About krishna_11

krishna_11 · ‎11-02-2020

Hi @alonsocaio I have been testing and it looks like your solution worked like a charm. Thank you so much for this amazing solution. Greatly appreciate it. I have been trying for quite some time and could not find any solution. You are a lifesaver 🙂 -Krishna

krishna_11 · ‎10-31-2020

Hi @alonsocaio Here is my source type config: [source::...ta-audit-logs-ingester*.log*] sourcetype = taauditlogsingester:log [source::...ta_audit_logs_ingester*.log*] sourcetype = taauditlogsingester:log [Audit-Logs-Source] INDEXED_EXTRACTIONS = json SHOULD_LINEMERGE = 0 category = Splunk App Add-on Builder pulldown_type = 1 Thank you so much for your help. Greatly appreciated. Thanks and best regards Krishna

krishna_11 · ‎10-30-2020

Hi @alonsocaio The original format of the log entries is JSON. The sourcetype contains only INDEXED_EXTRACTIONS is set to JSON and I have not set KV_MODE at all. Are there any other ideas? Best regards Krishna

krishna_11 · ‎10-30-2020

Hi Splunk experts I need one help, the splunk search is giving me duplicate entries when I do a search. I have made sure that there are no duplicate events and I have also used dedup in my search. Still it gives me duplicates. Need your help. See the attached image. Could you please let me know what could be the issue? Thanks and best regards Krishna

krishna_11 · ‎10-24-2020

Thank you so much. Greatly appreciate your help and support. That was helpful. 🙏

krishna_11 · ‎10-23-2020

Hi I want to add a dashboard to my Splunk add-on, so I need an app right. But in the App I am not able to find how to connect the add-on, Could you please help me out? How can I package them together so customers just download App or do they need to download both separately? Thank you in advance. Best regards Krishna

krishna_11 · ‎09-14-2020

Hi Splunk Gurus I have been trying to build my first technical addon. I just coded the validate inputs with a rest call to check the input stanza configuration. But when I am trying to create an input stanza I keep getting this error 'NoneType' object has no attribute 'get_proxy_settings'. I have not configured any proxy. Why am I getting this error? Please help. Thank you in advance. The REST calls work fine in collect_events.

krishna_11 · ‎09-10-2020

Hi Gurus, I have a couple of question regarding my first Splunk Technical add-on development: 1. If I develop a Splunk technical add-on for Splunk 7.0 will it work on Splunk 8.0? 2. Will it support Splunk cloud as well, or this requires a separate add-on? 3. What is the certification process for the Add-on? How long does it take? Any answers will be really helpful. Thanks and best regards Krishna

Posts	8
Solutions	0
Karma Given	5
Karma Received	6
Member Since	‎09-10-2020

Online Status	Offline
Date Last Visited	‎11-02-2020 03:01 PM

Duplicate entries in splunk search

Splunk add-on needs a dashboard

'NoneType' object has no attribute 'get_proxy_sett...

Splunk Technical add-on version on-prem and cloud

Re: Duplicate entries in splunk search

Re: Duplicate entries in splunk search

Re: Duplicate entries in splunk search

Duplicate entries in splunk search

Re: Splunk add-on needs a dashboard

Splunk add-on needs a dashboard

'NoneType' object has no attribute 'get_proxy_sett...

Splunk Technical add-on version on-prem and cloud