Just put all the module files in bin folder of your app and add below code to your python script and you can import any custom module:  Let me know if you are facing any error import os import sys import re ta_name = '<splunk_app_name>' ta_lib_name = '<parent_folder_of_python_pakage>' pattern = re.compile(r"[\\/]etc[\\/]apps[\\/][^\\/]+[\\/]bin[\\/]?$") new_paths = [path for path in sys.path if not pattern.search(path) or ta_name in path] new_paths.insert(0, os.path.sep.join([ta_lib_name])) sys.path = new_paths   Happy Splunking!!! #dataelicitsol.com #bhavik.bhalodia@dataelicitsol.com ... View more

The error is self-explanatory. You are trying to index None. You can not, because 'NoneType' object is not subscriptable. This means that you tried to do: None[something] In general, the error means that you attempted to index an object that doesn't have that functionality. You might have noticed that the method sort() that only modify the list have no return value printed – they return the default None. This is a design principle for all mutable data structures in Python.   ... View more

I know this sounds bad: disable all unneeded services except Splunk and reboot. ... View more

How to automatize the deletion of files using the Splunk Forwarder ? David ... View more

I was the same issue “Loading…” forever with Splunk version 4.2.3 build 105575, PDF Server for Linux 1.2. On page https://splunkserver/en-US/custom/pdfutils/pdfdownload/settings you can see your problem. Probably that's your PDF server is disabled. To resolv that in Manager -> System settings -> 'Email alert settings' setup your splunk IP address in Email Format -> Link hostname: 192.168.1.50 after that restart splunk /opt/splunk/bin/splunk restart ... View more

Is the search you pasted correct? The arguments to transaction do not take inequalities -- it should be something like maxspan=240m and maxpause=15m , not with > or < . ... View more

Thanks, that looks to be working great. What prevents it from incrementing type_count when more than one event gets generated for (type=traffic AND status!=deny)with the same src value but no (type=emailfilter AND blacklist)? ... View more

Make sure to mark Johnvey's answer as correct by clicking the green checkbox next to it. That will cause the answers system to treat this as 'answered' and help future users reading answers posts - not to mention hand out some rep points 🙂 ... View more

Fixing the invocation of the test script helped. (grumble tab completion pebkac) App is running nicely from sched. search now. Extraneous lxml package removed too.. Didn't think I needed it but was doing "due diligence". Not everyone is as reliable as Splunk at including dependencies! Thank you! ... View more

Splunk uses a token (in the form of an HTTP header) to authenticate any HTTP POST requests. What is happening here is that the token passed by the web browser does not match the one on record in Splunkweb. The following lines illustrate this: 2010-08-19 16:17:12,205 WARNING [4c6d3ce83315969c50] decorators:86 - CSRF: validation failed because client XHR did not include proper header 2010-08-19 16:17:12,206 INFO [4c6d3ce83315969c50] decorators:87 - CSRF: clientSession=21c5b6e29d9ebded1cc45a4ef495de1bdbb7c3f1 serverSession=74dd0a59bb07c95bd6763c12506a2d995338974e Note that the clientSession does not match the serverSession , which Splunkweb interprets as an authentication failure. Potential causes are: overly aggressive browser caching improper load balancing configuration improper web proxy configuration I would flush your cookies for the server and and try accessing the Splunk server without going through the proxy to see if the problem still exists. ... View more

The above syntax of including "%" in a separate set of quotes from the token, did not work for me. After a lot of trial and error, what worked was this, ie., encapsulating the "%" within the SAME SET of quotes as the token: | where like(label,"%$Token_Name$%") ... View more

Ah, you need to add another search or where command after the rex because the field will only come into being after it, like: * | rex ... | where action="Remain Queue" value>10. I've updated the example. ... View more

Thx fpr your answer. Support told me that, too. But unfortunately I have to handle a bunch of different event formats (some of them XML). They are all wrapped in a message which I tried to remove with this approach. But even if it would work, there are a lot more problems: - export still uses the raw format - field extraction dialog uses the raw format - and a lot more So we ended up stripping the message part from the event and put everything we need from it (basically meta data) into indexed fields. ... View more

Nothing more with respect to AdBlock. It depends on what kind of AdBlock, and whether or not the URIs used by dashboards (which include saved search names) trigger a blocking filter. ... View more

One caveat though, top will truncate the result set based on the limit= parameter, you would have to use limit=0 to get the same results. ... View more

Ok here is what I am seeing in the web_service.log 871 ERROR module:59 - Splunkd daemon is not responding: ('[Errno 24] Too many open files',) It appears that there is a limit to open files? Where would I go to modify this limit? thanks ... View more

Hi, Happens the same, I also tried with no realtime dashboard and no luck: INFO pdfhandler:628 - Generated pdf file. bytes=38571 time=301.91 2012-01-17 13:00:06,786 INFO Generated pdf file. bytes=38571 time=301.91 2012-01-17 13:00:06,791 DEBUG pdfhandler:746 - statuslog: ['startup', 'setsize', 'setsize', 'setsize', 'setsize', 'setsize', 'timeout', 'delayedshow', 'settings', 'print', 'success'] 2012-01-17 13:00:06,791 DEBUG statuslog: ['startup', 'setsize', 'setsize', 'setsize', 'setsize', 'setsize', 'timeout', 'delayedshow', 'settings', 'print', 'success'] 2012-01-17 13:00:06,791 WARNING pdfhandler:749 - Firefox timed out while waiting for the report to be rendered - Incomplete snapshot generated 2012-01-17 13:00:06,791 WARNING Firefox timed out while waiting for the report to be rendered - Incomplete snapshot generated 2012-01-17 13:00:06,791 WARNING xvfb:132 - Stopping X Server 5 2012-01-17 13:00:06,791 WARNING Stopping X Server 5 2012-01-17 13:00:08,830 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'. 2012-01-17 13:00:08,830 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'. 2012-01-17 13:00:08,831 DEBUG simpleRequest > GET https://127.0.0.1:8089/servicesNS/nobody/search/admin/alert_actions/email [] sessionSource=direct 2012-01-17 13:00:08,836 DEBUG simpleRequest < server responded status=200 responseTime=0.0047s 2012-01-17 13:00:08,837 INFO sendemail opening PDF request to appserver at http://splunk:80/en-US/report/ 2012-01-17 13:00:09,073 DEBUG cli_common:226 - Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'. 2012-01-17 13:00:09,073 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'. 2012-01-17 13:00:09,074 DEBUG cli_common:226 - Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'. 2012-01-17 13:00:09,074 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'. 2012-01-17 13:00:09,108 DEBUG cli_common:229 - Running btool for 'pdf_server.conf'. 2012-01-17 13:00:09,108 DEBUG Running btool for 'pdf_server.conf'. 2012-01-17 13:00:09,156 INFO pdfhandler:646 - Starting PDF App Renderer Version 1.3 2012-01-17 13:00:09,156 INFO Starting PDF App Renderer Version 1.3 2012-01-17 13:00:09,161 INFO xvfb:45 - Started new X server. Now 1 active 2012-01-17 13:00:09,161 INFO Started new X server. Now 1 active 2012-01-17 13:00:09,161 INFO pdfhandler:558 - Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print http://splunk:80/app/search/sms_operadors -printmode pdf -printfile /tmp/tmppnPl4E -title Splunk Alert: sms_operadors -orientation landscape -paperwidth 297 -paperheight 219 -mode splunk -timeout 300 -windowsize 1075x768 -footer_right Generated by Splunk at &D -cookie session_id_80=e20f804384c89a8bc67b293db2c92a1dbddd7db9 2012-01-17 13:00:09,161 INFO Executing /opt/splunk/etc/apps/pdfserver/bin/firefox-x86_64/firefox -print http://splunk:80/app/search/sms_operadors -printmode pdf -printfile /tmp/tmppnPl4E -title Splunk Alert: sms_operadors -orientation landscape -paperwidth 297 -paperheight 219 -mode splunk -timeout 300 -windowsize 1075x768 -footer_right Generated by Splunk at &D -cookie session_id_80=e20f804384c89a8bc67b293db2c92a1dbddd7db9 2012-01-17 13:00:09,166 INFO xvfb:205 - Assigned DISPLAY :5 2012-01-17 13:00:09,166 INFO Assigned DISPLAY :5 2012-01-17 13:00:09,166 INFO xvfb:115 - Starting X Server: ['/usr/bin/Xvfb', ':5', '-screen', '0', '3000x768x24', '-nolisten', 'tcp'] 2012-01-17 13:00:09,166 INFO Starting X Server: ['/usr/bin/Xvfb', ':5', '-screen', '0', '3000x768x24', '-nolisten', 'tcp'] 2012-01-17 13:00:09,167 INFO xvfb:116 - Starting X Server env: {'XAUTHORITY': '/opt/splunk/var/run/splunk/xvfb/xauth-5/Xauthority'} 2012-01-17 13:00:09,167 INFO Starting X Server env: {'XAUTHORITY': '/opt/splunk/var/run/splunk/xvfb/xauth-5/Xauthority'} 2012-01-17 13:00:11,170 INFO xvfb:122 - X Started 2012-01-17 13:00:11,170 INFO X Started 2012-01-17 13:00:38,858 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: Splunkd daemon is not responding: ('The read operation timed out',) 2012-01-17 13:00:38,859 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__admin__search_X1NjaGVkdWxlZFZpZXdfX3Ntc19vcGVyYWRvcnM_at_1326801600_9a43f779a8ba82ef?message_level=warn [] sessionSource=direct 2012-01-17 13:00:38,865 DEBUG simpleRequest < server responded status=200 responseTime=0.0061s 2012-01-17 13:00:38,865 DEBUG getStatus - elapsed=0.00634121894836 nextRetry=0.0500000020399 2012-01-17 13:00:38,888 INFO Sending email. subject="Splunk Alert: sms_operadors", results_link="http://splunk:80/app/search/@go?sid=scheduler__admin__search_X1NjaGVkdWxlZFZpZXdfX3Ntc19vcGVyYWRvcnM_at_1326801600_9a43f779a8ba82ef", recepients="['xxxxx@xxxxx.com']" Any clues?? Thanks in advance! Alex ... View more

The full description of relative time range modifiers is here: http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Specify_relative_time_ranges_in_your_search ... View more

Just as a word of warning. Multi-line searches can cause some problems in some of splunk's internal logs. This is mostly due to props settings for the log files. Normally this shows up as time-stamping errors in the splunkd.log source. For example, the auditrail, splunkd, and searches (I think) sourcetypes are not setup for multi-line events. And in some places the multi-line searches get logged across lines which causes the timestamping issue. Other times, the searches get wrapped as a single line, and this isn't a problem. (I tracked this down once, I think. But can't remember what the common factor was as to when this seems to happen.) In my own config, I've added SHOULD_LINEMERGE = True to these sourcetypes to make this problem go away. (I realize this probably isn't as efficient, but it seemed like the best workaround) ... View more

Really? Isn't this precisely that? 03-19-2010 14:09:33.277 INFO AuditLogger - Audit:[timestamp=03-19-2010 14:09:33.277, user=admin, action=search, info=granted , search_id="1269032973.28", search='search * | head 10', autojoin=1, buckets=300, ttl=600, max_count=10000, maxtime=0, enable_lookups=1, extra_fields="*", apiStartTime="Thu Mar 18 14:00:00 2010", apiEndTime="Fri Mar 19 14:09:33 2010"][n/a] ... View more

So does the namespace parameter in GET or POST just not work or doesn't do what you expect it to do? ... View more

While the URLs are correct, the Java SDK (which the OP refers to), supports namespaces. There is a description here: http://dev.splunk.com/view/SP-CAAAECN#namespaces ... View more

Thank you, k8to, for information on the general behavior of the metrics log. On recollection, we were running Splunk 4.0.6 at the time this gap was detected. We have since upgraded to Splunk 4.0.9, and will continue to monitor for this behavior. One question: why k8to? 😉 ... View more