About Neeraj_Luthra

Neeraj_Luthra · ‎07-08-2013

There doesn't seem to be anything wrong with the code. I tried it (on apache) and it worked just fine. Due to Same Origin Policy issues, you do need to set up a proxy for node to handle the requests to Splunk's REST APIs, i.e. on port 8089. For example, on apache, I have modified its httpd.conf file as follows: SSLProxyEngine On ProxyPass /proxy/ https://localhost:8089/ This works in the SDK examples for you because the examples are shipped with special handling for the "/proxy" requests.

Neeraj_Luthra · ‎07-03-2013

< results preview='1'/> means there are no events that match that search criteria. It is surprising that you notice events when you look at it from Jobs from the UI. follow.py example uses 'rt' for both earliest and latest time boundaries. Can you try and run the same search ( index=_audit action=search ) from the UI with time dropdown set to All time (real-time) and see whether that returns any events?

Neeraj_Luthra · ‎07-02-2013

We are working on a fix and will have a new version of the JS SDK out soon. I dont know of any workaround. If you can downgrade, it should work with 0.8 without issues.

Neeraj_Luthra · ‎07-02-2013

What version of Splunk and Node are you running? Keep in mind that there is a known issue with 0.10 version of Node.

Neeraj_Luthra · ‎06-24-2013

Manager -> Access Controls -> Users should show all the users granted you are logged in with the appropriate user. Try logging in with admin and see if the users you created show up. For getting the roles that a user is tied to, refer to the code sample at http://dev.splunk.com/view/SP-CAAAEJ8#listusers.

Neeraj_Luthra · ‎06-21-2013

I don't think 4.x supports these but with 5.x and higher, following 2 URLs can be used from the browser for a quick check. https://localhost:8089/services/search/jobs/oneshot?search=search%20index%3D_internal%20head%201 OR https://localhost:8089/services/search/jobs/export?search=search%20index%3D_internal%20head%201

Neeraj_Luthra · ‎06-19-2013

Agreed. We have this documented for our Java and C# SDKs but we need to port this information into other SDKs as well.

Neeraj_Luthra · ‎06-18-2013

There are a few dispatch specific arguments you can pass like bucket , max_count , earliest_time etc. You can get the full list at savedsearches.conf. The parameters that you are trying to use are substituted slightly differently. Here is an example ... Sample saved search query with host as one of the parameters that I want to substitute at runtime: index=fooindex sourcetype=foosourcetype host=$args.host$ Sample JS code to dispatch with argument substitution: mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) { You can bind multiple parameters in the call above depending on your need. Remember to specify args along with your parameter name as mentioned above.

Neeraj_Luthra · ‎06-17-2013

The 502 gateway error almost seems like something to do with your network setup, although it doesn't explain the "incorrect responses" for realtime command. Are you able to post the code you are using for the 2 issues you are running into?

Neeraj_Luthra · ‎06-13-2013

All the end points are available on Splunk docs at http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTlist. A couple that you might find useful from this list - saved/searches/{name} and search/jobs/{search_id}/results . We also have SDKs in 6 different languages. They make it much easier to hit these endpoints and get data from searches and reports from Splunk. You can can find more about the SDKs at http://dev.splunk.com/view/sdks/SP-CAAADP7.

Neeraj_Luthra · ‎05-23-2013

What specific issues are you running into? Can you provide more detail? Feel free to email me directly and I would be happy to look into it.

Neeraj_Luthra · ‎05-21-2013

Ayn is right. You should be connecting to port 8089, the default management port. 8000 is the web port that UI uses.

Neeraj_Luthra · ‎05-20-2013

First - Confirm from Splunk UI that the license is correctly added. Second - Are you logging in with default credentials - admin/changeme? By default, Splunk doesn't allow remote login with default password.

Neeraj_Luthra · ‎05-09-2013

@andras_kerekes - What version of Splunk are you running? Would you mind posting a new question with more details of how you are building the results reader object.

Neeraj_Luthra · ‎05-01-2013

Verified that this is an issue specific to OpenJDK. The Splunk Java SDK works fine against Oracle's JDK. Until this is fixed in the SDK, check the job's resultsCount and build the results reader only if the count is greater than 0.

Neeraj_Luthra · ‎05-01-2013

You either need to install the splunk-sdk using easy_install or pip OR make sure you have PYTHONPATH variable defined pointing to the sdk folder you just cloned. More details on how to install are available at http://dev.splunk.com/view/SP-CAAAEDG.

Neeraj_Luthra · ‎05-01-2013

The search query string, when used from Java SDK needs to have special characters like backslash ( \ ) properly escaped. After working more with @cwilen we learnt that lack of escaping these characters was causing this problem. Lesson learned: The search query string that works in Splunk UI may not work as-is from the SDK if it has special characters that need escaping.

Neeraj_Luthra · ‎04-17-2013

I assume you are referring to the cross-domain paragraph. The MAMP httpd.conf should have these lines, SSLProxyEngine On ProxyPass /proxy/ https://localhost:8089/ And after you restart MAMP, it should proxy the requests for Splunk correctly. Did you have the port defined in httpd.conf? Try the lines above and see if it works (assuming your Splunk is running locally on default ports, i.e. 8000 for UI and 8089 for management)

Neeraj_Luthra · ‎04-17-2013

Leave the proxy to be "/proxy" as that matches your conf changes in MAMP's httpd.conf. The location you copied xml2json to is incorrect. You need to place it inside the etc/apps folder on the server. Also, if you are using MAMP to serve the examples, you don't really need node at all.

Neeraj_Luthra · ‎04-17-2013

@preetigarg21 - I believe you posted the same question on github. I will update this post based on the findings in that thread.

Neeraj_Luthra · ‎04-17-2013

I believe we are helping you through the support case. We will update this post once we are able to resolve your issue with the findings from that case.

Neeraj_Luthra · ‎04-17-2013

It should honor the fields specified in the query string after the table keyword. If possible, try to run the query through cURL and see whether you get the desired results. Nonetheless, you can pass the list of fields explicitly to the getResults method on the job, once its done. JobResultsArgs resultArgs = new JobResultsArgs(); resultArgs.setFieldList(new String[] {"field1", "field2"}); InputStream results = job.getResults(resultArgs);

Neeraj_Luthra · ‎04-17-2013

@guilhem - What error are you running into? Assuming that you are using node v0.8.x.

Neeraj_Luthra · ‎04-11-2013

I am not sure what the problem is. Can you clarify further? Is the order in Java different from what your query is specifying after the table keyword?

Neeraj_Luthra · ‎04-04-2013

Please be more specific. It is the exact same question as you posted yesterday - http://splunk-base.splunk.com/answers/81924/send-search-result-as-http-post.

Posts	100
Solutions	14
Karma Given	3
Karma Received	41
Member Since	‎08-02-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Logging into Splunk SDK gives 404 error

Re: Real time search of _audit using Python SDK

Re: Can't login via Splunk Javascript API

Re: Can't login via Splunk Javascript API

Re: Where to find a list of users in Splunk web.

Re: accessing saved report data in json/xml from S...

Re: How to dispatch a saved search with parameters...

Re: How to dispatch a saved search with parameters...

Re: 502 Bad Gateway with Create Oneshot in Ruby SD...

Re: accessing saved report data in json/xml from S...

Re: C# SDK examples

Re: Does Splunk free license allow usage Splunk ja...

Re: Does Splunk free license allow usage Splunk ja...

Re: Splunk Java SDK -> com.splunk.ResultsReaderJso...

Re: Splunk Java SDK -> com.splunk.ResultsReaderJso...

Re: How to install SDK for Python and resolve erro...

Re: Splunk SDK search with aggregates returns zero...

Re: Javascript SDK internal server error

Re: Javascript SDK internal server error

Re: How to install SDK for Python and resolve erro...

Re: Splunk SDK search with aggregates returns zero...

Re: Order of fields in json java

Re: Not able to connect to splunk using javascript...

Re: Order of fields in json java

Re: Search results send as HTTP POST automatically