Great solution. using null or "" instead of 0 seems to exclude the need for the last mvfilter. ... View more

Hi @woodcock. This is very helpful, and somewhat of a game changer in sending dynamic alerts from Splunk. Thank you! I did have a quick question about outputcsv. From what I've read, outputlookup writes to a lookup file that replicates across a search head cluster, while outputcsv just writes a CSV in the current search head's var/run directory. I'm looking to have this result dataset NOT be persistent. Do you have any recommendations about creating a result dataset for the map command that will age out after the search is run, or some configurable time after? ... View more

This answer got me in the right direction and after struggling with it for a week, the solution for me was to never call startSearch() OR finalize(). Just calling 'settings.set("search": $searchquery) ', even with autostart set to false, would start the search. Below were my steps Create SearchManager object without 'search' set. call settings.set("search" after user clicks OK on a confirmation box search:done would trigger after this even though startSearch() and finalize() were never called. ... View more

You had the right idea to post to /acl, but you need to urlencode the parameters. The following creates a new EventType then changes the permissions afterwards. There does not appear to be a way to assign the roles with the initial create method. The "/acl" link can be derived from links in the returned Stanza object. from urllib.parse import urlencode newperms = { "perms.read": "role name 1,role name 2, role name 3", "perms.write": "role name 1, role name 2", "sharing": "app", "owner": "nobody" } newet = sdk.confs["eventtypes"].create("test_event_type",sharing="app",app="custom_app") sdk.post("%s/%s" % (newet.links["alternate"], "acl"), body=urlencode(newperms))   ... View more

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html "Issues a DELETE request against the service using a given path" I use the equivalent in Python as this sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid)) Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you. ... View more

It looks like |mcollect is just a custom command to create metrics.csv files. The metrics documentation on importing .csv files makes no mention of how to add a custom "host" field to your .csv file. Everytime I have used .csv for metrics the host value comes from inputs.conf. It's not elegant, but I verified a custom host can be extracted with props/transforms. Since using a new sourcetype name incurs license usage I'm betting your can have props reference a custom source instead. When Splunk writes the .csv from this |mcollect query to disk, it looks like this (I happened to have an "id" dimension in my results) |mcollect index=index_name source=source_name sourcetype=new_mcollect_stash spool=false id host ==> /var/opt/splunk/var/run/splunk/c247f3132f17807a_metrics.csv <== metric_timestamp,id,host,"metric_name:variable1","metric_name:variable2","metric_name:variable3","metric_name:variable4","metric_name:variable5","metric_name:variable6" 1583647501,71614,my_server_hostname,0,37.0842,0,-1,-1,-1 I copied the default "mcollect_stash" sourcetype to a new one for testing. The transforms extracts the 3rd column as the hostname. [new_mcollect_stash] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = csv ADD_EXTRA_TIME_FIELDS = False KV_MODE = none TRANSFORMS-newmetrichost = newmetrichost TIMESTAMP_FIELDS = metric_timestamp TIME_FORMAT = %s.%Q [newmetrichost] DEST_KEY = MetaData:Host REGEX = ^[^,]+,[^,]+,([^,]+) FORMAT = host::$1 ... View more

The parent workaround did not work for me, but I was able to load a job using REST -> Map command. | rest /services/search/jobs |where label="__SAVEDSEARCHTITLE__" |sort - updated |fields sid |head 1 |map search="loadjob $sid$" ... View more

To add some detail to this, I had this error until I set all traffic destined to 127.0.0.1 to skip MASQUERADE. The new iptables rule immediately fixed the error, no service restart required. iptables -I POSTROUTING 1 -t nat -d 127.0.0.1 -j ACCEPT Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 10 600 ACCEPT all -- * * 0.0.0.0/0 127.0.0.1 5710K 580M MASQUERADE all -- * * 0.0.0.0/0 0.0.0.0/0 ... View more