Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About KOJL
KOJL
Explorer
Member since:
08-08-2022
11-15-2022
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 08-08-2022 |
Activity Feed
- Posted Why is Dashboard studios base search from report, "app undefined"? on All Apps and Add-ons. 11-02-2022 08:07 AM
- Posted Re: DB connect app 3.5.1 Oracle databases SID with underscore on All Apps and Add-ons. 10-03-2022 04:54 AM
- Karma Re: DB connect app 3.5.1 Oracle databases SID with underscore for isoutamo. 10-03-2022 04:50 AM
- Posted DB connect app 3.5.1 Oracle databases SID with underscore on All Apps and Add-ons. 10-03-2022 02:32 AM
- Karma Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs for gjanders. 08-09-2022 04:00 AM
- Karma Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs for gjanders. 08-09-2022 04:00 AM
- Posted Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs on All Apps and Add-ons. 08-09-2022 03:59 AM
- Posted Re: Splunk DB Connect V3 - Automated / Programmatic creation of connections and inputs on All Apps and Add-ons. 08-08-2022 02:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
11-02-2022
08:07 AM
Hi! I have a set of python scripts running every night as part of an automation process. These scripts output data into the _internal index that is restricted for a large portion of the work force. However some teams should be able to view the output from these scripts as it would help them troubleshoot why hosts fail. I was hoping to solve the access issue by having a scheduled search run every night collecting the output of the python scripts and using that report as a base search in a new dashboard powered by dashboard studios. I would then just use the chain search function for creating the tables and reports that staff with less privileges could use to access the otherwise unavailable information. But my problem is that I can not get the base search to work. Not matter what I put under the key App: "Put the name of the app holding the saved search here" When I use the "open in search function" from the dashboard, I notice that whatever I put under the context of "app", splunk does not care, it always just resolves to "undefined". Here is an example of the code from dashboard studios: { "type": "ds.savedSearch", "options": { "ref": "internal_base_search", #this should be the name of the report "app": "search" #The app where the report exist. }, "name": "Saved Search Data Source From S&R" } So no matter what I do, the url I get using the "open in search" function, it points to: <hostname>:8000/en-US/app/undefined/search?s=Internal%20base%20search%20Clone and if I manually change it to the app that holds the report it finds it just fine, for example: <hostname>:8000/en-US/app/search/search?s=Internal%20base%20search%20Clone Has anyone had a simlar issue? This to me feels like a bug and that "APP" key in the json formatted source code does not resolve correctly.
... View more
- Tags:
- splunk-search
Labels
- Labels:
-
dashboard
-
development
10-03-2022
04:54 AM
Hi! Thank you for these answers! I tried just removing the _ and everything that followed it, and db connect seem to have accepted it. I'll let the automation try and create the input during the night and hopefully it will work intended. I'll update the post tomorrow and see if it was successfull in using the "stripped" version of the SID. Once again big thanks.
... View more
10-03-2022
02:32 AM
Hello! I have the last months been working on automating adding/deleting new/old databases through a cmdb database. It's working pretty well and maybe one day i hope to make it available for the community. But last week I ran into some trouble and I can not find any mentioning of this problem. This project has a lot of oracle databases, somewhat 700 or so. And it turns out some of them contain an underscore (_) in the middle of their SID. And i noticed that all of these fail to connect to the database. It does not matter if it gets created from the automation app from the web UI, the error message is the same. {"errors":[{"messageKey":"DATABASE_CONNECTION_INVALID_ERROR","args":{"name":"<HOSTNAME>"},"message":"Database connection <HOSTNAME> is invalid.","messageTemplate":"Database connection {name} is invalid.","detail":"Listener refused the connection with the following error:\nORA-12505, TNS:listener does not currently know of SID given in connect descriptor\n \r\n\r\nDiagnosis:\r\nIt seems like the provided database SID does not exist.\r\n\r\nPossible resolution:\r\nPlease provide the correct database SID"}]} So it would seem as the DB connect app does not like it when underscores are a part of the SID. Has anyone else ran into this issue?
... View more
Labels
- Labels:
-
configuration
-
development
-
troubleshooting
08-09-2022
03:59 AM
That is a nifty trick, thank you. I did update my post with the solution to my issue, but I can't say if it's necessary to both hit the admin reload or just restarting the task server is enough. Doing both will at least make your inputs run. Once again thank you for taking the time to help out.
... View more
08-08-2022
02:04 AM
Hi! First off, thank you for contributing your insights into the workings of the DB connect app. I have developed a collection of python3 scripts to automate adding new databases and inputs to db connect through the rest api. But I have run into the issues you describe in this post when starting the testing phase. The connections and inputs are generated in the app and are visable through the UI. The timestamp file is also present in the folder : /opt/splunk/var/lib/splunk/modinputs/server/splunk_app_db_connect/ However, the data for the inputs are not in the index. After trying the solution that you describe for this i have run into some issues that i hope someone can answer. When trying to contact the url for reloading the inputs: https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/inputs/_reload I only get a 404 status in return, leading me to think that this enpoint is no longer available through the rest api? I'm running version 3.5.1 of db connect. I can reach the : https://localhost:8089/servicesNS/nobody/search/admin/server/_reload And the task server url with curl, but not through python requests for some reason (503 error) https://localhost:8089/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/taskserver But in the end the inputs generated over the api does not seem to run and i'm guessing it is becouse I dont get the reload on inputs. When running the query for the input through the UI i do get data back so i belive all parameters are present and correct for the input,identity and connection. I guess I could restart the splunk instance all togheter but that would be a last resort kind of solution that i rather avoid. Update: The data was there,just in another index then expected due to splunk baseline configs. As for the endpoints for reloading the task server, all it needed was a bit of time. If you are planning to reload the taskserver and hit the admin reload endpoint in the same script, make sure to add in breaks as it takes a couple of seconds for the service to reload and if you hit the reload task server endpoint right after the admin reload url, you will get the 503 error.
... View more
