv files makes no mention of how to add a custom "host" field to your .csv file. Everytime I have used .csv for metrics the host value comes from inputs.conf. It's not elegant, but I verified a custom host can be extracted with props/transforms. Since using a new sourcetype name incurs license usage I'm betting your can have props reference a custom source instead. When Splunk writes the .csv from this |mcollect query to disk, it looks like this (I happened to have an "id" dimension in my results) |mcollect index=index_name source=source_name sourcetype=new_mcollect_stash spool=false id host ==> /var/opt/splunk/var/run/splunk/c247f3132f17807a_metrics.csv <== metric_timestamp,id,host,"metric_name:variable1","metric_name:variable2","metric_name:variable3","metric_name:variable4","metric_name:variable5","metric_name:variable6" 1583647501,71614,my_server_hostname,0,37.0842,0,-1,-1,-1 I copied the default "mcollect_stash" sourcetype to a new one for testing. The transforms extracts the 3rd column as the hostname. [new_mcollect_stash] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = csv ADD_EXTRA_TIME_FIELDS = False KV_MODE = none TRANSFORMS-newmetrichost = newmetrichost TIMESTAMP_FIELDS = metric_timestamp TIME_FORMAT = %s.%Q [newmetrichost] DEST_KEY = MetaData:Host REGEX = ^[^,]+,[^,]+,([^,]+) FORMAT = host::$1 ... View more

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html "Issues a DELETE request against the service using a given path" I use the equivalent in Python as this sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid)) Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you. ... View more

I got around the error for no results by adding the following immediately before the map command |append [|makeresults |eval ] e.g. |append [|makeresutls |eval emailToHeader=""] I also added "graceful=true" to the sendemail command to ignore errors about trying to send an email with no "to" ... View more

The parent workaround did not work for me, but I was able to load a job using REST -> Map command. | rest /services/search/jobs |where label="__SAVEDSEARCHTITLE__" |sort - updated |fields sid |head 1 |map search="loadjob $sid$" ... View more

That fix is extremely inefficient for large sites. The 7.0 call to data/indexes appears to specify "splunk_server=local". Adding the stanza Support provided with a |rest call without the "local" works quickly. <key name="keyName">entry.properties.get('index', 'index key not found')</key> <key name="keyValue">entry.properties.get('index', 'index key not found')</key> <key name="splunkSource">/search/jobs/oneshot</key> <key name="splunkSourceParams" type="dict"> <key name="output_mode">"atom"</key> <key name="count">"1000"</key> <key name="search">"|rest /services/data/indexes |stats values(title) as index |mvexpand index"</key> </key> ... View more

To add some detail to this, I had this error until I set all traffic destined to 127.0.0.1 to skip MASQUERADE. The new iptables rule immediately fixed the error, no service restart required. iptables -I POSTROUTING 1 -t nat -d 127.0.0.1 -j ACCEPT Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 10 600 ACCEPT all -- * * 0.0.0.0/0 127.0.0.1 5710K 580M MASQUERADE all -- * * 0.0.0.0/0 0.0.0.0/0 ... View more