Hi all, I want to configure a Datamodel in different apps. On app should define the datamodel (here search). The seconds app should (here: dm_acc) should define schedule and acceleration. andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/metadata/local.meta [datamodels/metricbeat] access = read : [ * ], write : [ admin ] owner = testuser [models/metricbeat] access = read : [ * ], write : [ admin ] owner = testuser andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/local/datamodels.conf​ [metricbeat] #acceleration = true #acceleration.earliest_time = 0 acceleration.hunk.dfs_block_size = 0 andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat default/datamodels.conf [metricbeat] acceleration = true acceleration.earliest_time = 0 acceleration.cron_schedule = * * * * * andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat metadata/local.meta [] access = read : [ * ], write : [ admin ] export = system this seems to work fine so far. I can query the DM using | tstats summariesonly=t count values(host) from datamodel=metricbeat Unfurtunaly I'm receiving an error message: "Error in data model "metricbeat" : JSON file contents not available." when using the WebGUI and access Datamodels. Any hint's?! Does this look like a GUI bug?! Regards, Andreas ... View more

Hi all, I'd like to create a custom alert action, which doesn't get it's custom parameters from savedsearches.conf, but from another (custom) configuration file. I guess from the alert action (python) script it should be no issue to read and parse another configfile instead of using the json which is coming from stdin. so far I have no idea how to display the values for the parameters in the webgui of the alert from another source than savedsearches.conf. Did anyone may fall over a custom alert action not using the default way to save and display parameters? Thanks for you help in advance, Andreas ... View more

Hi forum, we are facing large increasing delays between dispatchtime and scheduledtime in scheduler log. We see delays up to 200 seconds for searches which are scheduled every minute - resulting in not-scheduled searches. this directly correlates to "ERROR SHCRepJob - failed to delegate job job=SHPDelegateSearchJob peer="peername", guid="466C6F6D-2779-4BFD-AE1F-64A71D0A5AC8" saved_search=system;; err=" messages we see at the SHC Captain. Any hints? Other Single-Search-head instances do not show any issues. Using v.7.1.6 Best Regards, Andreas ... View more

Hi forum, I'm trying to implement a custom reporting command. Here is the smallest implementation which does nothing but giving the results back. from __future__ import absolute_import, division, print_function, unicode_literals import os from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators import sys from splunklib import six @Configuration() class SavetableCommand(ReportingCommand): @Configuration() def map(self, records): return records def reduce(self, records): return records dispatch(SavetableCommand, sys.argv, sys.stdin, sys.stdout, __name__) Unfortunately this doesn't give me the correct order of the incoming resultset. Example: | tstats count values(source) as a where index=_internal by sourcetype | table sourcetype count a | mycommand Gives back a table with a count sourcetype - so it looks like columns of the stats are reordered alphabetically. How would it be possible to return the columns is in a correct order?! Thanks and best regards, Andreas ... View more

Hi all, is there any reason why eventgen.conf and sample files are not included in v3.5.0 while it is available in older versions (e.g.: v3.4.2)? ~/Downloads/Splunk_TA_bluecoat-proxysg/default$ ls -1 app.conf eventtypes.conf inputs.conf props.conf tags.conf transforms.conf ~/Downloads/Splunk_TA_bluecoat-proxysg/default$ cat app.conf | grep -i version version=3.5.0 Best Regards, Andreas ... View more

Hi forum, We increased Memory on multiple VM Instances running splunk from 64GB to 128GB. On some instances change is reflected in splunk on some doesn't. Splunk was restarted after memory was increased. I'm using index=_introspection host=myinstances* hostwide | stats latest(data.mem) by host and | rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide | search splunk_server=myinstance* output on one of the instances which are displayed with 64GB RAM: cat /proc/meminfo MemTotal: 130023424 kB MemFree: 4469608 kB Buffers: 1801916 kB Cached: 115051716 kB SwapCached: 21600 kB Active: 58163608 kB Inactive: 60075332 kB Active(anon): 1080072 kB Inactive(anon): 307072 kB Active(file): 57083536 kB Inactive(file): 59768260 kB any hints? Version is 7.1.3.1 running Linux. Regards, Andreas ... View more