I want to use the splunk app for lookup file editing to export a csv lookup file and automatically apply utf8-bom encoding when opening the downloaded file on my local PC. How can I do this? I went into that path and modified lookup_editor_rest_handler.py and added a utf8-BOM stream to csv_data, but that setting is not applied. When the user opens the exported Excel file on a local PC, a problem occurs where non-English characters are encoded incorrectly. $SPLUNK_HOME/etc/apps/lookup_editor/bin/lookup_editor_rest_handler.py     import codecs def post_lookup_as_file(self, request_info, lookup_file=None, namespace="lookup_editor", owner=None, lookup_type='csv', **kwargs): self.logger.info("Exporting lookup, namespace=%s, lookup=%s, type=%s, owner=%s", namespace, lookup_file, lookup_type, owner) try: # If we are getting the CSV, then just pipe the file to the user if lookup_type == "csv": with self.lookup_editor.get_lookup(request_info.session_key, lookup_file, namespace, owner) as csv_file_handle: csv_data = csv_file_handle.read() csv_data = codecs.BOM_UTF8.decode('utf-8')+csv_data # If we are getting a KV store lookup, then convert it to a CSV file else: rows = self.lookup_editor.get_kv_lookup(request_info.session_key, lookup_file, namespace, owner) csv_data = shortcuts.convert_array_to_csv(rows) return { 'payload': csv_data, # Payload of the request. 'status': 200, # HTTP status code 'headers': { 'Content-Type': 'text/csv; charset=UTF-8', 'Content-Disposition': f'attachment; filename*=UTF-8\'\'{lookup_file}' }, } except (IOError, ResourceNotFound): return self.render_error_json("Unable to find the lookup", 404) except (AuthorizationFailed, PermissionDeniedException): return self.render_error_json("You do not have permission to perform this operation", 403) except Exception as e: self.logger.exception("Export lookup: details=%s", e) return self.render_error_json("Something went wrong!")       ... View more

indexes.conf [volume:hot] path=/mnt/splunk/hot maxVolumeDataSizeMB = 40 [volume:cold] path = /mnt/splunk/cold maxVolumeDataSizeMB = 40 [A] homePath = volume:hot/A/db coldPath = volume:cold/A/colddb maxDataSize = 1 maxTotalDataSizeMB = 90 thawedPath = $SPLUNK_DB/A/thaweddb [_internal] homePath = volume:cold/_internaldb/db coldPath = volume:cold/_internaldb/colddb thawedPath = $SPLUNK_DB/_internaldb/thaweddb maxDataSize = 1 maxTotalDataSizeMB = 90 I collected data from each index, and the percentage stored in cold volume was A=30MB, _internaldb/db=10MB. This was understood to account for a larger percentage because the data volume and collection speed of the A index was larger and faster than that of _internal collection. If you stop collecting data from the A index and maintain data collection only for the _internal index, the old buckets in _internaldb/db will be moved to _internaldb/colddb in the order they were loaded in _internaldb/db, and will not be maintained in colddb in the order in which they were loaded in _internaldb/db, but will be immediately deleted. Additionally, data that existed in A/colddb is deleted in oldest order. I understood that the cold volume is limited to 40 and the cold volume is already full, so it will not be maintained in _internaldb/colddb and will be immediately deleted. However, why is the data in A/colddb deleted? Afterwards, when the A/colddb capacity reaches 20, A/colddb is not deleted. The behavior I expected was that if A/colddb capacity is deleted until it becomes 0, the old buckets in _internaldb/db would be moved to _internaldb/colddb and then maintained. I'm curious why the results are different from what I expected, and if maxTotalDataSizeMB is the same, the Volume maintains the same ratio. ... View more

I want to create a custom role to manage splunk risky commands. I looked for configuration files related to risky commands and found that it is related to web.conf command.conf file and I found that you can disable risky commands by setting [command] is_risky=false in command.conf file. What I want is to give a role to manage risky_command so that I can get different search results than other users. I wonder if it is possible to create such a role. ... View more

My friend and I have the same indexes.conf, but why are the bucket sizes being created different? Mine is around 1MB, but my friend's are created in 5.x MB units.. indexes.conf [volume:hot] path = /data/HOT maxVolumeDataSizeMB = 100 [volume:cold] path = /data/COLD maxVolumeDataSizeMB = 100 [lotte] homePath = volume:hot/lotte/db coldPath = volume:cold/lotte/colddb maxDataSize = 1 maxTotalDataSizeMB = 200 thawedPath = $SPLUNK_DB/lotte/thaweddb     ... View more

Currently, my sourcetype contains a mix of bank logs and card logs. I would like to categorize this into `index=bank` and `index=card` respectively. Currently, the search is done with index=main, and all data is displayed. If index=bank, I want only bank-related logs to be output. We set the forwarder as follows and created bank, card, and error indexes on the server that will receive the data. This is the code I have written so far... I need help,,,,,   splunk@heavy-forwarder:/opt/splunk/etc/apps/search/local:> cat inputs.conf [monitor:///opt/splunk/var/log/splunk/test.log] disabled = false host = heavy-forwarder sourcetype = test crcSalt = <SOURCE>   splunk@heavy-forwarder:/opt/splunk/etc/system/local:> cat props.conf [test] TRANSFORM-routing=bankRouting,cardRouting,errorRouting splunk@heavy-forwarder:/opt/splunk/etc/system/local:> cat transform.conf [bankRouting] REGEX=bank DEST_KEY =_INDEX FORMAT = bankGroup [cardRouting] REGEX=card DEST_KEY =_INDEX FORMAT = cardGroup [errorGroup] REGEX=error DEST_KEY =_INDEX FORMAT = errorGroup splunk@heavy-forwarder:/opt/splunk/etc/system/local:> cat outputs.conf [tcpout:bankGroup] server = 192.168.111.153:9997 [tcpout:cardGroup] server = 192.168.111.151:9997 [tcpout:errorGroup] server = 192.168.111.152:9997   ... View more

I'm practicing auto-lookup. Auto-lookup of vendors_ip.csv has already been successful in my index. Here, I would like to add auto-lookup for the prices.csv file in the same index. The process I followed uploaded a lookup table, created a lookup definition, and created an automatic lookup, but as a result of searching for index=main, only the prices.csv fields are not visible. The fields of vendors_ip that were previously successful are output. What I'm curious about is whether it is possible to perform multiple automatic lookups on one index in splunk. I would also like to know why the automatic lookup is not working. ... View more

f this is my current quey... <I am currently sending metric-data to O11y and receiving data through the splunk sim command. What I'm curious about is that I want to optimize my current query using base-search. Is this possible?> | sim flow query="A = data('sap.hana.connection.count', rollup='latest').sum(by=['CONNECTION_STATUS']).publish(label='A')" resolution=10 | tail 20 | stats avg(_value) as avg_val by _time, CONNECTION_STATUS <row> <panel id="connections"> <html depends="$hiddenForCSS$"> <style> #connections{ width: 15% !important; } </style> </html> <single> <title>Connections</title> <search> <query>| sim flow query="A = data('sap.hana.connection.count', rollup='latest').sum().publish(label='A')" | stats sum(_value) as host_sum by _time</query> <earliest>$global_time.earliest$</earliest> <latest>$global_time.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>$time_set$</refresh> <refreshType>delay</refreshType> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="height">151</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x555","0x118832","0x1182f3","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[0,30,50,70]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">0</option> <option name="showTrendIndicator">0</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> <panel id="Con_state"> <html depends="$hiddenForCSS$"> <style> #Con_state{ width: 34% !important; } </style> </html> <single> <title>Connections by state</title> <search> <query>| sim flow query="A = data('sap.hana.connection.count', rollup='latest').sum(by=['CONNECTION_STATUS']).publish(label='A')" resolution=10 | tail 20 | stats avg(_value) as avg_val by _time, CONNECTION_STATUS</query> <earliest>$global_time.earliest$</earliest> <latest>$global_time.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>$time_set$</refresh> <refreshType>delay</refreshType> </search> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="height">174</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">0</option> <option name="trellis.size">medium</option> <option name="useColors">1</option> </single> </panel></row>     ... View more

Below is my dashboard XMLcode. The behavior I want to implement is to have the user's selection of values ​​in the table's columns automatically enter the multi-selection input. I don't know what to do. I want to make this...  Does anybody know what can I to do..??? Pleasee Help..me..... : ((((     <form version="1.1" theme="dark"> <label>Sales DashBoard</label> <fieldset submitButton="true" autoRun="false"> <input type="time" token="globalTime" searchWhenChanged="true"> <label>Select Time Range</label> <default> <earliest>0</earliest> <latest></latest> </default> </input> <input type="text" token="country" searchWhenChanged="true"> <label>select Country</label> <default>*</default> </input> <input type="multiselect" token="client_token"> <label>client_token</label> <choice value="*">ALL</choice> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>clientip="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>clientip</fieldForLabel> <fieldForValue>clientip</fieldForValue> <search> <query>index=main | stats count by clientip</query> </search> <default>*</default> </input> <input type="multiselect" token="field1" searchWhenChanged="true"> <label>field1 $clicked_value$</label> <choice value="*">all</choice> <choice value="clicked_value">choice</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>products</fieldForLabel> <fieldForValue>products</fieldForValue> <search> <query>| index=main productName=$clicked_value$ | stats count by productName</query> </search> <delimiter> </delimiter> </input> <input type="text" token="input_02" searchWhenChanged="true"> <label></label> <default>$clicked_value$</default> <initialValue>$clicked_value$</initialValue> </input> </fieldset> <row> <panel> <title>test demo</title> <table> <title>셀트리온 과제임 $clicked_value$</title> <search> <query>index=main sourcetype="access*" action=purchase $client_token$ | stats values(productName) as products by clientip</query> <earliest>$globalTime.earliest$</earliest> <latest>$globalTime.latest$</latest> </search> <option name="drilldown">cell</option> <format type="color" field="clientips"> <colorPalette type="minMidMax" maxColor="#118832" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> <format type="number" field="clientips"></format> <drilldown> <set token="clicked_value">$click.value2$</set> </drilldown> </table> </panel> </row> <row> <panel> <title>Actual Purchase Rate</title> <single> <title>transition from shopping cart to actual purchase</title> <search> <query>index=main sourcetype="access_combined_wcookie" status=200 action IN(addtocart, purchase) | iplocation clientip | search Country="$country$" | eval action_type=if(action="addtocart", "cart", if(action="purchase", "purchase", "other")) | stats count(eval(action_type="cart")) as cart_count count(eval(action_type="purchase")) as purchase_count | eval rate=round(purchase_count*100/cart_count, 2) | table rate</query> <earliest>$globalTime.earliest$</earliest> <latest>$globalTime.latest$</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0.00</option> <option name="rangeColors">["0xd41f1f","0xd94e17","0xf8be34","0x1182f3","0x118832"]</option> <option name="rangeValues">[60,70,85,90]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel>..</form> ... View more