Hello, Is the IT essentials work app able to provide all the functionalities that the now deprecated splunk app for windows infraestructure did? In detail, we use the former to alert when a user has group membership changes in Active Directory for specific groups. The data we use for this comes from the WinEventLog:Security source. Thanks. ... View more

Hello, We have an oracle database schema with mutiple tables. All these tables have a column called idversion, and each has a view that shows only the version that was specified into the table sesio_te. So the expected way to work with these tables is to INSERT INTO "XXXX"."SESIO_TE" (sessionvalue, usuario, version_actual) VALUES ('test version', 'splunk', 21)  and then SELECT * FROM "XXXX"."PRESU_IN_AUD_VI" WHERE ... What I want to achieve is a dashboard that shows some data in these tables on demand from the DB. Not indexed data. So if I have multiple users watching this dashboard and they are asking for different versions I need to update the version before quering the views. But if you try to do   INSERT INTO "XXXX"."SESIO_TE" (sessionvalue, usuario, version_actual) VALUES ('test version', 'splunk', 21); SELECT * FROM "XXXX"."PRESU_IN" WHERE ... ; in the same dbxquery command it fails saying java.sql.SQLSyntaxErrorException: ORA-00933: SQL command not properly ended. Any ideas how to do this? Thank you in advance.   ... View more

I have a custom web app in angular where the user logs in via LDAP. The app shows splunk dashboards to the user. The problem is that when users log in this custom web app and navigate to splunk's dashboards, the login interface is displayed instead. Once the user logs in splunk (with the same credentials), everything works fine. The idea is to preemptively log in the user to  the splunk web server so that this doesn't happen. Maybe a REST call or curl command can return the required session to the browser? Any help is appreciated. Thank you. ... View more

What i am trying to accomplish is forcing the scheduler to dispatch a scheduled saved search throgh REST in order to update it's cached results. here's what i have working so far: 1 scheduled report with search: | makeresults Count=1 | eval embed = "embeded report" | eval argumento = $args.argument$ | table embed, argumento   Then I execute: curl -k -u admin:pass https://localhost:8089/servicesNS/admin/Admin_Tools/saved/searches/embed_report/dispatch -d args.argument=1 And get the response: <?xml version="1.0" encoding="UTF-8"?> <response> <sid>admin__admin_QWRtaW5fVG9vbHM__RMD5e57d89b9c983845a_at_1609434492_13436</sid> </response> With the sid i can see that the argument was passed correctly: curl -k -u admin:pass https://localhost:8089/services/search/jobs/admin__admin_QWRtaW5fVG9vbHM__RMD5e57d89b9c983845a_at_1609434492_13436/results <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder> <field>embed</field> <field>argumento</field> </fieldOrder> </meta> <result offset='0'> <field k='embed'> <value><text>embeded report</text></value> </field> <field k='argumento'> <value><text>1</text></value> </field> </result> </results> The thing is i want to have this report embbeded in a web app. From this app, perform a request to the REST API with this argument and have the embbeded report updated. However, the embbeded report shows the last cached results which are saved in a job with a name like: scheduler__nobody_XXXX-XXXX-XXXXXX Any ideas how this can be achieved? Thank you. ... View more

Hello, We have a simple XML dashboard in our splunk implementation which works fine when browsing splunk web. We embedded this dashboard in another web through an iframe like follows:   <iframe src="https://Splunk-Server:8000/account/insecurelogin?username=USER&password=PASWROD&return_to=/app/My-App/Dashboard-to-embed"></iframe>   This works fine on firefox, but chrome doesn't load it. We suspect that chrome is blocking the iframe contents because it won't load splunk's cookies in a third-party web-page, as per this article: https://blog.heroku.com/chrome-changes-samesite-cookie In short, we don't know how to configure splunk's cookie flags to allow them being loaded cross-domain. (SameSite=None, Secure) Or really, if this is the problem at all... We would apreciate any help you can provide. Thank you. ... View more