I accepted this as the solution because it was the earliest one that mentioned eval with periods/dots for the concatenation which is the most common approach I've seen in the last 12 years since this answer was written. Nice work! I do believe the | strcat works too, but didnt check before writing this. ... View more

Ok great! For the app to work, it requires python.  That means it will not run on a Universal forwarder, and I can't recommend running a full instance of splunk on a domain controller either.  So I would have to recommend against using this app at all on a domain controller.  Apologies for any disappointment. ... View more

For short: YYYY-MM-DD = %F HH:MM:SS = %T Ex. TIME_FORMAT=%F %T,%3N ... View more

you should be able to solve timeout problems by first insuring the ports are open. If the ports are closed from your host you're executing this command on, then that will cause a "timeout" or "connection refused". You can verify with openssl: openssl s_client -connect https://yourSH:8089 if that opens a connection and reads a bunch of details about cryptography to you, you're good... if it fails with timeout or connection refused, the ports are blocked / or you cant otherwise route to "yourSH:8089". If you're in a resource constrained environment and you absolutely must increase this timeout setting, then you do so by editing the following configuration item in web.conf: so we need to edit web.conf: [settings] ... splunkdConnectionTimeout = <integer> * The amount of time, in seconds, to wait before timing out when communicating with splunkd. * Must be at least 30. * Values smaller than 30 will be ignored, resulting in the use of the default value * Default: 30 ... ...and dont forget to restart! I hope this helps! ... View more

A typical way of restarting splunkd.exe (by going into Services manager and restarting the service instead of doing "splunk restart" - this way you don't have to bother with Splunk admin accounts) often ends up with "the service failed to stop" message due to way too short timeouts set by default for services. The Linux equivalent of "service splunk restart" or "systemctl restart splunk" don't typically do that. ... View more

I wouldn't consider this problem solved. It remains annoyingly hard to run custom search commands from the command line because the protocol is entirely undocumented and no tooling is available. ... View more

Unfortunately, the links at the end of this post point to "depublished" conf talks, as Splunk for some reason does not keep old talks searchable from the .conf pages. There is an idea to fix this (https://ideas.splunk.com/ideas/PORTALSID-I-141) - feel free to upvote if you'd like, and @sloshburch maybe you can you link to the pdf directly instead? ... View more

DS init failed: Deployment Server not available on a dedicated forwarder. This is not a real error on an Universal Forwarder. There is no Deployment Server on an Universal Forwarder. There is just a Deployment Client on the UF.  I think this event is show everytime the UF starts. This is how it looks in version 7.1.2 and 7.36, both Windows and Linux: INFO DS_DC_Common - Deployment Server not available on a dedicated forwarder. ... View more

Hi Team   I am getting the below error while trying to access  splunk Rest API . . I am trying to login using the username and password.  Is there any other access required to successfully Login .Please help on the same. Below is the code snippet   Map<String,Object> connectionArgs=new HashMap<String,Object>(); connectionArgs.put("host", "myHost"); connectionArgs.put("username", "myUsename"); connectionArgs.put("password", "myPassword"); connectionArgs.put("port",8089); connectionArgs.put("scheme","https"); HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2); Service service=Service.connect(connectionArgs);   Exception in thread "main" com.splunk.HttpException: HTTP 401 -- Login failed at com.splunk.HttpException.create(HttpException.java:84) at com.splunk.HttpService.send(HttpService.java:452) at com.splunk.Service.send(Service.java:1293) at com.splunk.HttpService.post(HttpService.java:308) ... View more

What kind of builder are you using for your dashboards? If it's dashboard studio, I believe it is not possible to render any dynamic JS content. With the classic dashboard panel I think it would be possible to do so. In this url you can check differences between both of them. Finally, you got the option with SPLUNK UI, where you can customize everything and in a dynamic way, but it requieres a huge effort for developing the whole solution. ... View more

2022-10-31 09:41:14 , 147 ERROR pid=14783 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback ( most recent call last ) : File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/ta_ms_log **bleep** ytics/modinput_wrapper/base_modinput.py ", line 127 , in stream_events self.collect_events ( ew ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/log_ **bleep** ytics.py ", line 96 , in collect_events input_module.collect_events ( self , ew ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/input_module_log_ **bleep** ytics.py ", line 72 , in collect_events response = requests.post ( uri , json=search_params , headers=headers ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/ta_ms_log **bleep** ytics/requests/api.py ", line 110 , in post return request (' post ', url , data=data , json=json , ** kwargs ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/ta_ms_log **bleep** ytics/requests/api.py ", line 56 , in request return session.request ( method=method , url=url , ** kwargs ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/ta_ms_log **bleep** ytics/requests/sessions.py ", line 488 , in request resp = self.send ( prep , ** send_kwargs ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/ta_ms_log **bleep** ytics/requests/sessions.py ", line 609 , in send r = adapter.send ( request , ** kwargs ) File " /opt/splunk/etc/apps/TA-ms-log **bleep** ytics/bin/ta_ms_log **bleep** ytics/requests/adapters.py ", line 473 , in send raise ConnectionError ( err , request=request ) ConnectionError: (' Connection aborted. ', error ( 104 , ' Connection reset by peer ')) ... View more

https://github.com/bentleymi/ta-webtools/issues/17 was created by another member of the community.  Accepting this as the answer. ... View more

All adjustable limits can be found in limits.conf.  Note that some limits can exist in an app context. That is to say limits in the search app can be different from the limits in your app. Any edits to core python code will be destroyed on upgrades (most likely) and may also trigger "file integrity" warnings as well.     ... View more

Perfect, do you mind accepting my answer as the solution?   ... View more

TLDR;  seems that stats list(x) as well as table commands return the events in the order they were indexed. I may be flogging a dead horse here but I thought to add my two cents after investigating the same topic recently. It is still relevant and helps to be aware of this behavior.  For my use case, I generated sample data and indexed it to a single Splunk Enterprise 9.0.1 instance. (So index clustering is not the culprit ) I noticed that the values/rows returned in my stats list(x) and table commands are ordered the same but not correctly by time. But when you do a search that just return the events, they are ordered correctly by _time as usual.  I realized that the events returned from the commands are ordered the same as the events in the input file and therefore the order they were indexed in.  This is of course a moot point when the data source is chronological making this one quite sneaky. ... View more

This post looks like it addresses this issue. ... View more

Yes, the solution is to use SPL commands to extract the fields from the curl_response field.   if it's json response, try | spath if it's csv, try | kv try | rex field=curl_response "(?<extractedFieldName>REGEXHERE)" ... View more

fieldColors gets confused by the ":" in your field names.  You need to escape the ":" in your field names in the fieldColors using a "\", like this: <option name="charting.fieldColors">{"TPS_MAX\: PREVIEW":0x990000, "TPS_MAX\: COMMIT":0x999900, "TPS_MAX\: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX\: CHECK":0x9900FF, "TPS_MAX\: RESERVE":0x006600, "ParNew\: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC\: MLC_GC":0xff0000 }</option> ... View more

A further step which may be useful: I encountered the same issue as this but the above steps were NOT successful in removing the associated app. The exact reason is still unclear, the only hints I have found were an event log generated during the bundle push, which you can find with the following search:  index=_internal sourcetype=splunkd_conf component=confdeployment "data.task"=downloadDeployableApps The event is a JSON object containing an element for each app; built in apps that do not get pushed by the deployer will have a value data.apps{}.action=preserved, ones which are pushed will have data.apps{}.action=matched. In this case, the app showed as preserved, despite not being one of the built in defaults. Cluster members would not delete it even though all local configs were gone, and the app had been removed from the deployer's bundle, and neither debug/refresh nor rolling restart helped. The eventual solution was: create a dummy app with the same name - literally an empty directory - on the deployer push the bundle with this directory this made the SHC members move the existing configs into a default.old.<date>-<time> directory Repeated the above post's steps for deleting this dir and local configs, just to be sure Pushed bundle again - app successfully deleted ... View more

Here is how we removed all 200 entries in the haproxy.log. Simply added this line to /etc/rsyslog.conf:   if ($programname == "haproxy" and not ($msg contains " 200 ")) then /var/log/haproxy.log       ... View more