Hi all,   I am trying to develop a custom command. The custom command works as expected and now I am working to setup proper logging, but I can't seem to be able to make the python script log anything or I'm looking in the wrong place. I built it following what's written here: Create a custom search command | Documentation | Splunk Developer Program Here's a quick python code example: #!/usr/bin/env python # coding=utf-8 # # Copyright © 2011-2015 Splunk, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"): you may # not use this file except in compliance with the License. You may obtain # a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the # License for the specific language governing permissions and limitations # under the License. import os, sys, requests, json sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "lib")) from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators, splunklib_logger as logger @Configuration() class TestCustomCMD(StreamingCommand): def getFieldValue(self, field_name, record): return record[field_name] if field_name in record else "" def writeFieldValue(self, field_name, field_value, record): record[field_name] = field_value def stream(self, records): for record in records: self.writeFieldValue("TEST FIELD", "TEST CUSTOM COMMAND", record) logger.fatal("FATAL logging example") logger.error("ERROR logging example") logger.warning("WARNING logging example") logger.info("INFO logging example") yield record dispatch(TestCustomCMD, sys.argv, sys.stdin, sys.stdout, __name__)   command.conf: [testcustcmd] filename = test_custom_command.py python.version = python3 chunked = true   and search to test: | makeresults count=2 | testcustcmd   The search completes correctly and returns this:   However, I don't find the logged lines anywhere. On my Splunk server I ran this: grep -rni "logging example" "/opt/splunk/var/log/splunk/"   But the result is empty. Can you help me understand what I am doing wrong here?   Thank you in advance, Tommaso ... View more

Hi,   This thing is getting me crazy. I am running Splunk 9.2.1 and I have the following table: amount compare frac_type fraction integer 0.41 F Number 0.41 0 4.18 F Number 0.18 4 0.26 F Number 0.26 0 0.34 F Number 0.34 0 10.60 F Number 0.60 10 0.11 F Number 0.11 0 2.00 F Number 0.00 2 3.49 F Number 0.49 3 10.58 F Number 0.58 10 2.00 F Number 0.00 2 1.02 F Number 0.02 1 15.43 F Number 0.43 15 1.17 F Number 0.17 1   And these are the evals I used to calculate the fields: | eval integer = floor(amount) | eval fraction = amount - floor(amount) | eval frac_type = typeof(fraction) | eval compare = if(fraction = 0.6, "T", "F")   Now, I really can't understand how the "compare" field is always false.... I was expecting it to output TRUE on row 5 with amount = 10.60, which means fraction = 0.6, but it does not. What am I doing wrong here? Why "compare" evaluates to FALSE on row 5? I tried to change 0.6 with 0.60 (you never know), but no luck.   If you want you can try this run anywhere search, which gives me the same result:   | makeresults | eval amount = 10.6 | eval integer = floor(amount) | eval fraction = amount - floor(amount) | eval frac_type = typeof(fraction) | eval compare = if(fraction = 0.6, "T", "F")   Can you help me?     Thank you in advance, Tommaso ... View more

Hello,   I have this data set:       event, start_time, end_time EV1, 2024/07/11 12:05, 2024/07/11 13:05 EV2, 2024/07/11 21:13, 2024/07/12 04:13 EV3, 2024/07/13 11:22, 2024/07/14 02:44         I need to split the time intervals into hourly intervals. One interval for each row. Eventually I'm looking for an output like this:       event, start_time, end_time EV1, 2024/07/11 12:05, 2024/07/11 13:00 EV1, 2024/07/11 13:00, 2024/07/11 13:05 EV2, 2024/07/11 21:13, 2024/07/12 22:00 EV2, 2024/07/11 22:00, 2024/07/12 23:00 EV2, 2024/07/11 23:00, 2024/07/12 00:00 EV2, 2024/07/11 00:00, 2024/07/12 01:00 EV2, 2024/07/11 01:00, 2024/07/12 02:00 EV2, 2024/07/11 02:00, 2024/07/12 03:00 EV2, 2024/07/11 03:00, 2024/07/12 04:00 EV2, 2024/07/11 04:00, 2024/07/12 04:13 EV3, 2024/07/13 11:22, 2024/07/14 12:00 EV3, 2024/07/13 12:00, 2024/07/14 13:00 EV3, 2024/07/13 13:00, 2024/07/14 14:00 EV3, 2024/07/13 14:00, 2024/07/14 15:00 EV3, 2024/07/13 15:00, 2024/07/14 16:00 EV3, 2024/07/13 16:00, 2024/07/14 17:00 EV3, 2024/07/13 17:00, 2024/07/14 18:00 EV3, 2024/07/13 18:00, 2024/07/14 19:00 EV3, 2024/07/13 19:00, 2024/07/14 20:00 EV3, 2024/07/13 20:00, 2024/07/14 21:00 EV3, 2024/07/13 21:00, 2024/07/14 22:00 EV3, 2024/07/13 22:00, 2024/07/14 23:00 EV3, 2024/07/13 23:00, 2024/07/14 00:00 EV3, 2024/07/13 00:00, 2024/07/14 01:00 EV3, 2024/07/13 01:00, 2024/07/14 02:00 EV3, 2024/07/13 02:00, 2024/07/14 02:44         I tried using bin or timechart command but they don't work. Do you guys have any sugestion?     Thank you, Tommaso ... View more

Hello, I have events in this format: <servername> <metricname> <epochtime> <metricvalue>   These events comes from HEC to an heavy forwarder and are then forwarded to indexers. I would like to set Splunk to recognize <epochtime> as the event timestamp. <servername> and <metricname> are alphanumerical words with no whitespaces inside, while <metricvalue> is numerical. <epochtime> is a 10 digits, integer epoch time.   I've set up props.conf file on heavy forwarder as follows: [sourcetypename] TIME_FORMAT = %s   But events are not indexed with the correct timestamp. I also tried to add this property: TIME_PREFIX = \S+\s\S+\s But no luck.   Can you help me understand what am I doing wrong?   EDIT---- Log example: mywebserver123 SOME_METRIC 1706569460 5 myotherwebserver456.domain.com ANY_OTHER_NAME 1706569582 3 ... View more