About Sanz

Sanz · ‎08-22-2022

I wanted to get a list of the sizes of all lookup files to see which ones are very large. Some of the lookup files are set to app only and the SPL doesn't work.

Sanz · ‎08-17-2022

Hi All, I am trying to view a lookup file that has the sharing set on this app only from another app than it is defined. Is there anyway to achieve this without changing the permission in the GUI? This is the SPL i'm running but it skips the lookup files that aren't being shared. Maybe temporary set the sharing to global and set it back or something | rest splunk_server=local /servicesNS/-/-/data/lookup-table-files | fields title eai:acl.owner eai:acl.app | where !match(title,"\.mlmodel") | rename eai:acl.* as * | map [ | inputlookup $title$ | foreach * [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] | addtotals b_* fieldname=b | stats sum(eval(b/1024/1024)) as mb | eval name="$title$", owner="$owner$", app="$app$" ] maxsearches=1000

Sanz · ‎08-08-2022

Hi All, According to the documentation for Splunk Cloud Classic Experience If your Splunk Cloud Platform deployment is on Classic Experience, you can manage your indexes programmatically using the Splunk REST API cluster_blaster_indexes/sh_indexes_manager endpoint. Manage indexes on Splunk Cloud Platform Classic Experience - Splunk Documentation When I used the command: curl -k -H "Authorization: Bearer MyToken" https://MySplunk.splunkcloud.com:8089/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json I get this respond: <!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta http-equiv="refresh" content="1;url=https://XX.splunkcloud.com/en-US/servicesNS/nobody/search/data/indexes"><title>303 See Other</title></head><body><h1>See Other</h1><p>The resource has moved temporarily <a href="https://XX.splunkcloud.com/en-US/servicesNS/nobody/search/data/indexes">here</a>.</p></body></html> This brings me to a 404 page Basically I want to create an Index using REST API on Splunk Cloud (Classic Experience)

Sanz · ‎08-02-2022

@somesoni2 Thanks a lot for you reply! This works like a charm. Question though: How can I loop the results as list into 1 field maybe as list? Something like this (I mixed python and SPL haha) data[] = results from | where match(data,"\|\s*savedsearch\s") OR match(data,"ds\.savedSearch") OR match(data,"search ref\=") for x in data: print(x) in field "savedsearch"

Sanz · ‎08-02-2022

Hi I'm new to Splunk and what to create a search that shows what savedsearches where used in a dashboard? This is how far I got: | rest /servicesNS/-/-/data/ui/views splunk_server=local | search title="test_dashboard" | rename eai:acl.app AS app, eai:data AS data | fields title app author data I have no clue how to go from this data to an actual list of savedsearches used in this dashboard. Is there anyone who can put me on a good track?

Posts	6
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎08-02-2022

Online Status	Offline
Date Last Visited	‎08-22-2022 04:03 AM

Lookup files permissions- Is there a way to view l...

How do I create an index using REST API?

How do I create a search that shows which Savedsea...

Re: Lookup files permissions- Is there a way to vi...

Lookup files permissions- Is there a way to view l...

How do I create an index using REST API?

Re: Savedsearches used in Dashboard

How do I create a search that shows which Savedsea...

Are you a member of the Splunk Community?