Reposting this in the correct area of the forum. I have made a Tech add on that polls an API. In order to perform requests against the API, an API key is required. I have used the following as the example in order to get the URL and the API key for the request saved onto Splunk: https://github.com/splunk/Developer_Guidance_Setup_View_Example The setup page is working as expected from that example, and am able to correctly populate data with it. After that, when I look at the app specific conf files ( ie /opt/splunk/etc/apps/TA-eg/local/ta_eg_settings.conf) Then I see that the api_key is starred out, ie encrypted at rest:   [additional_parameters] api_key = ******** eg_domain = <correct_plaintext_domain> disabled = 0   The following files are also present in /opt/splunk/etc/apps/TA-eg/local/: app.conf inputs.conf passwords.conf However if I attempt to use the python helper function get_global_setting("api_key") as defined in: https://docs.splunk.com/Documentation/AddonBuilder/3.0.2/UserGuide/PythonHelperFunctions Then it is always returning the string "undefined" as opposed to the correct API key that I added. In TA-eg/bin/TA_eg_rh_settings.py  I have also set encrypted = True for the correct field:   fields_additional_parameters = [ field.RestField( 'eg_domain', required=True, encrypted=False, default='', validator=validator.String( min_len=0, max_len=8192, ) ), field.RestField( 'api_key', required=True, encrypted=True, default='', validator=validator.String( min_len=0, max_len=8192, ) ) ]   Please help me figure out how to get the correct output of this encrypted at rest API key using the Splunk helper functions.   ... View more

My App is not showing up in Splunk Cloud. Yet I have uploaded the app to Splunkbase, and it passes all the Appinspect checks without any errors. This is the app in question: https://splunkbase.splunk.com/app/3980 ... View more

I am following the example in this github example: https://github.com/splunk/Developer_Guidance_Setup_View_Example In order to get the setup page of my Tech add on working correctly. The add-on previously used a setup.xml in the default folder which would take in a URL and API key. I have changed the add on to now use html, JS and CSS like the example suggests in the github link above. Once I have hit the `Submit` button i get presented with the above error whenever trying to navigate to the /inputs endpoint of my TA then the following error message comes up:   Internal configuration file error. Something wrong within the package or installation step. Contact your administrator for support. Detail: instance.pages.configuration.tabs[0].entity[1].type is not one of enum values: text,singleSelect,checkbox,multipleSelect,radio    Watching the logs on both the splunk side and the server side where the API call is being made. I see that the correct URL/domain and API key are being used because the request is going through correctly. Also looking in the corresponding config file like so:   cat etc/apps/TA-canary/local/ta_canary_settings.conf [additional_parameters] api_key = ******** canary_domain = <server_domain> disabled = 0   Which is all correct. Following the logs doesn't give any helpful output as to which field is incorrectly in the config files as not one of the following field types like the error says:   text,singleSelect,checkbox,multipleSelect,radio       ... View more

Hi  I am getting the following error on my application/dashboard: " Error in 'eval' command: The expression is malformed." The query that is being triggered is: | makeresults count=1 | eval id=$incident_id$| sendalert canary_acknowledge_incident param.incident_id=$incident_id$ param.index_name="main"   And this is getting triggered when a Submit Button is being clicked. The Submit button is tied to a Dropdown of values. The dropdown is populated with values and is defined as below: <input type="dropdown" token="incident_id" searchWhenChanged="false"> <label>Incident to Close</label> <fieldForLabel>id</fieldForLabel> <fieldForValue>id</fieldForValue> <search> <query>`canary_tools_index` sourcetype="canarytools:incidents" | stats values(id) as id| mvexpand id</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> </input> And running that drop down populating query using the Search tool gives information such as: incident:canarytoken:80f36193721b94fb268bb6df:<source_ip>:<epoch_timestamp> incident:canarytoken:80f36193721b94fb268bb6df:<source_ip>:<epoch_timestamp>   Looking at previous questions asked on this forum point towards the field names of the `eval` command not working whenever they start with a numeric character. But this is not the case in my issues as I am using : `eval id=$incident_id$`   This is happening on Splunk 8.0.0 ... View more