Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About slashnburn
slashnburn
Path Finder
Member since:
07-14-2014
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 3 |
| Karma Given | 11 |
| Karma Received | 4 |
| Member Since | 07-14-2014 |
Activity Feed
- Karma How to get more than 100 rows in web framework using Django binding? for tommywang. 06-05-2020 12:47 AM
- Karma Re: What is the developer console view? for tom_frotscher. 06-05-2020 12:47 AM
- Karma Re: How to divide the results of one search by the results of a second search? for strive. 06-05-2020 12:47 AM
- Karma Re: How to divide the results of one search by the results of a second search? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to divide the results of one search by the results of a second search? for bwooden. 06-05-2020 12:47 AM
- Karma Why is splunkweb not starting on an indexer cluster member with hanging message "Waiting for web server at...to be available..."? for pdjhh. 06-05-2020 12:47 AM
- Got Karma for Re: How to wait for the SearchManager job to finish?. 06-05-2020 12:47 AM
- Got Karma for What is the developer console view?. 06-05-2020 12:47 AM
- Got Karma for Re: What is the developer console view?. 06-05-2020 12:47 AM
- Got Karma for How to divide the results of one search by the results of a second search?. 06-05-2020 12:47 AM
- Karma Re: Web Framework SearchManager to Token for ineeman. 06-05-2020 12:46 AM
- Karma Re: Pass variable to custom module template for btsay_splunk. 06-05-2020 12:46 AM
- Karma Re: How do you create custom modules for sideview. 06-05-2020 12:45 AM
- Karma Re: How do you create custom modules for dbrezinski. 06-05-2020 12:45 AM
- Karma Re: Added a large file and now "Daily indexing volume limit exceeded." for ftk. 06-05-2020 12:45 AM
- Posted Re: How to automate the deletion of some data in a CSV file before indexing? on Getting Data In. 03-11-2015 02:46 PM
- Posted Re: Splunk Dashboard on All Apps and Add-ons. 03-11-2015 02:37 PM
- Posted Re: help setting up Palo Alto Firewall to log to splunk securely (SSL / TLS) on All Apps and Add-ons. 03-11-2015 02:30 PM
- Posted Re: How to wait for the SearchManager job to finish? on Splunk Search. 11-04-2014 09:58 AM
- Posted Re: How to get more than 100 rows in web framework using Django binding? on Splunk Dev. 11-04-2014 09:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
03-11-2015
02:46 PM
I would recommend Python. From there you can create a scripted input that performs the operation at a specific time.
... View more
03-11-2015
02:37 PM
This is absolutely feasible. I would recommend downloading the web framework toolkit to get some background on search managers and the like.
Essentially you will create a search manager for each of your various forms, perform your business logic on myresults.data, then return it back to whatever splunk view you want.
Another good starting point for some background can be found here http://dev.splunk.com/webframework
I should note that you will need access to the server's file system.
... View more
03-11-2015
02:30 PM
You can set up a secure connection using the Splunk default certificates, self-signed certificates, or certificates signed by a third party. You could probably get by using the default certificates, but I would recommend following the process to self-sign the certificates.
A good place to start is http://docs.splunk.com/Documentation/Splunk/6.2.2/Security/AboutsecuringyourSplunkconfigurationwithSSL
... View more
11-04-2014
09:58 AM
1 Karma
Could you provide a little more insight?
myResults = new SearchManager({
id: "mysearch",
search: "mycustomsearch",
data: "results",
status_buckets: 300,
preview: true,
cache: false
}, {tokens: true}).data("results").on("data", function() {
... View more
11-04-2014
09:48 AM
This is similar to a problem I am having. I am looping through my result set, but it is only returning 100 results. Is this something I can change in the search manager.
this.parsesplunkRows = function() {
console.log("" + " " + splunkRows.length);
for(var i = 0; i<this.splunkRows.length; i++) {
this.splitString(this.splunkRows[i]);
}
... View more
08-21-2014
12:28 PM
As on my other post relating to this issue, there is a process for using scripts. The best way I found was to place them in the splunk bin, rather than the app bin. I decided to just take the stdout from the script, rather than use the text file. With that said, if you still wanted to use the text file, follow the procedure for running the script that outputs the file, then have splunk monitor the output file.
... View more
08-21-2014
12:26 PM
I just struggled with this and I determined the best to accomplish this task is to include the scripts in the $SPLUNK_HOME/bin/scripts folder. Visibility and permissions become a real pain when placing the scripts in a custom app folder.
... View more
08-21-2014
11:27 AM
I fixed the problem. To summarize:
I removed the batch script, because
the .path file essentially does the
same thing.
I placed the call to the
.path file in the input.config file
with the parameters I had listed.
I placed the .ps1 file and the
.path file in the
$SPLUNK_HOME\bin\scripts .
Once I realized that the .path file is essentially a one line batch script, I was able to make the call to powershell (must use an explicit path) and then issue the command. Once I knew everything was in the right place, I figured out that I had to include "-file" before making the call to the .ps1 file.
... View more
08-21-2014
07:22 AM
Actually, after looking, I had this stanza in input.conf:
[script://.\bin\mypathfile.path]
interval = 50
source = mypsscript.ps
... View more
08-21-2014
07:20 AM
how do I then get the script to run?
... View more
08-21-2014
06:02 AM
I have followed some documentation on adding inputs to from scripts, and have the following:
A batch script, which calls my powershell script (running the batch scripts executes the powershell script properly)
.path file located in myapp\bin
$SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe "D:\Program Files\etc\apps\myapp\bin\mypsscript.ps1"
app.conf file located in myapp\default with stanza
[script://D:\Program Files\etc\apps\myapp\bin\mypathfile.path]
interval = 50
source = mypsscript.ps1
However, I am not sure how to know whether or not this script is actually running. I don't think it is, because if I search for that source, it doesn't have any results. Is this configured properly? How do I ensure the script kicks off? Do I need to do anything else?
... View more
08-20-2014
07:57 AM
I have a powershell script that outputs a text file. What I want to do is have that powershell script run once a day and splunk to ingest the text file that has been generated by that powershell script whenever my app is opened. What is the most efficient way to do this?
I have toyed with a couple different ideas:
Put the powershell script on the forwarder, configuring it to run once a day, and configure splunk to monitor the directory where that file is output
Configure splunk to monitor a batch file that runs the powershell script (I don't think this will actually grab the text file that is generated)
... View more
08-19-2014
08:16 AM
1 Karma
I have two separate searches and would like to divide the results of the first by the second.
My first search is, which returns "3":
| set intersect [search source="test1.csv" | table Setting] [search source="test2.csv" | table Setting] | stats count(Setting)
And my second search is, which returns "5":
source="test1.csv" | table Setting| stats count(Setting)
I am looking to combine both searches to get ".6". I know how to do this with a more simple search that doesn't involve the intersection of two sources, but am not familiar with how to do it in this case.
... View more
08-05-2014
07:42 AM
1 Karma
I got it all, thanks for the help. I think calling it a developer console "view" is a poor use of words.... only because Splunk has views.
... View more
08-05-2014
05:53 AM
1 Karma
I'm going through the "create a custom view" tutorial, becasue I didn't have any luck with the custom module, and it tells me to open the developer console view, and navigate to demoview.html. Two questions: what is the developer console view and how do i navigate to demoview.html?
... View more
- Tags:
- django
07-29-2014
06:25 AM
I am making a custom module and cannot, for the life of me, figure out how the python script is working. I am using the Example 6 script as a guide and my main trouble is with this piece:
dataset = getattr(job, entity_name)[offset: offset+count]
outputJSON = {}
for i, result in enumerate(dataset):
tdict = {}
tdict[str(result.get('processor', None))] = str(result.get('value', None))
name = str(result.get('name', None))
if name not in outputJSON:
outputJSON[name] = dict()
outputJSON[name].update(tdict)
I can see what it is doing, but my results are much different than a simple table. I need a way of pulling out the first value in a table cell, then the second, etc. This script outputs a JSON array of
{name:foo, {processor1 : value}, {processor2:value}, {etc}} .
I need a JSON array of something more complex, like:
{
"name": "flare",
"children": [
{
"name": "analytics",
"children": [
{
"name": "cluster",
"children": [
{"name": "AgglomerativeCluster", "value": 3938},
{"name": "CommunityStructure", "value": 3812},
{"name": "HierarchicalCluster", "value": 6714},
{"name": "MergeEdge", "value": 743}
]
},
{
"name": "graph",
"children": [
{"name": "BetweennessCentrality", "value": 3534},
{"name": "LinkDistance", "value": 5731},
{"name": "MaxFlowMinCut", "value": 7840},
{"name": "ShortestPaths", "value": 5914},
{"name": "SpanningTree", "value": 3416}
]
},
{
"name": "optimization",
"children": [
{"name": "AspectRatioBanker", "value": 7074}
]
}
]
},
{
"name": "animate",
"children": [
{"name": "Easing", "value": 17010},
{"name": "FunctionSequence", "value": 5842},
{
"name": "interpolate",
"children": [
{"name": "ArrayInterpolator", "value": 1983},
{"name": "ColorInterpolator", "value": 2047},
{"name": "DateInterpolator", "value": 1375},
{"name": "Interpolator", "value": 8746},
{"name": "MatrixInterpolator", "value": 2202},
{"name": "NumberInterpolator", "value": 1382},
{"name": "ObjectInterpolator", "value": 1629},
{"name": "PointInterpolator", "value": 1675},
{"name": "RectangleInterpolator", "value": 2042}
]
In other words, I need to build a JSON object that is much more complex than a 1:1 mapping, like in this example. Does anyone have any ideas on how to complete this? I still haven't been able to figure out if things like tdict[str(result.get( is just a python thing, or a splunk thing.
... View more
07-15-2014
11:35 AM
I think I determined the problem. It seems if you have any errors in your JavaScript, they could (or could not) cause the module to improperly load!
... View more
07-15-2014
08:00 AM
I created a custom module, which shows up in http:..../modules but when loading the app, it says the module cannot be found.
I also have placed the module in the TreeMap1.conf file using className = Splunk.Module.TreeMap1.
The modules folder is called TreeMap1 and the JavaScript file is named TreeMap1.js.
Any ideas on why this isn't loading?
... View more
