Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About breid1313
breid1313
Path Finder
Member since:
07-15-2020
01-15-2021
Community Statistics
| Posts | 16 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 07-15-2020 |
Activity Feed
- Posted Using standard node libraries in Splunk App on Splunk Dev. 01-14-2021 12:45 PM
- Tagged Using standard node libraries in Splunk App on Splunk Dev. 01-14-2021 12:45 PM
- Tagged Using standard node libraries in Splunk App on Splunk Dev. 01-14-2021 12:45 PM
- Tagged Using standard node libraries in Splunk App on Splunk Dev. 01-14-2021 12:45 PM
- Tagged Using standard node libraries in Splunk App on Splunk Dev. 01-14-2021 12:45 PM
- Tagged Using standard node libraries in Splunk App on Splunk Dev. 01-14-2021 12:45 PM
- Posted Re: Call to custom/eai endpoint from setup view on Splunk Dev. 12-14-2020 10:21 AM
- Posted Call to custom/eai endpoint from setup view on Splunk Dev. 12-14-2020 09:11 AM
- Tagged Call to custom/eai endpoint from setup view on Splunk Dev. 12-14-2020 09:11 AM
- Tagged Call to custom/eai endpoint from setup view on Splunk Dev. 12-14-2020 09:11 AM
- Tagged Call to custom/eai endpoint from setup view on Splunk Dev. 12-14-2020 09:11 AM
- Tagged Call to custom/eai endpoint from setup view on Splunk Dev. 12-14-2020 09:11 AM
- Posted Re: Splunk app configuration with setup view once is_configured is already set to True on Splunk Cloud Platform. 12-11-2020 10:05 AM
- Posted Re: Splunk app configuration with setup view once is_configured is already set to True on Splunk Cloud Platform. 12-11-2020 07:57 AM
- Posted Re: Developing Apps for Search Head Cluster Deployments on Splunk Dev. 12-08-2020 02:27 PM
- Got Karma for Re: How do I create a Splunk setup view?. 12-08-2020 01:39 PM
- Posted Re: How do I create a Splunk setup view? on Splunk Dev. 12-08-2020 01:38 PM
- Karma Re: How do I create a Splunk setup view? for thellmann. 12-08-2020 01:38 PM
- Karma Re: Update notable event with splunklib (splunk-sdk for python) for kchamplin_splun. 12-08-2020 12:33 PM
- Posted Re: How do I create a Splunk setup view? on Splunk Dev. 12-08-2020 12:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-14-2021
12:45 PM
Does anyone use standard node libraries in their splunk apps, for example 'util'? I'd like to use some of that functionality in an app, but am a little confused how to import that library within the context of Splunk and requirejs.
... View more
12-14-2020
10:21 AM
My goals could also be accomplished with a [script:] stanza as well. Since we are using a setup view now, all the configuration is done with the splunkjs SDK before the python script is called, so I don't necessarily need an eai endpoint. All I'm looking to do is test a connection to a third-party app using a custom endpoint. Same question applies here though. I've messed with the examples but get 404's through the js sdk using both a [script:] and [admin:]/[admin_external:] endpoint.
... View more
12-14-2020
09:11 AM
Hello all - I'm creating a setup view (migrating from setup.xml) for an app and would like to continue to leverage the custom eai python handler that is already in place. Can anyone point me towards an example of this? I may be using web.conf incorrectly as I can access the handler via port 8089 but when I attempt to call the endpoint from the setup view via the splunkjs sdk it generates a 404 error. Once I resolve this issue I believe I should be able to pass all the parameters necessary into data: {TODO} in order to use the eai handler the same way we were when using setup.xml app.js callScript(){
$.ajax({
type: "POST",
url: "/servicesNS/-/<app_name>/configureMyApp/handleConfig",
data: {TODO},
contentType: "application/json; charset=utf-8",
dataType: "json",
success: function(data) {
console.log("success returned");
console.log(data);
},
error: function(xhr){
console.log("Error ", xhr);
}
});
} restmap.conf [admin:configureMyApp]
match = /configureMyApp
members = handleConfig
[admin_external:handleConfig]
handlertype = python
python.version = python3
handlerfile = handler.py
handleractions = list, edit
handlerpersistentmode = false web.conf [expose:configureMyApp]
methods = GET, POST
pattern = configureMyApp
[expose:handleConfig]
pattern = configureMyApp/*
methods = GET, POST
... View more
12-11-2020
10:05 AM
@assadabbas this may be helpful to us! https://community.splunk.com/t5/Developing-for-Splunk-Enterprise/How-to-call-a-python-script-from-an-html-view/m-p/262037
... View more
12-11-2020
07:57 AM
I have a similar situation to yours that I am trying to figure out. We are moving from using default/setup.xml to using setup views. Once the setup view captures the input from the user, I would like to be able to then trigger our existing handler python file to finish the necessary actions. Not quite sure how to accomplish this yet though.
... View more
12-08-2020
02:27 PM
Hey @thellmann , Appreciate the info! We are already making changes to conf files via the REST API, so should be all set there. The app (actually an add-on) is pretty simple. We take input from the user (currently via setup.xml and soon to be a setup view) and save the configuration values via the REST API (using Splunk Python SDK soon to be Splunk JS SDK). We also have a modalert script that sends splunk search data or notable event data to a 3rd party app when a saved search is matched.
... View more
12-08-2020
12:20 PM
Thank you to all at Splunk for the helpful Developer Guidance - Setup View app. The concise and simple example is extremely helpful. I am converting an app from using default/setup.xml to using a setup view. When I make changes to the HTML template in the example app and restart splunk, the changes do not appear in the setup page. Am I missing a step to get the HTML template to render with the new content? Changes to the xml dashboard do take as soon as a restart splunk though 🙂 Thanks in advance. @thellmann @lknecht_splunk
... View more
12-04-2020
11:36 AM
Hi all, We currently have an Splunk add-on that is cluster-naive and would like to convert it to be able to be deployed on a Search Head Cluster. I have been able to location information packing apps for clusters so far. Is packing the only stage of development where we need to consider a clustered environment, or are there steps that need to be taken earlier in app development in order to ensure the app is deployable on a cluster? Thank you for the input.
... View more
11-04-2020
12:33 PM
Hi all, I'm wondering if anyone has had success updating notable events using the Splunk SDK for Python (splunklib). I've seen a few examples of how to get it done with the splunk python package (for example https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-edit-notable-events-in-es-programatically.html), but I'd prefer to leverage the Python SDK. I've formatted the POST request every way I can think of, but I can't get a proper request to the server. I always get the error: ``` splunklib.binding.HTTPError: HTTP 400 Bad Request -- b'"ValueError: One of comment, newOwner, status, urgency is required."' ``` I am passing a `comment` argument, but it must be doing it incorrectly.
... View more
10-22-2020
08:48 AM
@tuckcodes have a look at this. Hope it helps! https://github.com/breid1313/splunk-docker
... View more
10-22-2020
08:15 AM
@tuckcodes I have something hacky working that I can generalize and push to github if you're interested. It's a docker-compose setup that creates a new slave server off a master license server we have running remotely. It's pretty convenient for quick testing or to more closely replicate someone else's environment.
... View more
07-16-2020
08:17 AM
Did you find a solution to this? I'm looking to do the same and avoid opening up a terminal in the container to manually change the python version.
... View more
07-15-2020
03:38 PM
1 Karma
I have also tried to copy /opt/splunk/etc/ and /opt/splunk/var/ to my local file system and mount them into a new container with the below command: docker run -it \
-p 8000:8000 \
-e "SPLUNK_START_ARGS=--accept-license" \
-e "SPLUNK_PASSWORD=securePassw0rd" \
-v /local/path/etc/:/opt/splunk/etc \
-v /local/path/var/:/opt/splunk/var \
splunk/splunk but ansible still fails to provision the new server TASK [splunk_common : Start Splunk via CLI] *********************************************************************************************************************************************************************************************************************************
fatal: [localhost]: FAILED! => {
"changed": false,
"cmd": [
"/opt/splunk/bin/splunk",
"start",
"--accept-license",
"--answer-yes",
"--no-prompt"
],
"delta": "0:00:16.962175",
"end": "2020-07-15 22:28:05.187999",
"rc": 10,
"start": "2020-07-15 22:27:48.225824"
}
STDOUT:
Splunk> Take the sh out of IT.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
STDERR:
homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
MSG:
non-zero return code
... View more
07-15-2020
01:29 PM
Hi all, I'm leveraging the splunk/splunk:8.0.4.1 image for some development. At this time, I've pulled the splunk/splunk image, and configured it according to my needs. I now want to commit that container to save it as a new image, so that I have a baseline container to fall back on and start. However, my newly saved image fails to start when I perform a `docker run`. I've checked the original container for the `cacert.pem` file in question and it does exist. Since the new image I'm attempting to start is essentially a clone of the running container, I'm surprised that it fails to start. Is this a use case that can be achieved with the splunk/splunk image? Thank you. ```
TASK [splunk_common : Start Splunk via CLI] ************************************
fatal: [localhost]: FAILED! => {
"changed": false,
"cmd": [
"/opt/splunk/bin/splunk",
"start",
"--accept-license",
"--answer-yes",
"--no-prompt"
],
"delta": "0:00:01.506092",
"end": "2020-07-15 19:59:26.957025",
"rc": 1,
"start": "2020-07-15 19:59:25.450933"
}
STDOUT:
Splunk> Take the sh out of IT.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Creating: /opt/splunk/var/lib/splunk
Creating: /opt/splunk/var/run/splunk
Creating: /opt/splunk/var/run/splunk/appserver/i18n
Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css
Creating: /opt/splunk/var/run/splunk/upload
Creating: /opt/splunk/var/run/splunk/search_telemetry
Creating: /opt/splunk/var/spool/splunk
Creating: /opt/splunk/var/spool/dirmoncache
Creating: /opt/splunk/var/lib/splunk/authDb
Creating: /opt/splunk/var/lib/splunk/hashDb
STDERR:
The CA file specified (/opt/splunk/etc/auth/cacert.pem) does not exist. Cannot continue.
SSL certificate generation failed.
MSG:
non-zero return code
PLAY RECAP *********************************************************************
localhost : ok=43 changed=6 unreachable=0 failed=1 skipped=44 rescued=0 ignored=0
```
... View more
Labels
- Labels:
-
app
