About vamsigurram

vamsigurram · ‎03-28-2021

Thanks @tscroggins This is exactly, what i wanted. Both your suggestions worked.

vamsigurram · ‎03-26-2021

Hi, I have a tabular results of folks, who are using index=* in their searches. So i have SPL that outputs below User app title SPL email user1 search xyz index=* abc\@test.com user2 app1 abc index=* source=* user2\@test.com WHen i add the below command, i see email of all the results in the table. | sendemail to="abc@test.com" format=table subject=myresults sendresults=true inline=true But i want user1, to get only his/her result Similarly user2, should get only his/her result. SO i tried below. but none worked. | map [|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true] | map [sendemail to="$email$" format=table subject=myresults sendresults=true inline=true] | map search="|sendemail to="$email$" format=table subject=myresults sendresults=true inline=true" | map search="sendemail to="$email$" format=table subject=myresults sendresults=true inline=true" Please let me know the right syntax.

vamsigurram · ‎11-27-2020

The below code is throwing error. {"messages":[{"type":"WARN","text":"call not properly authenticated"}]} r = requests.get(base_url+"/servicesNS/admin/search/auth/login", data={'username':username,'password':password}, verify=False) sessionkey = minidom.parseString(r.text).getElementsByTagName('sessionKey')[0].firstChild.nodeValue print ("Session Key:", sessionkey) Output: Session Key: im0t_JBlWSnQnaWwFCj016^q_QEYutHbpQMBGLEHlxOesSAVh6iQ0X8Y4tcoQR5a4lwr3I2ayDgBVNx0412THyMkON0iO6^Af_2DCYS1F8Eseo I see Session Key here. No issues so far. But when I pass the above session key, to the below requests.post, I see the error. What am I doing wrong here? url = base_url + "/services/search/jobs?output_mode=json" headers = { "content-type": "application/x-www-form-urlencoded", "Authorization": "Splunk %s" % sessionkey, } payload = { "search": "|rest /servicesNS/%s/search/directory" % kouser, "count": 0 } r = requests.post(url, headers=headers, data=payload, verify = False) print(r.text) {"messages":[{"type":"WARN","text":"call not properly authenticated"}]} Is there anything wrong here?

vamsigurram · ‎11-27-2020

This code seems to be working. Assigning same existing KO's owner and sharing details, in the payload is saving the splunk KO. headers = { "content-type": "application/x-www-form-urlencoded", "Authorization": "Splunk %s" % sessionkey } payload={ 'owner': ko['owner'], 'sharing': ko['sharing'] } res = requests.post(url,headers=headers, data=payload, verify = False)

vamsigurram · ‎11-25-2020

@thambisetty We have 30 search heads in the backend. Moving hundreds of users local and meta folders, is giving us pause. I am still leaning towards doing this through python script. If we can do it (save Knowledge Object, without making any changes) from UI, then we should be able to do it, through REST endpoint. Is there a way to see, what underlying endpoints, splunk UI is calling? May be that will give us some pointers.

vamsigurram · ‎11-24-2020

I have a task to move All users (except admins, nobody) KOs (Knowledge Objects) from search app, to their own apps. When I try to move the KO, I get below error. Replication-related issue: Cannot move asset lacking a pre-existing asset ID Online search shows, work around for this. We just re-save the splunk KO and them move it (to other app). But problem is we have thousands of splunk KOs. There is no way we can manually do this. I tired to automate with python script. I did not see rest endpoint "/save" or /re-save Endpoints for Views: <link href="/servicesNS/admin/search/data/ui/views/my_dashboard" rel="list"/> <link href="/servicesNS/admin/search/data/ui/views/my_dashboard/_reload" rel="_reload"/> <link href="/servicesNS/admin/search/data/ui/views/my_dashboard" rel="edit"/> <link href="/servicesNS/admin/search/data/ui/views/my_dashboard" rel="remove"/> <link href="/servicesNS/admin/search/data/ui/views/my_dashboard/move" rel="move"/> I see /move but not /save. Need help, finding rest endpoint, so that I can script (The save, with NO changes and Move), for all Splunk KOs (Savedsearches, Views, Eventtypes, etc...) for users.

vamsigurram · ‎11-24-2020

As soon as i posted this question, i found the answer. Its indeed count = 0 the answer, as highlighted below. Been struggling with this for 2 days. But answer is so simple. url = base_url + "/services/search/jobs/%s/results" % sid headers = { "content-type": "application/x-www-form-urlencoded", "Authorization": "Splunk %s" % sessionkey } payload = { "output_mode": "json", "count": 0 } res = requests.get(url, headers=headers, params=payload, verify = False) result = json.loads(res.text)["results"] print("length is %s" % len(result))

vamsigurram · ‎11-24-2020

I wrote the below python code, which is giving me only first 100 events. I checked online docs, i saw "count = 0" as a solution, to get all results, but that option only works for Splunk SDK (splunklib.client.service) I am using python's requests library. Need help in looping/pagination of all the results of this search id (%sid) import requests import json url = base_url + "/services/search/jobs/%s/results" % sid headers = { "content-type": "application/x-www-form-urlencoded", "Authorization": "Splunk %s" % sessionkey } payload = { "output_mode": "json" } res = requests.get(url, headers=headers, params=payload, verify = False) result = json.loads(res.text)["results"] print("length is %s" % len(result)) =================> Output here is 100

vamsigurram · ‎11-23-2020

Good idea. I will try that. Thanks again for your help.

vamsigurram · ‎11-23-2020

@inventsekar Yes, its for learning more on splunk.rest. But as @harsmarvania57 mentioned, its a bummer why splunk-sdk does not have those libraries. Now I have to code directly in linux (without vscode)

vamsigurram · ‎11-22-2020

Hi, From the below github link, I see this python code, which works on the search head(linux), when I use this command. /opt/splunk/bin/splunk cmd python ko_change.py https://github.com/harsmarvania57/splunk-ko-change/blob/master/ko_change.py I see below import statements. import splunk.rest as rest import splunk.auth as auth When I use these, import statements, in my laptop, vscode, it get below error. "ModuleNotFoundError: No Module named "splunk.auth"; 'splunk' is not a package" "ModuleNotFoundError: No Module named "splunk.rest"; 'splunk' is not a package" I have splunk-sdk installed in my vscode. splunklib is working. So the question here is, how come the above import statements work on splunk search head(Linux) , but not in vscode (in my laptop), even when I have splunk-sdk installed? What library, do I need to install, to make splunk.auth and splunk.rest work in vscode (on my windows laptop)

vamsigurram · ‎11-03-2020

Thanks richgalloway for the reply. I will check _audit and see if that helps. I will reply back with my findings.

vamsigurram · ‎11-02-2020

I am looking for SPL, that can give me list of all the knowledge Objects, created in last 24 hours, in search app. I looked at the below rest SPL, but i did not see creation time. | rest /servicesNS/-/search/directory

vamsigurram · ‎10-23-2020

I found the issue in the lookup. This is working. | rest /servicesNS/-/-/saved/searches | search search="*sourcetype=*" | fields qualifiedSearch search title author | rex field=qualifiedSearch "sourcetype=\s*\"*(?<st>[^\"\ \)]+)" | eval st = lower(st) | lookup temp_pvsi_sourcetypes.csv sourcetype as st OUTPUT sourcetype as sourcetypefound | where isnotnull(sourcetypefound)

vamsigurram · ‎10-23-2020

I updated rex. But Lookup is giving issue. | rest /servicesNS/-/search/saved/searches | search search="*sourcetype=*" | fields qualifiedSearch search title author | rex field=qualifiedSearch "sourcetype=\s*\"*(?<st>[^\"\ \)]+)" | eval st = lower(st) | lookup sourcetypelist.csv st as sourcetype OUTPUT sourcetype as sourcetypefound | where isnotnull(sourcetypefound) Error in 'lookup' command: Could not construct lookup 'sourcetypelist.csv, st, as, sourcetype, OUTPUT, sourcetype, as, sourcetypefound'. See search.log for more details. | inputlookup temp_pvsi_sourcetypes.csv (this gives fields index, sourcetype)

vamsigurram · ‎10-23-2020

I need to find the users that are using sourcetypes in their savedsearches (reports/dashboards). I have list of sourcetypes in csv file. SPL1:(this gives me source type list) | inputlookup sourcetypelist.csv SPL2: (this gives list of savedsearches and their search string used). I see 1200 rows here. | rest /servicesNS/-/search/saved/searches | search search="*sourcetype*" | fields qualifiedSearch search title author I need to combine the above 2 SPL's (inner join, append, sub search. I am not sure), to find only those saved seaches that are using the specfic sourcetypes (listed from SPL1, above.), in their savedsearch SPL's, | rest /servicesNS/-/search/saved/searches | search search="*sourcetype*" | fields qualifiedSearch search title author | where match(search,"osma") As seen highlighted above match function (osma is one of the sourcetype value) takes string/regex, but not variable. I cannot do this | where match(search, $sourcetype_variable$) I would appreciate if someone can help me here.

vamsigurram · ‎10-16-2020

Looking at splunk docs, i found the below REST API, gives all the info that "All Configurations" is giving us. | rest /servicesNS/-/search/directory | search eai:acl.app="search" The only question, i have is why does splunk give me "All configurations" for all the apps, when i clearly mentioned search app, as highlighted above? Hence i had to limit my results to search app, by doing | search eai:acl.app="search"

vamsigurram · ‎10-15-2020

Hi, WHen i go into splunk console --> settings --> "All Configurations", i see 2000+ entries for seach and reporting app. How do i pull all these rows using rest api? I want to list all these knowledge objects per author (owner). I tried something like this, but that did not give all the results. | rest "/servicesNS/-/search/saved/searches"

vamsigurram · ‎09-06-2020

Hi, I have a host.csv, with 20K+ hosts in it. I am expecting values(index) by host. But tstats gives error for the below command. | tstats values(index) where index=* [| inputlookup eft_hosts2.csv | format ] by host I get below error. Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group I do not want to use the stats command as shown below, becasue it will never complete and very performance intensive. index=* [| inputlookup eft_hosts2.csv | format ] | stats values(index) by host is there any other command that can search meta files and do index aggregation per host?

Posts	19
Solutions	4
Karma Given	0
Karma Received	0
Member Since	‎02-16-2017

Online Status	Offline
Date Last Visited	‎03-28-2021 11:42 PM

Splunk - Sendemail for each output row

splunk - python - requests.post Authentication err...

Python - ReSave Splunk (existing) Knowledge Object...

Splunk-Python (requests.get) outputs only first 10...

Splunk search head's python library Vs Python 3.8

Find Knowledge Objects created in last 24 hours

Find knowledge Objects that are using sourcetypes

Splunk rest API - List "All configurations"

tstats index aggregation

Re: Splunk - Sendemail for each output row

Splunk - Sendemail for each output row

splunk - python - requests.post Authentication err...

Re: Python - ReSave Splunk (existing) Knowledge Ob...

Re: Python - ReSave Splunk (existing) Knowledge Ob...

Python - ReSave Splunk (existing) Knowledge Object...

Re: Splunk-Python (requests.get) outputs only firs...

Splunk-Python (requests.get) outputs only first 10...

Re: Splunk search head's python library Vs Python ...