×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
kilimche
Explorer
Member since: ‎12-17-2021
‎06-01-2022
Community Statistics
Posts 6
Solutions 1
Karma Given 2
Karma Received 1
Member Since ‎12-17-2021
Activity Feed
View All

Re: Why is Splunk rest api result not returning ag...

by in Getting Data In
‎05-31-2022 11:52 PM
‎05-31-2022 11:52 PM
Hi, @santoshbwn any update on your issue? ... View more

Why can I not read grouped data from SPLUNK Rest A...

by in Splunk Search
‎05-31-2022 09:43 AM
‎05-31-2022 09:43 AM
Hello, I am facing an issue while I try reading from Rest API Splunk Aggregated info. A query that uses the calculation below is able to provide 4 columns via UI but not via ADF Rest API where I get only the Total result. Seems to me like the issue is with the grouped data which can not be read for some reason. Any suggestion please? | eval Days=(relative_time(now(), "@month+28d")-patchLevelDate)/86400 | where time>relative_time(now(), "-30d") | eval system="2. VDI Persistent" | eval compliant=if(Days<70, "Yes", "No")] | chart count(host) by system compliant | addtotals      ... View more
Labels

Re: Splunk rest api result not returning aggregate...

by in Getting Data In
‎05-31-2022 09:24 AM
‎05-31-2022 09:24 AM
Hi, any update on your issue, Im facing similar problem when reading from SPLUNK Rest APi via ADF using  | eval compliant=if(Days<60, "Yes", "No")] | chart count(host) by system compliant | addtotals | eval No=round((100*No/Total),2) | eval Yes=round((100*Yes/Total),2) | fields – Total Yes No   I see the correct result via UI but only the summary in the ADF result ... View more

Re: Change default APP in a rest API call for a in...

by in Splunk Search
‎12-22-2021 12:38 AM
1 Karma
‎12-22-2021 12:38 AM
1 Karma
Hello I was able to change the relative URL and successfully get the new app data -changing the default application search.  I used this article:  https://community.splunk.com/t5/Getting-Data-In/REST-API-with-namespace/m-p/9596   My API call looks like https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs The TargetNamespace is the new APP (search header).   Thanks     ... View more

Re: Change default APP in a rest API call for a in...

by in Splunk Search
‎12-20-2021 06:05 AM
‎12-20-2021 06:05 AM
Thanks,  I am still not able to make this work ... View more

Change default APP in a rest API call for a inputl...

by in Splunk Search
‎12-17-2021 07:43 AM
‎12-17-2021 07:43 AM
Hi could you please give me an advice how to edit a call to the Splunk Rest API with the following parameter: search | inputlookup mylookup.csv The goal is to use another APP, not the user default one. I tried the following but it gave me same result: | inputlookup mylookup.csv | eval app_name = $env:MyNewApp$    Thanks a lot! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-01-2022 09:38 AM
Karma from
View All
Karma given to
View All