Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About rshoun
rshoun
Explorer
Member since:
03-20-2017
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 4 |
| Member Since | 03-20-2017 |
Activity Feed
- Got Karma for We are trying to make a REST input and the result is XML data but it has no schema.. 06-05-2020 12:48 AM
- Got Karma for Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer?. 06-05-2020 12:48 AM
- Got Karma for Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer?. 06-05-2020 12:48 AM
- Got Karma for Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer?. 06-05-2020 12:48 AM
- Karma Re: Field Extraction Not Showing Up for MuS. 06-05-2020 12:47 AM
- Karma Re: How do I submit a ticket to support? for lukejadamec. 06-05-2020 12:46 AM
- Posted We are trying to make a REST input and the result is XML data but it has no schema. on Getting Data In. 03-30-2017 05:50 PM
- Tagged We are trying to make a REST input and the result is XML data but it has no schema. on Getting Data In. 03-30-2017 05:50 PM
- Posted What do you experienced folks recommend in order to really know everything about Splunk? on Splunk Dev. 03-29-2017 07:41 PM
- Tagged What do you experienced folks recommend in order to really know everything about Splunk? on Splunk Dev. 03-29-2017 07:41 PM
- Tagged What do you experienced folks recommend in order to really know everything about Splunk? on Splunk Dev. 03-29-2017 07:41 PM
- Tagged What do you experienced folks recommend in order to really know everything about Splunk? on Splunk Dev. 03-29-2017 07:41 PM
- Posted Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 12:41 PM
- Posted Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 12:33 PM
- Posted Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 11:39 AM
- Posted Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 11:37 AM
- Posted Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 10:01 AM
- Posted Re: Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 09:22 AM
- Posted Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 07:08 AM
- Tagged Can someone help me parse this XML into Splunk on the backend? Also should I add this to the props.config in my Deployment Server or my Search Head Deployer? on Getting Data In. 03-20-2017 07:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 1 |
03-30-2017
05:50 PM
1 Karma
We are trying to make a REST input and the result is XML data but it has no schema. The Source we are using is the Palo Alto, specifically Panorama, not the firewalls directly. Can someone help me create an XML schema??? (I have been stuck on this for a while!) Is there a way to manually build a schema in splunk for this input?
... View more
- Tags:
- splunk-enterprise
03-29-2017
07:41 PM
I just purchased the Building Splunk Solutions Book for one resource and I really want to get into the Dev Side of Splunk but as I am slowly introducing myself to this area, what IDE's or potential open-source resources to you all recommend in order to really get your hands into developing Splunk Apps? (Other than Google) I am assuming Python is the best language for this? Any suggestions or input?
... View more
03-20-2017
12:41 PM
1 Karma
Oh okay! That makes more sense! Geeze, I am really glad you are here! Thank you so much!
... View more
03-20-2017
12:33 PM
I just thought of something, will I need to add all of my XML (all the code above: ie: "[monitor:", etc. - all my XML extracted fields) to the props.conf Master Node Indexer as well? Or I just need to add the KV_MODE =1 to my Master indexer correct? I should not need to add everything else here or am I wrong? (Please let me know if my question does not make sense to you.)
... View more
03-20-2017
11:39 AM
Wow, you have been an outstanding resource! I will do this! Thank you sooo much for adding this extra content!
... View more
03-20-2017
11:37 AM
1 Karma
We have 7 search peers in our index cluster, if you count the index cluster master. The dev environment idea is actually a really good idea. I will see if I can get my team on board with this. I absolutely agree with the dev environment idea but not everyone will always understand the logical need for this. In the meantime, your idea of doing of local Splunk download is actually a really good idea! Thank you for your help!
... View more
03-20-2017
10:01 AM
Dang it. I knew a restart was going to be necessary. Should I restart all places where my props.conf and inputs.config are located as well or just the place where the index KV_MODE =1 will be applied?
... View more
03-20-2017
09:22 AM
I was wondering if that was the problem! Let me try the KV_MODE =1 and then I will see if that corrects the issue. Thanks!
... View more
03-20-2017
07:08 AM
1 Karma
Here is what I have tried and it is not working:
Edit the local/inputs.conf file and add this:
[monitor:///directory/*.xml]
sourcetype = panorama:api:templates
index = qt_palo
crcSalt = Belton Palo-Templates
alwaysOpenFile = 1
disabled = false
[monitor:///directory/*.xml]
sourcetype = panorama:api:templates
index = qt_palo
crcSalt = Tulsa Palo-Templates
alwaysOpenFile = 1
disabled = false
[monitor:///directory/*.xml]
sourcetype = panorama:api:devicegroups
index = qt_palo
crcSalt = Belton Palo-Templates
alwaysOpenFile = 1
disabled = false
[monitor:///directory/*.xml]
sourcetype = panorama:api:devicegroups
index = qt_palo
crcSalt = Belton Palo-Device Groups
alwaysOpenFile = 1
disabled = false
Create a local/props.conf file and add this:
[panorama:api:templates]
EXTRACT-Status = (?i)<response status>(?P<Status>[^<]+)
EXTRACT-Name = (?i)<entry name>(?P<Name>[^<]+)
EXTRACT-TemplateStack = (?i)<template-stack>(?P<TemplateStack>[^<]+)
EXTRACT-EntryName = (?i)<entry name>(?P<EntryName>[^<]+)
EXTRACT-Serial = (?i)<serial>(?P<Serial>[^<]+)
EXTRACT-Connected = (?i)<connected>(?P<Connected>[^<]+)
EXTRACT-UnsupportedVersion = (?i)<unsupported-version>(?P<UnsupportedVersion>[^<]+)
EXTRACT-LastCommitAllStateTPL = (?i)<last-commit-all-state-tpl>(?P<LastCommitAllStateTPL>[^<]+)
EXTRACT-LastValidateAllStateTPL= (?i)<last-validate-all-state-tpl>(?P<LastValidateAllStateTPL>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
EXTRACT-Connected = (?i)<XMLtagInRawEvent1>(?P<YourXMLExtractionName1>[^<]+)
... View more
