Hello. I am a Splunk newbie. I have a question about the replication factor in searchhead clustering. Looking at the docs it says that search artifacts are only replicated for scheduled saved searches. https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/ChooseSHCreplicationfactor   I'm curious as to the reason and advantage of duplicating search artifacts only in this case. And, then, in the case of real-time search, is it correct that search artifacts are not replicated and only remain on the local server? In that case, in a clustering environment, member 2 should not be able to see the search results of member 1. But I can view it by using the loadjob command in member2. Then, wouldn’t it be possible to view real-time search artifacts as well? Thank you ... View more

I'm trying to get data by registering it as a Splunk script using Python code. But the problem only occurs when I run this code in Splunk. When I run it directly in Splunk Python locally, there is no problem,   but when I run it from Splunk, I get the following error.   The error contents are as follows. Failed to establish a new connection: [Errno 8] nodename nor servname provided, or not known   So I searched and tried using http scheme and requests.get(verift=false), but the same error occurs. There is no error when I run it locally, so it seems to be a problem when sending a request from Splunk.     If anyone knows, I'd appreciate any help.     import requests as req import json def tmdb_api_call(requestURL, parameters): response = req.get(url=requestURL, params=parameters) if response.status_code != 200: print(response.json()) exit() data = response.json() return json.dumps(data) def get_upcoming_movies_by_page(api_key, page_number=1): requestURL = "http://api.themoviedb.org/3/movie/upcoming" parameters = {"api_key": api_key, "page": page_number} return tmdb_api_call(requestURL, parameters) def main(): api_key = "key" upcoming_movie_list = get_upcoming_movies_by_page(api_key, 1) data = json.loads(upcoming_movie_list) print(json.dumps(data["results"])) main()     (code from https://github.com/siddharthajuprod07/youtube)   ... View more

Why is the data model hierarchical? A data model is a hierarchical structure with a root data set and sub data sets. It's a sudden thought today, but if the data composition of the upper root data set is changed, the lower data set is also affected. If this happens, wouldn't the lower data depend on the upper data every time and be vulnerable to change? I don't know why the structure is like this. Inheriting the characteristics of the data itself creates a dependency, which then has to be changed every time. For example, when the type of equipment is replaced, the composition of the field changes each time, and the data model must also change each time. (everything below) I don't know if this is efficient. Why are data models designed as hierarchical? ... View more

Splunk documentation said "fillnull command is a distributable streaming command when a field-list is specified. When no field-list is specified, the fillnull command fits into the dataset processing type"   I wonder why it works as dataset processing if no fields are specified. The results are all the same anyway, but there must be a reason. Thanks for letting us know. ... View more

I am developing a Reporting command. However, a problem was found in the search command I made. To explain the problem, I have attached some code snippets of splunk_python_sdk. 0. First, the final query I want to run is index=splunk_example | table test, test_results | customcommand(reporting command) However, the command was not executed properly. However, the strange thing was that this command was executed using the index stored in the search header. However, the command was not executed on the index stored in the indexer.   1. found out - So what I found out was that the map phase runs on the indexer and the rest of the reduce phase runs on the search header. - And I checked the source code provided by the SDK, and I thought that the data extracted from the indexer can be passed as records when the map function is executed after checking the following related to the map function. -> Q) Execution of the reporting command is done in two stages: map and reduce, but only  the reduce function actually executes. Is there any way to run the map function?       ## 1-1. Here is the code provided by the sdk. def map(self, records): """ Override this method to compute partial results. :param records: :type records: You must override this method, if :code:`requires_preop=True`. """ return NotImplemented def prepare(self): phase = self.phase if phase == 'map': # noinspection PyUnresolvedReferences self._configuration = self.map.ConfigurationSettings(self) return if phase == 'reduce': streaming_preop = chain((self.name, 'phase="map"', str(self._options)), self.fieldnames) self._configuration.streaming_preop = ' '.join(streaming_preop) return raise RuntimeError('Unrecognized reporting command phase: {}'.format(json_encode_string(six.text_type(phase)))) def reduce(self, records): """ Override this method to produce a reporting data structure. You must override this method. """ raise NotImplementedError('reduce(self, records)')         2. how i tried - In this code, it is suggested to enable the requires_preop option to true to run the map function.       @Configuration() class TestReportingCommand(ReportingCommand): @Configuration(requires_preop = True) def map(self, records): ... def reduce(self, records):         - commands.conf (add) requires_preop = true   So, I tried both methods, but when I took a log, only the reduce function was executed and the map function was not executed.   If you know how to use map, please share. I used a translator, so there may be some awkwardness in the text. ... View more