Hi Splunkers, I received a notice about upgrading jQuery to version 3.5 or higher, and I ran a jQuery scan through the Upgrade Readiness dashboard. The incompatibility issue is coming from my custom app. The file in question: C:\Program Files\Splunk\etc\apps\custom_app\appserver\static\help\en-GB\jquery.js needs to be updated. Remediation(Sugested by the dashboard): The jQuery 1.11.1 bundled with the app introduces vulnerabilities. Splunk apps must use jQuery 3.5 or higher, as lower versions are no longer supported in Splunk Cloud Platform. What I’ve done so far: I downloaded the new jQuery.js file from jquery.com, renamed it, and replaced the file in the specified path and restarted splunk, but this hasn't resolved the upgrade issue. I'm unsure of the next steps and would appreciate any guidance or suggestions. Thanks! Upgrade Readiness App   ... View more

Hi there, I’m currently developing a React app and have almost finished the development. Now, I need to package it as a Splunk app, but I’m stuck on the packaging process. Is there a tool similar to the Splunk App Inspect that can fully inspect the React app I’ve created? Any documentation or blog posts on this would be really helpful. Thanks! ... View more

Hi Splunkers, I'm working on a React app for Splunk based on the documentation provided. https://splunkui.splunk.com/Packages/create/CreatingSplunkApps  I need to hide(may configure) the Splunk header bar when the React app is in use.   I’ve come across several community posts suggesting that overriding the default view files might be necessary, but I’m unsure how to configure this within a React app. I’d appreciate any guidance on how to achieve this. ... View more

Hi Splunkers, I’m new to React development and currently working on a React app that handles creating, updating, cloning, and deleting users for a specific Splunk app. The app is working well, but for development purposes, I’ve hardcoded the REST API URL, username, and password. Now, I want to enhance the app so it dynamically uses the current session’s user authentication rather than relying on hardcoded credentials. Here’s the idea I’m aiming for: When a user (e.g., "user1" with admin roles) logs into Splunk, their session credentials (like session key or authentication token) are stored somewhere, right? I need to capture those credentials in my React app. Does this approach make sense? I’m looking for advice on how to retrieve and use the session credentials, token, or session key for the logged-in user in my "User Management" React app. Here’s the current code I’m using to fetch all users (with hardcoded credentials):   // Fetch user data from the API const fetchAllUsers = async () => { try { const response = await axios.get('https://localhost:8089/services/authentication/users', { auth: { username: 'admin', password: 'changeme' }, headers: { 'Content-Type': 'application/xml' } }); // Handle response } catch (error) { console.error('Error fetching users:', error); } }; I also tried retrieving the session key using this cURL command: curl -k https://localhost:8089/services/auth/login --data-urlencode username=admin --data-urlencode password=changeme However, I’m still hardcoding the username and password, which isn’t ideal. My goal is for the React app to automatically use the logged-in user’s session credentials (session key or authentication token) and retrieve the hostname of the deployed environment. Additionally, I’m interested in understanding how core Splunk user management operates and handles authorizations. My current approach might be off, so I’m open to learning the right way to do this. Can anyone guide me on how to achieve this in the "User Management" React app? Any advice or best practices would be greatly appreciated! Thanks in advance! ... View more

Hi Splunker, I’ve been developing a React app for Splunk that manages users via the REST API (create/update/delete). Initially, I hardcoded the REST API URL, username, and password for development purposes. Now that the development is nearly complete, I need to make the URL dynamic. It should retrieve the REST API server URL and the currently logged-in user’s information and use it in the Splunk React app. How can I achieve this? Here is the current hardcoded code: const fetchAllUsers = async () => { try { const response = await axios.get('https://mymachine:8089/services/authentication/users', { auth: { username: 'admin', password: 'admin123' }, headers: { 'Content-Type': 'application/xml' } }); } catch (error) { console.error('Error fetching users:', error); } }; #restapi  #createuser #react #reactapp thanks in advance ... View more

Hi Splunkers, I am currently working on creating an alert that sends an email with a table of inline results when triggered. I need to include a link to a dashboard's tab (e.g., "View Results") in the alert email(when the user clicks th link it must go to the particular tab in dashboard. I've checked some community posts but didn't find any replies. Could you please guide me on how to achieve this?   Thanks in advance ... View more

Hi Splunkers, I am working on creating custom alerts using JavaScript in Splunk. I have created the SPL for the alert and configured the definition in macros.conf as follows: index=XXXX sourcetype=YYYY earliest=-30d latest=now | eval ds_file_path=file_path."\\".file_name | stats avg(ms_per_block) as avg_processing_time by machine ds_file_path | eval avg_processing_time = round(avg_processing_time, 1) ." ms" From the JS part, I gave the alert condition: | search avg_processing_time >= 2 When I run the SPL in Splunk, it returns about 5 to 6 rows of results: machine       ds_file_path                                                          avg_processing_time Machine01  C:\Program Files\Splunk\etc\db\gdb.ds      5.3 ms Machine02  C:\Program Files\Splunk\etc\db\rwo.ds      7.6 ms Machine03  C:\Program Files\Splunk\etc\db\gdb.ds      7.5 ms Machine04  C:\Program Files\Splunk\etc\db\rwo.ds      8.3 ms   However, when I send the conditions result as an alert email, it includes only one row of the result, like the one mentioned below: machine       ds_file_path                                                          avg_processing_time Machine01  C:\Program Files\Splunk\etc\db\gdb.ds      5.3 ms   I need to send all the populated results ( avg_processing_time >= 2) in the email. How can I achieve this? I need some guidance. Here are the alert parameters I used: { 'name': 'machine_latency_' + index, 'action.email.subject.alert': 'Machine latency for the ' + index + ' environment has reached an average processing time ' + ms_threshold + ' milliseconds...', 'action.email.sendresults': 1, 'action.email.message.alert': 'In the ' + index + ' environment, the machine $result.machine$ has reached the average processing time of $result.avg_processing_time_per_block$ .', 'action.email.to': email, 'action.logevent.param.event': '{"session_id": $result.machine$, "user": $result.avg_processing_time_per_block$}', 'action.logevent.param.index': index, 'alert.digest_mode': 0, 'alert.suppress': 1, 'alert.suppress.fields': 'session_id', 'alert.suppress.period': '24h', 'alert_comparator': 'greater than', 'alert_threshold': 0, 'alert_type': 'number of events', 'cron_schedule': cron_expression, 'dispatch.earliest_time': '-30m', 'dispatch.latest_time': 'now', 'description': 'XXXXYYYYYZZZZ', 'search': '|`sw_latency_above_threshold(the_index=' + index + ')`' } I suspect that the email action is not configured to include the entire result set. Could someone help me with how to modify the alert settings or the SPL to ensure that all results are included in the alert email? Thanks in advance for your help! ... View more

  Hi Splunkers, I am currently working on creating custom alerts with JavaScript and am encountering issues with finding proper documentation. I reviewed some posts in the Splunk community that included documentation links, but many of those links are expired or removed. Could someone provide me with the current documentation links for creating custom alerts with JavaScript? Specifically, I am working with parameters like: 'action.email.sendresults': 1, 'action.email.message.alert': 'xxxxx', 'action.email.to': email, 'action.logevent.param.event': '{"session_id": $result.session_id$, "user": $result.user_name$}', 'action.logevent.param.index': index, 'alert.digest_mode': 0, 'alert.suppress': 1, Thanks, Sanjai   ... View more

Hello everyone, I'm currently working on a Dashboard to visualize Database latency across various machines, and I'm encountering an issue with the Line Chart's SPL (Search Processing Language). The SPL requirement is to retrieve all values of the field ms_per_block grouped by ds_file_path and machine. Here's my SPL: index=development sourcetype=custom_function user_action=database_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | search ds_file_path="\\\\swmfs\\orca_db_january_2024\\type\\rwo.ds" | chart values(ms_per_block) by ds_file_path machine My result: My goal is to have the output where each ds_file_path value is listed in individual rows along with the corresponding machine and ms_per_block values in separate rows. I've tried using the table command: | table ds_file_path, machine, ms_per_block But this doesn't give me the desired output. The machine name is under a field, whereas I need the machine name to be a separate field, each containing its respective ms_per_block value. I feel like I'm missing something here. Any guidance on how to achieve this would be greatly appreciated. Thanks in advance!   ... View more

Hi Splunkers, I am working on creating a column line chart dashboard that shows database lattency . I'm encountering a issue where I'm trying to pass a token value to overlay options for line chart representation over a column chart. Here are things currently i have, My Chart and My SPL query:   SPL: index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine | appendcols [search index=development sourcetype=rwa_custom_function user_action=swmfs_test ds_file=* | eval ds_file_path=ds_path."\\".ds_file | stats max(block_count) as total_blocks by ds_file_path] I need to assign the overlay field value(avg_processing_time_per_block )from the line in SPL: | chart avg(ms_per_block) as avg_processing_time_per_block over ds_file_path by machine The reason I'm attempting to assign it as a token is that the avg_processing_time_per_block has dynamic values (sometimes it may be 10 or 12 machines data ).instead of rwmini and rwws01. Column has total_blocks value   Or is there any ways to achieve this requirement? Your thoughts on these are highly appreciated. Thank you in advance. Sanjai ... View more