About Brett

Brett · ‎12-18-2024

Every bucket has to store every dimension value once, so if you are using a million unique IDs to reference combinations of less than a million unique dimension strings, you are making the situation worse. Using KV Store is a great idea for repetitive asset information, like adding context to a hostname, but in this situation you should still store the meaningful unique identifier (hostname) as a dimension. I believe your best solution will be some combination of dimensions and KV Store to enrich them, but don't go 100% in either direction, and if you start creating new unique keys to make it work I think it's going too far. The only other suggestion I have is if you have large logic groups of systems without overlapping dimensions, you could put them into separate indexes and use wildcards in your index filter to access them all. Will keep the TSIDX smaller and performance higher.

Brett · ‎05-24-2024

I just built an app to do this: https://splunkbase.splunk.com/app/7371

Brett · ‎03-07-2024

As I said on Reddit, you should take a look at Mothership. https://splunkbase.splunk.com/app/4646

Brett · ‎08-24-2023

FYI there are no index time field extractions on mode=multikv There are on mode=single but they are for metric store.

Brett · ‎08-24-2023

Thanks for the mention. This person definitely needs to watch my conf talk. https://conf.splunk.com/files/2023/recordings/PLA1163C.mp4

Brett · ‎07-19-2023

https://splunkbase.splunk.com/app/1724

Brett · ‎07-19-2023

Splunk provides documentation for its REST API at https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTprolog You can also integration Splunk with external systems using their REST API by developing your own Splunk App. You can learn more at https://dev.splunk.com/enterprise/docs/developapps

Brett · ‎07-19-2023

The Certification team can help. Contact them via email at certication@splunk.com. For training questions, contact education_amer@splunk.com.

Brett · ‎07-19-2023

Splunk provides a full list of documenated search commands at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Brett · ‎07-19-2023

Splunk provides detailed instructions and examples at https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/ You can use the Splunklib python library to quickly create custom search commands in Splunk. At a bare minimum you can create a commands.con under /local and point to your sceleton python command residing under /bin and print to stdout to start with.

Brett · ‎07-19-2023

Splunk provides lots of useful resources to develop your own Splunk apps at https://dev.splunk.com/enterprise/docs/developapps There are many kinds of Splunk apps, which can do different things, so it depends on what you are trying to achieve. At the most basic level, you can just create a new app inside the Splunk Web UI, and create content like dashboards and saved searches.

Brett · ‎07-19-2023

You can find your local Splunk usergroup at the usergroups site https://usergroups.splunk.com/ If there isnt one in your area, consider starting one yourself by signing up at https://usergroups.splunk.com/become-a-splunk-user-group-leader/ You can also join the User Group Slack and chat with people in your geography using channels , for example #apac

Brett · ‎07-19-2023

Splunk lists community pages at https://www.splunk.com/en_us/community.html For example you can join the Usergroup Slack Community, Join you local User Group, or come to the community zone at .conf.

Brett · ‎04-14-2023

If the sourcetype is WinEventLog and you have Splunk_TA_windows installed, then there is a conflicting field alias named parent_process_for_windows, so the naming of your alias definition either puts you before or after it during the runtime after merge. If the TA used ASNEW this may not have been an issue, but it uses AS so overwrites the field. This would be why changing the namespace impacts the field alias working. FIELDALIAS-parent_process_for_windows = Creator_Process_Name AS parent_process

Brett · ‎12-01-2022

The developer appears to be using the wrong REST URL It should be splunkd/__raw/services/TA-ServiceNow-SecOps_Setup I would report this to customersupport@servicenow.com

Brett · ‎10-12-2022

Ok I have a better solution. If you want to use Splunk Create as the Splunk user, and avoid using the Splunk provided NodeJS v8 runtime, remove the Splunk bin from your terminal path first. export PATH=$(echo $PATH | sed -s 's+/opt/splunk/bin:++') node -v This worked for me to develop as my Splunk user.

Brett · ‎10-08-2022

I am having the same issue and can point you in the right direction. If you are logged in as the Splunk user, it seems you get that error whenever you try run node. You can confirm this by running "which node" and you will see it's Splunk's. The workaround I'm using, is I develop my Splunk UI app as another OS user where node works. I also just created the symlink manually because my environment is a little different.

Brett · ‎12-05-2021

Answered this question myself. The "extracted_host" is actually still "host" in the _meta key, so the solution is to force Splunk to read the _meta key for its value. INGEST_EVAL = host:=$field:host$, $field:host$:=null()

Brett · ‎12-05-2021

How can I get the "host" value extracted from a JSON event with "INDEXED_EXTRACTIONS = json" into the events host field? By default, this value ends up in the extracted_host value, and the following INGEST_EVAL does not work: INGEST_EVAL = host:=extracted_host, extracted_host:=null()

Brett · ‎07-26-2021

Yes, once you upload it to Splunkbase it will run through AppInspect, however you do not need to pass to get on Splunkbase! I have a published app which cannot pass AppInspect for example. A human will review your app just to check it doesn't have malware etc. You can also run AppInspect yourself by API. See more details at https://dev.splunk.com/enterprise/docs/developapps/testvalidate/appinspect/

Brett · ‎07-25-2021

If your app has no python code in it, I don't see why you should be trying to run the Python Upgrade Readiness against it, as it has nothing to check. A "fail" makes sense in the context that the check failed, but not that you app has failed to work with Python 3. I cannot see any reason why your app wouldn't work with Python 3, because it has no Python to begin with. If you want to be sure, I would just run and test your app on the latest Splunk 8.2 version.

Brett · ‎08-04-2019

You most likely want to use either msiexec.exe /i splunkuniversalforwarder.msi RECEIVING_INDEXER=[indexerhostname]:9997 AGREETOLICENSE=yes /quiet or if you have a deployment server, then use: msiexec.exe /i splunkuniversalforwarder.msi DEPLOYMENT_SERVER=[deploymentserverhostname]:8089 AGREETOLICENSE=yes /quiet If you do not include the agreetolicense, it will not work unattended.

Posts	15
Solutions	3
Karma Given	8
Karma Received	9
Member Since	‎07-23-2019

Online Status	Offline
Date Last Visited	‎08-11-2025 07:54 PM

How to get the host value from INDEXED_EXTRACTIONS...

Re: Best Practices for Handling High-Cardinality D...

Re: Integrating and Ingesting Atlassian Audit Logs...

Re: Best Approach to Centralized Monitoring of Spl...

Re: Windows TA - MultiKV fields

Re: Windows TA - MultiKV fields

Re: How to create and manage lookup tables?

Re: How can I integrate Splunk with external syste...

Re: Who can I contact for Training and Certificati...

Re: What are the different search commands in Splu...

Re: How to develop custom search commands?

Re: How to build a custom Splunk app?

Re: How do I meet Splunk users in my area? Are the...

Re: Is there anywhere else Splunk Community joins ...

Re: Why does FIELDALIAS work or doesn't depending ...

Re: How do I resolve this error: [SPLUNKD] Not Fou...

Re: Error while linking app to Splunk directory on...

Re: Error while linking app to Splunk directory on...

Re: How to get the host value from INDEXED_EXTRACT...

How to get the host value from INDEXED_EXTRACTIONS...

Re: Python3 Readiness App return false positive

Re: Python3 Readiness App return false positive

Re: Script for install Splunk Forwarder on Windows...

Join the Conversation