This worked for me, thanks a lot! Note: the extension of my certificate file was .crt by default. Also, once the certificate expires, you'll have to update this piece of code. ... View more

Same issue on 8.1.4 ... View more

Thanks @isoutamo  I have tested this a bit and I do not get any searches that has ttl = 0. Maybe I just haven't encountered that case yet in my testing. ... View more

We have the same problem. We store a list of items in a row in the search that is used to create a pie chart. The end of the search looks as follows: | streamstats count as Count, values(ITEM_ID) as ITEM_list by DEPT | dedup DEPT sortby -Count | table DEPT, Count, ITEM_list The pie chart draws correctly, using DEPT as fields and Count as counts for the chart. In the drilldown, we set: <set token="ITEM_list">$row.ITEM_list$</set> The idea is to use the ITEM_list token in a subsequent search. This technique works perfectly with bar charts, but the drilldown for the pie chart does not set the token as required. I think this is a functionality that does not work in the pie chart. ... View more

Thanks @venkatasri  On our DEV server this would be easy to solve,  I could change the max_rows_per_query parameter in limits.conf. On our production environment, we are tenants on a multi-tenant platform, so we do not have access to the configuration files. The approach I took here is to make use of the skip parameter that is available in the query function. I can then have a loop that runs through the entire kv store by incrementing the skip parameter: while end == False: data_list = collection.data.query(skip=skip_tracker) if len(data_list) != 0: for item in data_list: # perform action on entry in kv store (delete, update etc.) skip_tracker += 50000 else: end = True  More details on the query function here: https://github.com/splunk/splunk-sdk-python/blob/13f07cd08f8b2017c1cdafc2fbc75673013dc713/splunklib/client.py#L3633  ... View more

@atayarani_impri  This problem typically occurs when the name of the custom command does not match the name defined in the sendemail.py file. I encountered this when I made a copy of the default sendemail.py file to make our own custom sendemail command. I named the new command newsendemail (with the file newsendemail.py).  In the file newsendemail.py, there is a piece of code:   sendemailRegex = r'\|\s*sendemail' if (re.findall(sendemailRegex, searchToRun)): parameters['input-search'] = re.split(sendemailRegex, searchToRun)[0] parameters['et'] = jsonJob.get('earliestTime') parameters['lt'] = jsonJob.get('latestTime') else: raise PDFException("Can't attach PDF - ssName and pdfViewID unavailable")   This is where that error is generated. For us, I had to change the  r'\|\s*sendemail' part to r'\|\s*newsendemail' The regex is searching for 'sendemail' in the search query, but the name of the custom command has been changed to 'newsendemail', so the regex needs to be updated. The error occurs if the regex does not find anything in the search query. ... View more

I have been trying to get this right for a while.  I used to make use of this format: <eval token="earliest_epoch">if(isnum($p2_period.earliest$),$p2_period.earliest$,relative_time(now(),$p2_period.earliest$))</eval> I had that code in a dummy search that would run when I hit the "Submit" button, and in the <change> tag for the time input.  This seemed to work well, until it stopped working (we upgraded to Splunk 8 from 7 and I think this is when it stopped working. This is reported here as well, the problem revolves around the isnum check: https://community.splunk.com/t5/Splunk-Enterprise/xml-Check-if-a-value-is-a-number/m-p/554255#M5996 ) I eventually decided to go over to javascript to solve this. I now have the following code in the "submit" event (gets triggered on the "Submit" button click): service.oneshotSearch("| makeresults | eval time=\"" + earliest_time + "\" \ | append [ | makeresults | eval time=\"" + latest_time + "\"] \ | eval time_e = if(isnum(time),time,relative_time(now(),time))" , { output_mode: "JSON" }, function (err, results) { if (err) { console.error(err); } else { earliest_time_e = results.results[0]['time_e'] console.log(earliest_time_e ); latest_time_e = results.results[1]['time_e'] console.log(latest_time_e ); var now_time_e = Math.round(Date.now()/1000) var diff_time_e = now_time_e - earliest_time_e //set any tokens needed mvc.Components.getInstance('submitted').set('earliest_time_e',earliest_time_e ); // rest of code....... } }});   The oneShotSearch executes this type of search (this one adds an eval to produce a 2 week plus and 2 week minus time as well): | makeresults | eval time=1620079200 | append [ | makeresults | eval time=1622671200] | eval time_e = if(isnum(time),time,relative_time(now(),time)) | eval time_min_2w = relative_time(time_e,"-2w") | eval time_plus_2w = relative_time(time_e,"+2w")    In this way you can to any type of time manipulation and set your tokens, allowing a lot of flexibility. ... View more

@weidertc I'm seeing the same thing. It used to work for me as well, now it has stopped working. We upgraded to Splunk 8.1.0 from Splunk 7 recently, it might have something to do with this..?   UPDATE: I described the approach I took to address this here: https://community.splunk.com/t5/Splunk-Search/Convert-timepicker-token-to-epoch-time-for-eval-regardless-of/m-p/425185/highlight/false#M121916  ... View more

Hi javiergn Can you maybe give some technical detail on why subsearches are expensive in terms of performance? Is the performance cost simply equal to doing that search on its own? ... View more

This solution worked for me, thanks! Details on the  replicate = true flag is here: https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Collectionsconf  ... View more

After getting stuck with this problem for many hours, I have also determined that the tstats latest command does not support milliseconds. It seems the milliseconds are recoded in the tsidx file (in the _time field), however when we make use of the tstats latest command, the records are only searched on second resolution, not millisecond. The result is that numerous of our events that occur in the same second (at different milliseconds) and considered to have occurred simultaneously, resulting in inconsistent results for the latest command. ... View more