About andrew_f_trobec

andrew_f_trobec

Thanks @PickleRick for second opinion, I'm also hedging on the latter part of your statement 🙂 I'm gonna go ahead and get official statement anyways...

andrew_f_trobec

There are conflicting statements in Splunk ITSI 4.21 documentation about being able to use adaptive thresholding on per-entity basis, please help to clarify. Statement 1 "In ITSI 4.21, adaptive thresholding has been enhanced to support entity-level data, providing users with greater granularity and precision in monitoring KPIs." https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/visualize-and-assess-service-health/4.21/advanced-thresholding/migrate-anomaly-detection-to-adaptive-thresholding-in-itsi Statement 2 "You currently can't perform adaptive thresholding on a per-entity basis. If you want to perform thresholding at the per-entity level, you must use the standard thresholding procedure." https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/visualize-and-assess-service-health/4.21/advanced-thresholding/create-adaptive-kpi-thresholds-in-itsi Please clarify. Thank you. Andrew

andrew_f_trobec · ‎07-16-2021

@abhishek_solank Amazing, thank you so much, this solved the issue! The custom field is now syncing: Not sure if I updated the regex correctly, but it now looks like this (I added the two periods (.)): "^(u_|[a-z$.])([_]?[a-z$.\d]+)*$" Since it works I'm not gonna go searching for trouble 🙂 Best regards, Andrew

andrew_f_trobec · ‎07-02-2021

Hello! I am using the Splunk Add-on for ServiceNow to retrieve data from standard ServiceNow tables, in particular the "sc_req_item" table for service requests. The form has a custom field that I need to extract and it has an internal id of "variables.4d1b6d291b2fd4d025d5eb186e4bcb19". When calling the ServiceNow REST API with Postman I can retrieve the field without issue: When trying to retrieve the same field using the Splunk Add-on for ServiceNow I get the message: "Values should begin with a letter or '$', and can include '_' and numbers, but got the value: variables.4d1b6d291b2fd4d025d5eb186e4bcb19" I can sync all the fields I need through the connector with the exception of the custom which has a . (period) in the name. I have tried using quotes and replacing . (period) with _ (underscore) but I cannot get the field synced. Here is the input configuration for reference: Is what I am trying to do possible with the Splunk Add-on for ServiceNow? Thanks! Andrew

andrew_f_trobec · ‎11-13-2020

I figured it out, and the issue was with the cleantext custom command packaged with NLP Text Analysis. This command seems only to work with python2. I suspected this and updated the cleantext stanza local/commands.conf with python.version = python2. After restarting nothing changed. After further investigation it seems Splunk 8.0.x comes packaged with both python 3 and python 2, with python.version in default/server.conf set to python2. In my case I had a value force_python3 value set in local/server.conf, which means that setting python.version anywhere else (like in local/commands.conf for the cleantext command) will be ignored. I updated that value to python3, restarted, and everything started working. So I think NLP Text Analytics assumes that users leave the python.version value in default/server.conf as python2. In my case that value was updated in local/server.conf which screwed everything up. This might be written in the documentation somewhere, but I'm not going to lie: I didn't even check it... I hope this may clarify some things for others!

andrew_f_trobec · ‎11-12-2020

Hello, I've noticed post upgrade to Splunk Enterprise 8.0.5 that NLP Text Analytics searches freeze when encountering accented characters as well as some additional characters such as: à “ ” – (long dash) I am certain there are more, but I just want to know how to make them compatible with the NLP Text Analytics searches. I did not have this problem with Splunk 7.3.2 running Python 2.7.x. I am using lookups to put my data in, but the same happens when the data is coming from an index. I tried creating and recreating the lookup with various methods to ensure that it's UTF-8 encoding but I could not resolve. If I put one of the characters mentioned above into the pride_prejudice sample CSV files and it breaks that as well (to try it, use field "sentence" and search "| inputlookup pride_prejudice.csv | head 1" on the Counts dashboard). I have the following components installed: nlp-text-analytics - 1.1.0 Splunk_SA_Scientific_Python_linux_x86_64 - 2.0.2 Splunk_ML_Toolkit - 5.2.0 Does anybody know how to solve? Thanks! Andrew

andrew_f_trobec · ‎11-11-2016

Stupid double quotes! Thank you!

andrew_f_trobec · ‎11-09-2016

Hello, I have a simple issue that I can't resolve, and was hoping for support. I have the following data: OBJECT ID,NEW STATE 1,STATE ONE 1,STATE TWO 1,STATE THREE 2,STATE ONE 2,STATE TWO 2,STATE ONE My objective is to return the amount of times that "STATE ONE" appears. I have the following code: index = "SAMPLE INDEX" | stats count(eval("NEW STATE" = "STATE ONE")) as "COUNT" I was hoping that this would return "COUNT" = 3, but it keeps returning 0. What am I missing? Any help would be greatly appreciated. Thank you! Andrew

Posts	8
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎11-09-2016

Online Status	Offline
Date Last Visited	a week ago

Does Splunk ITSI 4.21 support per-entity adaptive ...

How can I retrieve ServiceNow field values with . ...

Why does NLP Text Analytics on Splunk 8.0.5 (Pytho...

How do I return the number of times a specified va...

Re: Does Splunk ITSI 4.21 support per-entity adapt...

Does Splunk ITSI 4.21 support per-entity adaptive ...

Re: How can I retrieve ServiceNow field values wit...

How can I retrieve ServiceNow field values with . ...

Re: Why does NLP Text Analytics on Splunk 8.0.5 (P...

Why does NLP Text Analytics on Splunk 8.0.5 (Pytho...

Re: How do I return the number of times a specifie...

How do I return the number of times a specified va...

Join the Conversation