Hi all, I have developed an app that has a custom dashboard. On that custom dashboard, I am using Splunk's JavaScript Web Framework to run my custom searches that call our external REST API and then the dashboard is rendered using results returned from those searches. Specifically, I'm using the Search Manager to define and process results from my searches. The code structure that I'm following for each search is as follows:   var phishInc = new SearchManager({ id: "phishing_inc", preview: true, cache: true, search: "| snxusers stat=phishing_breakdown globalFilterValue=$globalFilterValue$" }, {tokens: true}); phishInc.on('search:failed', function(properties) { }); phishInc.on('search:progress', function(properties) { }); phishInc.on('search:done', function(properties) { }); var phishing_inc_search = splunkjs.mvc.Components.get('phishing_inc'); var phishing_inc_results = phishing_inc_search.data("results", {count: 0, output_mode: 'json_rows'}); phishing_inc_results.on("data", function () { // The data from the search is processed here });   $globalFilterValue$ is a token that I have defined whose value I set from a drop-down menu. Whenever I set its value, my searches are triggered automatically as I have set tokens: true  Now I have observed that for a single search only, the results are returned pretty quickly but when I define all of my searches  (total = 15) their times add up and the complete dashboard is rendered slowly. Since all of those searches depend on the globalFilterValue token, they are probably running in a sequential manner due to which the last parts of the dashboard are rendered at the end. Is there any way to speed up the execution of all these searches by somehow running them in a parallel fashion? Does Splunk JavaScript Web Framework allow any such possibility? ... View more

Hi Dear Splunkers, I am trying to develop a Modular Input for our REST API which will ingest some data from our API through a python script implementation. The idea is simple. The modular input will poll our REST API after some interval, fetch the data, and index it into Splunk. However, I am confused about the concept of single-instance and multiple-instance modular inputs. What I have understood is that single-instance modular inputs can be configured only once by the user and there is only one instance of the python script running at any point. Our API has the same type of data so there is no need for the user to configure multiple inputs otherwise, as the same data will be duplicated and indexed by Splunk which will be wasteful, I believe. Can someone explain to me the major difference between both types in easy terms, and also suggest which type of modular input I should create for my use case? Thanking you all for taking the time to read this. Regards! ... View more

I have written my own custom generating command in Splunk which connects to our API and fetches threat details of a domain/ip. The syntax of the command is as follows: | snxhostreputation host= e.g. snxhostreputation host=www.google.com This command generates one event for one domain but what I want to achieve is that, I should be able to pass multiple domains to this generating command and correspondingly generate events on each request to the API. The intended use-case is that users should be able to pass all domains present in their log data and get the information in the form of events. Now, as the generating command must be the very first command in a search, I cannot use any other command behind it to pass it data. What can I do to achieve my use-case? So far, I have considered changing it to a streaming search command but I am not sure how would I achieve the same there as I also want the command to work for a single value as well as a list of values. Any tips to achieve this? ... View more