I've got an issue with a scheduled alert that keeps going to finalizing but never stops (if this happens on the weekend it will "finalize" all weekend until I kill it on Monday). Is there a way to find out why it's getting stuck, or to set a finalizing time limit so it just stops after n seconds regardless of state? I've already set the dispatch.max_time but that doesn't appear to effect the finalizing duration. ... View more

TL;DR; I need to set a value on one SH in a cluster, and then tell the other SH what it is using Python. Tried using the RESTapi (see below) but any tips where someone has done it before would be great!  Full Version I'm working on a clustered instance of Splunk. It talks to another tool using an access token which expires after so long (1 hour). When the user calls the tool and the token has expired a new token is generated and needs to be shared between the other SHs so they can use it until it expires again. The token is set in Python and I looked to use the services.post command to update a custom conf file/stanza     service.post('/servicesNS/nobody/APP/configs/conf-app/session')     And when I run it under admin it works fine, but when I run it as a user I get an error:     HTTP 403 Forbidden -- You (user=barry) do not have permission to perform this operation (requires capability: admin_all_objects).     But I don't want the user to have admin_all_objects.   I have given the user a role which has write access to the conf file:     [APP/session] owner = nobody access = read : [ app_role ], write : [ app_role ]     Can anyone suggest how I can get the API to update the local conf without admin or come up with a better way to share the token between SHs? ... View more

Hi, I'm trying to build an app that will pull information from a third party tool via it's API function. The information I'm getting is not event data and is only going to be pulled when called by a user of the app. The API link is going to be authenticated with a service account that Splunk will store the password for. Here's where I'm getting trouble. when the users call the API, I need to pull the password to initiate the session, but it's obvs going to be encrypted and the users can't get it without the list_stored_passwords role. However If I give the users the list_stored_passwords role they can see ALL stored passwords by using the REST command. Is there a way to lock the list_stored_passwords role so it only brings back the password a specific app? If not how else could I store a password that only people who have access to the app could decrypt? ... View more

I'm trying ot add a bit of jazzyness to my simple_xml form and I wanted to put some colour on a couple of html eliments. I know I can add a style sheet / add style tag but I wanted to use the brand names so it changes as the tool does (Eg brandColorD30). I thought it might be possible like in bootstrap by adding it to the class by this didn't work. Any tips would be helpfull. ... View more

I'm trying to install a forwarder on a NAS box but everytime I try to start it I get the error: /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libpcre2-8.so I've extracted it 3 times now and I get the same issue every time. I've set the owner and group to splunk:splunk and I can see that the libpcre2-8.so is in the lib folder but everytime I run the splunk start I get asked to run the set up then I enter admin as my username then it gives me this error. Please help as it's driving me potty!! ... View more

I have a query that loads a string into a token depending on the results. If one of the three results come out I want to make part of the token bold. EG: - This user has level 1 permission - This user has level 2 permission - This user have NO PERMISSIONS I have the query outing a value like this: This users has &ltstrong&gtNO PERMISSIONS&ltstrong&gt but it's obviously converting the &lt&gt into it's html code and spitting it out as it is seen not as a html tag. ... View more

I have a missing set of data. I've been given a new set of data to fill the gaps but there are some duplicates in the raw file to what is already in splunk and I need a way to import the non duplicate data. So far I've managed to import the new data into a separate index and used a query to remove the items that are already in the main index then tired the collect command to put the values into another index (I've used a dummy one to start with so I don't mess up my main index). However when the data is copied it messes up some of the date formats (turns them to epoch) and doesn't pick up the _time field correctly. Current code: (index=main sourcetype="sourcetype1") OR (index=sourceindex" ) | eventstats count by deviceCustomDate1 fileName | search count=1 | collect index=sourceindex sourcetype=sourcetype1 Then if I look at the results for one of the record in both indexs I get this _time deviceCustomDate1 index 2019-05-16 23:47:21 2019/05/16 22:47:21 UTC sourceindex 2019-05-17 00:03:29 1558046841000 destinationindex Am I missing something? Is Collect the right tool to use? Thanks in advance. ... View more