Hi, I have a dashboard that contains an IFrameInclude module and a HiddenSearch module . The IFrameInclude points to a Mako Template containing some custom UI. From the events triggered by interacting with this custom UI , is it possible to restart/refresh the search from the HiddenSearch ? Could anyone give some pointers on how to achieve this ? Thank you ... View more

Hi, What would be the available options in order to parameterize a search in a Splunk view ? Let's say that all events that I'm indexing into Splunk contain a field , and that field can have values from a limited set of values. How would I make it possible for the user to specify that he is interested in events with fields having a particular value. Thanks ... View more

Hi, In the Splunk App I am working on , there is a need to specify some parameters through UI, persist them and later on read/update them. Since the "setup screen" doesn't provide me all the flexibility I need I've looked for other options. Eventually I realized that by using a custom controller and reading/writing some .conf files I can obtain what I need. However the tricky part is manipulating those files. Reading content created no problems , with the following code import splunk.bundle as bundle dict = {} try: conf = bundle.getConf(self.MY_CONF_FILE) for stanza in conf: logger.info("stanza : "+stanza ) dict[stanza] = {} dict[stanza].update(conf[stanza].items()) except splunk.ResourceNotFound: pass Writing on the other hand , done though the Splunk bundle proved to offer something else then desired. The content was written in a version of MY_CONF_FILE located somewhere else then " .../myApp/default " directory (perhaps "..../system/local" , it's a while since I've tried it). So In my intention to persist some configuration I realized that I was reading from a file and writing to another file, therefore subsequent reads would not bring previous writes. Here's the code used to write conf = bundle.getConf(self.MY_CONF_FILE) conf.beginBatch() conf['STANZA']['setting_1'] = value_1 conf['STANZA']['setting_2'] = value_2 conf['STANZA']['setting_3'] = value_3 conf.commitBatch() Therefore I resorted to use ConfigParser for reading/writing .conf files , without doing it through Splunk. def writeMacrosConfFile(self,statisticsPort): writeSuccesfull = True try: parser = ConfigParser.SafeConfigParser() parser.read(MACROS_CONF_FILE) parser.set(MACRO_PORT_STANZA, DEFINITION, statisticsPort) with open(MACROS_CONF_FILE, 'wb') as configfile: parser.write(configfile) except Exception as e: writeSuccesfull = False This is done for both custom .conf files and the macros.conf file The question would be if there is something wrong in manipulating the .conf files like this since I am feeling it is not according to the Splunk way ? Would this kind of code render the Splunk app unacceptable for uploading in Splunkbase ? Also any feedback on reading/writing .conf files would be greatly welcomed. ... View more

hello all, I have a input script to index data into Splunk. Through UI I want to input some configuration parameters and then write them in a file. When the script is run it should read the file and if it finds what it needs go on retriving data. Otherwise nothing happens. In order to achieve my goal I'm thinking to use a Form for displaying the UI widgets needed. Since I'm just a Splunk beginner I must ask whether this is feasible ? and if yes what technologies need to be employed ? I am particularly interested in the following details. is it possible to build simple custom UI (buttons, text-edit, dropdown widget, list) is it possible to execute a particular python script when some user event happens ( press a button, something from a list is selected) is it possible to dinamically load items in a dropdown list ? (I plan to read them from a file) Otherwise could you suggest other means of configuring my app through UI. I imagine this must be somehow possible since Splunk is MVC based. The Splunk version for which this app is intended is 5.0.5 ... View more