About kilimche

kilimche · ‎05-31-2022

Hi, @santoshbwn any update on your issue?

kilimche · ‎05-31-2022

Hello, I am facing an issue while I try reading from Rest API Splunk Aggregated info. A query that uses the calculation below is able to provide 4 columns via UI but not via ADF Rest API where I get only the Total result. Seems to me like the issue is with the grouped data which can not be read for some reason. Any suggestion please? | eval Days=(relative_time(now(), "@month+28d")-patchLevelDate)/86400 | where time>relative_time(now(), "-30d") | eval system="2. VDI Persistent" | eval compliant=if(Days<70, "Yes", "No")] | chart count(host) by system compliant | addtotals

kilimche · ‎05-31-2022

Hi, any update on your issue, Im facing similar problem when reading from SPLUNK Rest APi via ADF using | eval compliant=if(Days<60, "Yes", "No")] | chart count(host) by system compliant | addtotals | eval No=round((100*No/Total),2) | eval Yes=round((100*Yes/Total),2) | fields – Total Yes No I see the correct result via UI but only the summary in the ADF result

kilimche · ‎12-22-2021

Hello I was able to change the relative URL and successfully get the new app data -changing the default application search. I used this article: https://community.splunk.com/t5/Getting-Data-In/REST-API-with-namespace/m-p/9596 My API call looks like https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs The TargetNamespace is the new APP (search header). Thanks

kilimche · ‎12-20-2021

Thanks, I am still not able to make this work

kilimche · ‎12-17-2021

Hi could you please give me an advice how to edit a call to the Splunk Rest API with the following parameter: search | inputlookup mylookup.csv The goal is to use another APP, not the user default one. I tried the following but it gave me same result: | inputlookup mylookup.csv | eval app_name = $env:MyNewApp$ Thanks a lot!

Posts	6
Solutions	1
Karma Given	2
Karma Received	1
Member Since	‎12-17-2021

Online Status	Offline
Date Last Visited	‎06-01-2022 09:38 AM

Why can I not read grouped data from SPLUNK Rest A...

Change default APP in a rest API call for a inputl...

Re: Why is Splunk rest api result not returning ag...

Why can I not read grouped data from SPLUNK Rest A...

Re: Splunk rest api result not returning aggregate...

Re: Change default APP in a rest API call for a in...

Re: Change default APP in a rest API call for a in...

Change default APP in a rest API call for a inputl...