About chrisdev

chrisdev · ‎01-28-2022

Hi all, Im attempting to create a graph that plots total number of events over time. I have tried various usages of timechart, which does not have the desired effect. sourcetype=* index=* | timechart span=1h count This yields the following result: The total number of events in this example is 16, however the data points on the graph correspond to imports and go from 0 -> 13 -> 3. Is there any way I can plot the total number of events over time (so the 3 data point actually becomes 16)? Thanks in advance for any assistance.

chrisdev · ‎12-03-2021

Hey all, I have 2 source types with the following properties source_1 id value source_2 name description So my events might look similar to: source_1: id=abc-123, value="blah" source_2: name=abc-123, description="some_description" The values of source_1.id and source_2.name are equal. Im trying to display the id/name, description and value in a table. I've came up with the following query to do so: index=main sourcetype=source_2 | rename name AS id | join id [search index=main sourcetype=source_1 id=*] | table id, value, description Is my query the best way to achieve this? Are there any alternatives?

chrisdev · ‎08-23-2021

I have a simple TA that makes a request to a REST endpoint and writes the data to the index (no UI associated with this, only indexing). Im exploring a distributed Splunk environment (with a forwarder, indexer and search head) but im unsure where to install the TA. On the forwarder, the indexer or somewhere else? Reading similar forum posts it appears that the answer can depend on the TA, however what about a TA decides in what environment it should be installed?

chrisdev · ‎03-18-2021

Thank you. Weighing up my options for deduplication of events at index time. Doesn't seem like the correct approach if it's bad practice to access an index from a scripted/modular input. I know that there's a dedup command at search time, however ideally I wouldn't have duplicate events in the index. The source of these events, which im not in control of, may produce duplicates.

chrisdev · ‎03-18-2021

Is it possible to access the index from a scripted or modular input? And is the standard way of doing this via the SDK features as shown in examples such as search.py?

chrisdev · ‎03-12-2021

Ive seen splunk.clilib used in numerous Splunk apps, however I cant find any documentation online for this. Are there any docs available?

chrisdev · ‎03-03-2021

I have a TA (modular input) running on Splunk and im trying to read a conf file, for example app.conf. My TA extends the OOTB BaseModInput. I can do this in python with something like: from splunk.clilib import cli_common as clicfg = cli.getConfStanza('app', 'launcher') And the data is returned correctly. However, installing other apps can affect the values returned. When I install the VSCode app, I always get the app.conf values back from VSCode (even without adding the debug import/start code to my own app). So my question is, is the approach im taking the correct way to read conf files? And if not what is the recommended approach?

Posts	7
Solutions	0
Karma Given	6
Karma Received	1
Member Since	‎03-03-2021

Online Status	Offline
Date Last Visited	‎10-13-2022 09:22 AM

Graph total events over time

Joining 2 sourcetypes by property value

TA installation in distributed environment

Index access from scripted or modular input

splunk.clilib documentation

Reading conf files in TA