I am running | rest /services/search/jobs command to check my failed searches for last 24 hrs. But I see that some of the searches are not getting captured. I wanted to know how long in past does rest command searches the data. Does it bring up results only for last few hours or few days ? ... View more

I am using Splunk 8.0.8. I have python versions 2.7 and 3.7 installed in $Splunk_Home/bin folder but all my python scripts are getting executed with python 2.7. I even tried changing python.version=python3 in server.conf under ./etc/system/local but still scripts are running using python 2.7. I even tried python.version=forced_python3 in server.conf but no luck. Can someone please let me know where I need to change python version so that all my scripts starts using python3.7. ? ... View more

How can I configure a different user and password other than admin to make rest end point calls to my Universal Forwader.  Current Functionality:    curl -k -u admin:changeme "https://<host>:<port>/services/receivers/simple?index=abc&source=test&sourcetype=test" -d "splunk rest test"   What I want:   curl -k -u mu_user:mypwd "https://<host>:<port>/services/receivers/simple?index=abc&source=test&sourcetype=test" -d "splunk rest test"     I tried putting this new user in authentication.conf with binddnuser and binddnpassword but it is throwing Unauthorized error. ... View more

I have 2 search boxes. I am using it to make to get parameters to REST API call. Now When there is no value in the search box then also the search gets executed. I want to restrict this and make it mandatory that until the user enters some value the search doesn't gets executed. Attaching the screenshot of the problem where search is getting executed even if there are no values in the search box. Note: I don't want to use submit button for this. ... View more

I want to put a filter box for all columns in a table. I know I can put a text box for all columns separately but that is not a good option. I want to put a text box besides/down each column name where if I enter a value then all rows gets filtered on that particular value. The default value will be "*" for all text boxes. ... View more

I have a below JSON Recalibration Stats json : {"modelid" : "30013", "champion_gini" : 0.8274502273019728, "recalibResult" : "CASE I Champion Retained", "challenger_gini" : 0.8013221831674033, "recalibDate" : "2020-05-01"}   Now to get the JSON fields I have to explicitly mention field names using table/fields. My JSON can get different fields from source so I want to get only parsed fields from JSON by not explicitly mentioning their names. Using below query is giving me all the unwanted fields as well. index = abx sourcetype = gmdevops_rome source="/axp/gnics/orchestra/dev/romedata/logs/model_run_qc.log" "Recalibration Stats json" | rex field=_raw "Recalibration Stats json : (?<recalib_stats>.+)" | spath input=recalib_stats | table * ... View more

I am rendering a table for each row of a table. But the table is not getting scrolled to other pages. On first reload of the dashboard the "Next" page option is working but when collapsing other rows this option stops working. Here is my java script I am using:   require([ 'splunkjs/mvc/tableview', 'splunkjs/mvc/chartview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'underscore', 'splunkjs/mvc/simplexml/ready!'],function( TableView, ChartView, SearchManager, mvc, _ ){ var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({ initialize: function(args) { // initialize will run once, so we will set up a search and a chart to be reused. this._searchManager = new SearchManager({ id: 'details-search-manager', preview: false }); this._TableView = new TableView({ managerid: 'details-search-manager' }); }, canRender: function(rowData) { // Since more than one row expansion renderer can be registered we let each decide if they can handle that // data // Here we will always handle it. return true; }, render: function($container, rowData) { // rowData contains information about the row that is expanded. We can see the cells, fields, and values // We will find the sourcetype cell to use its value var run_date_cell = _(rowData.cells).find(function (cell) { return cell.field === 'runDate'; }); var job_stage_cell = _(rowData.cells).find(function (cell) { return cell.field === 'jobStage'; }); var job_sub_stage_cell = _(rowData.cells).find(function (cell) { return cell.field === 'jobSubStage'; }); var model_desc_cell = _(rowData.cells).find(function (cell) { return cell.field === 'modelDescription'; }); var channel_cell = _(rowData.cells).find(function (cell) { return cell.field === 'channel'; }); var job_status_cell = _(rowData.cells).find(function (cell) { return cell.field === 'jobStatus'; }); //update the search with the sourcetype that we are interested in //this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count'}); this._searchManager.set({ search: 'index = abc sourcetype = xyz source="/test/test.log" NOT "training stats" AND NOT "testing stats" | dedup runDate,jobStage,jobSubStage,channel,modelDescription,logMessage | search runDate="'+run_date_cell.value+'" jobStage="'+job_stage_cell.value+'" modelDescription="'+model_desc_cell.value+'" channel="'+channel_cell.value+'" jobSubStage="'+job_sub_stage_cell.value+'" | dedup _time,logMessage | sort _time | table _time,logMessage'}); // $container is the jquery object where we can put out content. // In this case we will render our chart and add it to the $container $container.append(this._TableView.render().el); } }); var tableElement = mvc.Components.getInstance("job_status"); tableElement.getVisualization(function(tableView) { // Add custom cell renderer, the table will re-render automatically. tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer()); }); });   ... View more

I want my nested JSON to be parsed only at 1st level instead of parsing all the nested parts. I have below JSON: { "Name":Naman, "Age":25, "Address": { "H.No":"23", "Street_no":2, "Area":"Model Town" }, "Country":"IND" }  I want output like below: Name | Age | Address | Country Naman 25 "H.No":"23", IND "Street_no":2, "Area":"Model Town" I don't want to handle Address field separately as these are dynamic fields that are coming in from source. ... View more