I have been trying to fix this problem for for a week now for TLS 1.2 but nothing. Is there anybody out there who has successfully use send syslog from Palo Alto to Splunk with SSL/TLS? ... View more

To be more specific, I was running an array of search managers using the search:done listener and about 1 in 8 had no results when the query would otherwise produce them. This would also occur predictably and for the same queries. Changing the listener to results.on("data") solved the problem. ... View more

There are a few ways to solve this. One way is use use append to combine the two results into one result set and then use stats to isolate the data points you want. It is easier if we rename the counts before passing them to stats. I will use that approach below | set intersect [search source="test1.csv" | table Setting] [search source="test2.csv" | table Setting] | stats count(Setting) as dividend | append [ search source="test1.csv" | table Setting| stats count(Setting) as divisor ] | stats max(dividend) as dividend max(divisor) as divisor | eval quotient=dividend/divisor ... View more

Good comment, we will update the docs to clarify! ... View more

Not sure if I understood your question corrently, but (having already made a long reply, getting deleted by "You cannot include external links with this low karma" <insert cursing>, I'll make it short) All the function and methods used in your code snippet are from Python's built-in functions and types' methods. None of them are from Splunk's Python SDK. For reference, see: https://docs.python.org/2/library/functions.html (getattr(), enumerate(), str()) https://docs.python.org/2/library/stdtypes.html#dict.get As for how to form a more complex JSON object; you do exactly similar dictionary & list processing. JSON.dumps() converts python dictionaries { } to JSON objects, and python lists [ ] to JSON arrays. See https://docs.python.org/2/library/json.html#encoders-and-decoders for full details on how default JSON encoder/decoder works. ... View more

Hello , This is also my problem.I tried yours answers but its not working. ... View more