Hello, I've been tasked with ingesting some audit events from a online application (Lever Hire). I'm looking at using the REST API Modular input and need help parsing the data. Originally I thought I had to create a new sourcetype to do the parsing, but now I believe the correct method is to create a custom Response Handler. I've found some examples here: https://github.com/damiendallimore/SplunkModularInputsPythonFramework/blob/master/implementations/rest/bin/responsehandlers.py However, I'm not familiar enough with python to write my own response handler. I'm hoping someone in the community can quickly help me with the code. Here is what the raw data looks like. Any help is appreciated. { "data": [{ "id": "5b628f1e-2bcf-45f7-90fa-7b1264987d42", "user": { "role": "super admin", "id": "8810816c-03da-48db-b3c1-d47a8f5c024f", "name": "Joe Mama", "email": "[email protected]" }, "type": "key:added", "createdAt": 1515609233213, "target": { "type": "key", "id": "8d0501a2-f613-4154-b2e7-fc4b416ad213", "label": "Splunk" }, "meta": { "key": { "tokenLastFour": "w2jU", "id": "8d0501a2-f613-4154-b2e7-fc4b416ad213", "name": "Splunk", "partner": false, "service": "data-api" } } }, { "id": "85374119-2af3-48b2-838f-7821fb15ef7c", "user": { "role": "super admin", "id": "8810816c-03da-48db-b3c1-d47a8f5c024f", "name": "Joe Mama", "email": "[email protected]" }, "type": "key:removed", "createdAt": 1515609175385, "target": { "type": "key", "id": "21b0fb88-006d-4a9a-a1e1-2164fcd8d243", "label": "Splunk" }, "meta": { "key": { "tokenLastFour": "RhgT", "id": "21b0fb88-006d-4a9a-a1e1-2164fcd8d243", "name": "Splunk", "partner": false, "service": "data-api" } } }, { "id": "b368c76a-f7a5-4cc8-8201-ce4051847976", "user": { "role": "super admin", "id": "8810816c-03da-48db-b3c1-d47a8f5c024f", "name": "Joe Mama", "email": "[email protected]" }, "type": "user.authentication:succeeded", "createdAt": 1515609122117, "target": { "type": "user", "id": "8810816c-03da-48db-b3c1-d47a8f5c024f", "label": "Joe Mama" }, "meta": { "user": { "role": "super admin", "id": "8810816c-03da-48db-b3c1-d47a8f5c024f", "name": "Joe Mama", "email": "[email protected]" }, "authentication": { "method": "direct" } } }, { "id": "5b88b646-f141-4be7-a970-e39c56ce13ad", "user": { "role": "super admin", "id": "lever-support", "name": "Lever Support", "email": "[email protected]" }, "type": "key:added", "createdAt": 1515520786845, "target": { "type": "key", "id": "82cedc33-87ff-4d68-bc44-7dcc7559da4c", "label": "click-boarding" }, "meta": { "key": { "tokenLastFour": "RAof", "id": "82cedc33-87ff-4d68-bc44-7dcc7559da4c", "name": "click-boarding", "partner": false, "service": "data-api" } } }, { "id": "c4ef90e5-449d-4a2b-a724-8cde900f1a1f", "user": { "role": "super admin", "id": "cd6751d7-998a-451b-ab22-fb2e0fa96da5", "name": "superman", "email": "[email protected]" }, "type": "user.authentication:succeeded", "createdAt": 1515456274871, "target": { "type": "user", "id": "cd6751d7-998a-451b-ab22-fb2e0fa96da5", "label": "superman" }, "meta": { "user": { "role": "super admin", "id": "cd6751d7-998a-451b-ab22-fb2e0fa96da5", "name": "superman", "email": "[email protected]" }, "authentication": { "method": "direct" } } }], "hasNext": false } ... View more

Hello, I'm looking for some help on reporting on the status of my deployment client for better coverage. I know the Deployment Client data is available via rest using the following server on the Deployment Server: "I rest /services/deployment/server/clients count=0 splunk_server=local" However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field). So something like this: clientName, NumberOfServerClasses, ServerClassNames myServer | 3 | thisclass;thatclass;andtheotherone Any help is greatly appreciated. Thank you ... View more

Hello, We recently deployed Splunk in our environment and recently discovered that our engineering teams are cloning systems without clearing out the universal forwarder GUID and related logs prior to cloning the machine. I'm trying to set up a search and email alert to identify these problematic systems. I have the following search that I can run on my Deployment Server which will give me back duplicate UF GUIDs and count. | rest /services/deployment/server/clients count=0 splunk_server=local| fields hostname name ip dns utsname| stats count by name | where count > 1 I also have this search that returns all my UF installations from my deployment server. | rest /services/deployment/server/clients count=0 splunk_server=local| fields hostname name ip dns utsname| rename name as clientName I need help tying these two searches together. ...search... | rest /services/deployment/server/clients count=0 splunk_server=local| fields hostname name ip dns utsname| stats count by name | where count > 1) WHERE GUID IN (| rest /services/deployment/server/clients count=0 splunk_server=local| fields hostname name ip dns utsname| stats count by name | where count > 1) I'm familiar with SQL, but still learning SPL so I'm not sure how to link the two separate searches together with a equivalent SQL IN clause. Lastly, I want to schedule this search and email me a report of machines with duplicate GUIDs (but not email me an empty report). Any help is appreciated. Thank you. ... View more