I want my customer to be able to set the "interval" and control how frequent the module runs. I started with this: default/inputs.conf   [app_name] interval = 43200   and it worked as a default fallback, but once I added it to inputs.conf.spec, things started to break [app_name://<name>] interval = <integer>   The value was ignored. I tried 30 for every 30 seconds and tracked logs. further more I had this log message in my server: Ignoring parameter "interval" for modular input "app_name" when scheduling the runtime for script="/opt/splunk/etc/apps/app_name/bin/script_name.py". This means potentially Splunk won't be restarting it in case it gets terminated.   What is the way to expose "interval" to end user? (Ideally in "more options" at the Add Input UI. )       ... View more

I develop an app on a private Splunk Enterprise server and have a piece of code that accesses the rest api: # Use Splunk REST API to get all input parameters splunkd_uri = os.environ.get("SPLUNKD_URI", "https://127.0.0.1:8089") endpoint = f"{splunkd_uri}/servicesNS/nobody/{app_name}/data/inputs/{app_name}" headers = { 'Authorization': f'Splunk {session_key}' } response = requests.get(endpoint, headers=headers, verify=False, timeout=30) Everything works locally but when I run app-inspect before submitting to splunkcloud I get: FAILURE: If you are using requests.get to talk to your own infra with non-public PKI, make sure you bundle your own CA certs as part of your app and pass the path into requests.get as an arg. File: bin\utils\splunk_rest.py Line Number: 19 I am trying to understand how to solve this issue, because if I put a CA that matches the server I am working on, it will not satisfy the splunkcloud server that my clients will use. I think I am misunderstanding a core piece around how to utilize Rest API pragmatically. What is the correct way to go about this? Can it work both for Splunk enterprise and on Splunk Cloud? any clue or tip may help Thanks ... View more

It is like that for couple of minutes. I tried to refresh the page and reupload and it behaves the same.  What can I do?       ... View more

Hello My data is formatted as JSON and it contains a field named "cves" which contains an array of cve codes related to the event.  If I simply alias it to CVE then one row will contain all the CVES: [props.conf] FIELDALIAS-cve = cves as cve   I assume that in order for the data to be useful, I have to somehow break the array in such a way that each value will enter as a separate row. Is this assumption correct?  and if so, what is they way to do that in props.conf?  Thank you ... View more

Hi, I have a modular input that is connected to CIM through eventtypes and tags as follows: default/eventtypes.conf [my_event_type] search = sourcetype=my_default_source_type default/tags.conf [eventtype=my_event_type] alert = enabled This generally works up until a user decides to reconfigure the default sourcetype and index. When the sourcetype is altered the eventtype stanza breaks. How to go about this? What is the best practive to allow a user to reconfigure sourcetype while ensuring the CIM integration works.  Should I relay on other fields that I create?  Can this damage the efficiency of the query?  Thanks ... View more

Hi, I have submitted my app into Splunk Cloud Platform for vetting process and it is in "Pending" status for more then 3 weeks. Is this timespan normal?  Is there anyway to contact the team and check for a more specific status? Thanks ... View more

I developed my first app and am trying to integrate it into CIM using the documentations. so far I Successfuly defined an eventtype in eventtype.conf [my_event_type] search = sourcetype=my_source and when I search for this event type I get all the results: eventtype=my_event_type Now I continue to define tags, using this guide My tags.conf file looks like this: [eventtype=my_event_type] alert = enabled But nothing is returned when I search for: tag=alert Moreover when I search for all types of tags I get only one type "error" and it's count is significantly less then the eventtype amount: sourcetype=my_source | stats count by tag In the guide it says "Once you have tagged an event type, you can search for it in the search bar" but I can't search for the tags. How can I troubleshoot the process? What should I look for? What am I missing? thank you. ... View more