Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About premrajvs
premrajvs
Explorer
Member since:
11-08-2022
10-03-2026
Community Statistics
| Posts | 8 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 11-08-2022 |
Activity Feed
- Karma Re: sPath command Missing random few values from JSON Array for PickleRick. 01-16-2025 07:14 PM
- Karma Re: sPath command Missing random few values from JSON Array for yuanliu. 01-16-2025 07:14 PM
- Posted Splunk MLTK : Error in 'sample' command: The specified field name for the partition already exists: partition_number on All Apps and Add-ons. 01-16-2025 07:13 PM
- Posted Re: sPath command Missing random few values from JSON Array on Splunk Search. 08-26-2024 07:26 AM
- Posted sPath command Missing random few values from JSON Array on Splunk Search. 08-23-2024 11:48 AM
- Posted How to use Splunk REST API to create/update a role with more than 1 index access? on Splunk Cloud Platform. 09-18-2023 04:26 PM
- Got Karma for Re: Call Third Party REST APIs Dynamically. 11-10-2022 01:20 PM
- Posted Re: Call Third Party REST APIs Dynamically on Getting Data In. 11-10-2022 12:13 PM
- Posted Re: Can Heavy Forwarder monitor a Folder and forwards to Splunk indexer ? on Getting Data In. 11-08-2022 06:22 AM
- Posted Can Heavy Forwarder monitor a Folder and forwards to Splunk indexer ? on Getting Data In. 11-08-2022 04:56 AM
- Posted Is there a way for Splunk to Call Third Party REST APIs Dynamically? on Getting Data In. 11-08-2022 04:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-16-2025
07:13 PM
I am trying to execute the sample command in Splunk MLTK. For some reason, I am getting an error everytime I run a stats command after the sample command.
index=_internal | sample partitions=3 seed=42 | stats count by action, partition_number
Search error
Error in 'sample' command: The specified field name for the partition already exists: partition_number
I tried providing different field name and it is still the same error. If I remove stats command and try running the same search multiple times, it works without any issues. What could be the reason ?
... View more
Labels
08-26-2024
07:26 AM
Thank you for all the inputs. Here is the final query
index=Github_Webhook source="http:github-dev-token" eventtype="GitHub::Push" sourcetype="json_ae_git-webhook"
| rename repository.name as RepoName
| spath path=commits{} output=commitscollection
| mvexpand commitscollection
| fields _time RepoName commitscollection
| spath input=commitscollection
| table RepoName id added{} modified{} removed{} author.name author.email message
| spath path=commits{} output=commitscollection --> Thanks to all the responders. This helps in getting the commits from array
Next challenge is, if you pull the data for all the other fields in the same approach, each of those values cannot be mapped with each other. To address this, we should use mvexpand to split them into separate array events
Once the array is split into separate events, now, we will use the same logic to split the data into events.
Hope this helps.
... View more
08-23-2024
11:48 AM
In the data, there is an array of 5 commit IDs. For some reason, it is only returning 3 values. Not sure why 2 values are missing. Would like a fresh set of eyes to take a look please.
Query
index=XXXXX source="http:github-dev-token" eventtype="GitHub::Push" sourcetype="json_ae_git-webhook"
| spath output=commit_id path=commits.id
sourcetype definition
[ json_ae_git-webhook ]
AUTO_KV_JSON=false
CHARSET=UTF-8
KV_MODE=json
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=true
TRUNCATE=100000
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
Raw JSON data
{
"ref":"refs/heads/Dev",
"before":"d53e9b3cb6cde4253e05019295a840d394a7bcb0",
"after":"34c07bcbf557413cf42b601c1794c87db8c321d1",
"commits":[
{
"id":"a5c816a817d06e592d2b70cd8a088d1519f2d720",
"tree_id":"15e930e14d4c62aae47a3c02c47eb24c65d11807",
"distinct":false,
"message":"rrrrrrrrrrrrrrrrrrrrrr",
"timestamp":"2024-08-12T12:00:04-05:00",
"url":"https://github.com/xxxxxxxxxxxxxxx/AzureWorkload_A00008/commit/aaaaaaaaaaaa",
"author":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"committer":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"added":[
],
"removed":[
],
"modified":[
"asdafasdad.json"
]
},
{
"id":"a3b3b6f728ccc0eb9113e7db723fbfc4ad220882",
"tree_id":"3586aeb0a33dc5e236cb266c948f83ff01320a9a",
"distinct":false,
"message":"xxxxxxxxxxxxxxxxxxx",
"timestamp":"2024-08-12T12:05:40-05:00",
"url":"https://github.com/xxxxxxxxxxxxxxx/AzureWorkload_A00008/commit/a3b3b6f728ccc0eb9113e7db723fbfc4ad220882",
"author":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"committer":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"added":[
],
"removed":[
],
"modified":[
"sddddddf.json"
]
},
{
"id":"bdcd242d6854365ddfeae6b4f86cf7bc1766e028",
"tree_id":"8286c537f7dee57395f44875ddb8b2cdb7dd48b2",
"distinct":false,
"message":"Updating pipeline: pl_gwp_file_landing_check. Adding Sylvan Performance",
"timestamp":"2024-08-12T12:06:10-05:00",
"url":"https://github.com/xxxxxxxxxxxxxxx/AzureWorkload_A00008/commit/bdcd242d6854365ddfeae6b4f86cf7bc1766e028",
"author":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"committer":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"added":[
],
"removed":[
],
"modified":[
"asadwefvdx.json"
]
},
{
"id":"108ebd4ff8ae9dd70e669e2ca49e293684d5c37a",
"tree_id":"5a6d71393611718b8576f8a63cdd34ce619f17dd",
"distinct":false,
"message":"asdrwerwq",
"timestamp":"2024-08-12T10:09:33-07:00",
"url":"https://github.com/xxxxxxxxxxxxxxx/AzureWorkload_A00008/commit/108ebd4ff8ae9dd70e669e2ca49e293684d5c37a",
"author":{
"name":"dfsd",
"email":"[email protected]",
"username":"aaaaaa"
},
"committer":{
"name":"lllllllllllll",
"email":"[email protected]",
"username":"aaaaaa"
},
"added":[
],
"removed":[
],
"modified":[
"A.json",
"A.json",
"A.json"
]
},
{
"id":"34c07bcbf557413cf42b601c1794c87db8c321d1",
"tree_id":"5a6d71393611718b8576f8a63cdd34ce619f17dd",
"distinct":true,
"message":"asadasd",
"timestamp":"2024-08-12T13:32:45-05:00",
"url":"https://github.com/xxxxxxxxxxxxxxx/AzureWorkload_A00008/commit/34c07bcbf557413cf42b601c1794c87db8c321d1",
"author":{
"name":"aaaaaa aaaaaa",
"email":"[email protected]",
"username":"aaaaaa"
},
"committer":{
"name":"GitasdjwqaikHubasdqw",
"email":"[email protected]",
"username":"wdkcszjkcsebwdqwdfqwdawsldqodqw"
},
"added":[
],
"removed":[
],
"modified":[
"a.json",
"A1.json",
"A1.json"
]
}
],
"head_commit":{
"id":"34c07bcbf557413cf42b601c1794c87db8c321d1",
"tree_id":"5a6d71393611718b8576f8a63cdd34ce619f17dd",
"distinct":true,
"message":"sadwad from xxxxxxxxxxxxxxx/IH-5942-Pipeline-Change\n\nIh 5asdsazdapeline change",
"timestamp":"2024-08-12T13:32:45-05:00",
"url":"https://github.com/xxxxxxxxxxxxxxx/AzureWorkload_A00008/commit/3weweeeeeeeee,
"author":{
"name":"askjas",
"email":"[email protected]",
"username":"asdwasdcqwasfdc-qwgbhvcfawdqxaiwdaszxc"
},
"committer":{
"name":"GsdzvcweditHuscwsab",
"email":"[email protected]",
"username":"wefczeb-fwefvdszlow"
},
"added":[
],
"removed":[
],
"modified":[
"zzzzzzz.json",
"Azzzzz.json",
"zzzz.json"
]
}
}
... View more
Labels
- Labels:
-
subsearch
09-18-2023
04:26 PM
I am trying to create roles via API and here is the curl request. Question I have is, I am not able to add more than 1 index to the srchIndexesAllowed field either when I create the role or when I update the role. I am not able to find any Splunk documentation around the request body.
Does anyone know how I can add/update multiple indexes for a role.
curl --location 'https://XXXXXXXXXXXXXXX/services/authorization/roles/fi_a00002-namespace_nonprod_power' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic XXXXXXXXXXXXXXXX' \
--data-urlencode 'imported_roles=user' \
--data-urlencode 'srchIndexesAllowed=index1,index2' \
--data-urlencode 'srchIndexesDefault=index1,index2'
... View more
- Tags:
- splunk search
Labels
- Labels:
-
using Splunk Cloud
11-10-2022
12:13 PM
1 Karma
I think there is no app available to call APIs on adhoc basis. So, I am building my own custom app.
... View more
11-08-2022
06:22 AM
@gcusello The servers I am referring to are Heavy Forwarder Servers. They are not application servers. I want to run few commands on these Heavy Forwarder servers and output the results to files and this data I want to push to Splunk and track it.
... View more
11-08-2022
04:56 AM
I want to run some commands on my splunk Heavy forwarder servers and output the results to a folder. I want to monitor these folders and push the data to Splunk indexers. Is my only option installing Universal forwarders on the same server or configuring inputs and outputs.conf ?
... View more
Labels
- Labels:
-
heavy forwarder
-
monitor
11-08-2022
04:52 AM
Requirement : Call REST APIs and ingest the data into Splunk to specified indexes
As of now, we are using Splunk Add on Builder Application to create apps for REST API calls and importing the data into Splunk.
Limitation with this approach : We are not able to call an API dynamically or on ad-hoc basis only when needed. Team wants to have an UI to call the REST APIs dynamically and show this data into a dashboard.
Is there any way in Splunk to provide this capability ?
... View more
Labels
- Labels:
-
data
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-03-2026
02:16 PM
|
