This worked! ... View more

Thanks for this post. I tried for my scenario and it works. I was looking for extracting disabled status from the alerts and I used parseString instead of parse and "response.text" is the POST response. Example: response=request.post(http://xxx.x.x.x:8089/servicesNS/nobody/search/saved/searches/$ALERT$/disable) import xml.dom.minidom dom=xml.dom.minidom.parseString(response.text) keys=dom.getElementsByTagName('s:key') for n in keys: if n.getAttribute('name') == 'disabled':    Status=print(n.childNodes[0].nodeValue) ... View more

Look like it could be a splunk role permission issue. Check if you are member of the "admin" role and of the "itoa-admin" role, and make sure that some of their default capabilities were not removed, Verify that ITSI teams have the proper roles listed under. The other possibility is that the path of $SPLUNK_HOME on the 2 environments are different, and the backup is looking for a folder path that does not exist/is not accessible ? ... View more

Solution is provided here- https://answers.splunk.com/answers/548703/why-are-mailserver-settings-in-alert-actionsconf-n.html? from my observation if we save it through UI the savedsearch.conf of the app/local gets updated with action.email.mailserver = localhost (bug when edited from ui) instead in order to use the provided settings in email settings which is stored in alert_actions.conf in /etc/system/local you can either overwrite the ction.email.mailserver = in savedsearch.conf from command line or comment it and use the updated one from alert_actions.conf ... View more

That was a fun one! | makeresults | eval raw="Project_a,Sprint_1,5 Project_a,Sprint_2,10 Project_a,Sprint_3,4 Project_a,Sprint_4,3 Project_b,Sprint_1,20 Project_b,Sprint_2,3 Project_b,Sprint_3,5 Project_b,Sprint_4,4 Project_c,Sprint_1,4 Project_c,Sprint_2,8 Project_c,Sprint_3,4 Project_c,Sprint_4,5" | makemv delim=" " raw | mvexpand raw | rename raw AS _raw | rex "^(?<Project>[^,]+),(?<Sprint>[^,]+),(?<points>.*)$" | fields - _* | rename COMMENT AS "Everything above should be replaced with your 'Query-1'" | eval Sprint_and_points = Sprint . ":" . points | stats list(Sprint_and_points) AS Sprint_and_points BY Project | append [| makeresults | eval Sprint="Future_1 Future_2" | makemv Sprint | mvexpand Sprint | fields - _* | rename COMMENT AS "Everything inside of this append should be replaced with your 'Query-2'"] | eventstats list(Sprint) AS Sprints | where isnull(Sprint) | eval Sprint = mvappend(Sprint_and_points, Sprints) | fields Project Sprint | mvexpand Sprint | rex field=Sprint "^(?<Sprint>[^:]+):(?<points>.*)$" ... View more

Thank you DalJeanis I tried with this too and it worked and it has the step function with window to change the step in any case. | sort - sprintstartDate | streamstats last(sprintstartDate) as next_sprintstartDate window=1 current=f | sort sprintstartDate | eval next_sprintstartDate=if(isnull(next_sprintstartDate),now()),next_sprintstartDate) ... View more