Basically we are inserting data using Rest Api, after 1 hour interval our stream events get called and it dumps all the data, to avoid this we use lookup before insertion. On UI if we remove duplicate, it works as expected but in event there is lot of duplicates values, which is taking lots of space and giving slow performance
... View more
Thanks for update @ITWhisperer , we are doing extraction during search, but user dont want duplication in splunk event as well so we implemented isinstance method to check data exist or not, is there any other way to check duplicate
... View more
Currently we are checking data already exists in Splunk DB by isinstance method, here we need to iterate through entire data which is time consuming, Is there any best way to check same data already exists in Db to avoid duplication.
... View more
Basically we are taking same cred in all 5 data input. So I want to combine them and segregate using performance and inventory data using 2 different time intervals. Yes existing 5 inputs are Python based modinputs. This in our custom app.
... View more
Hi Team, How to combine multiple data input into one, basically I am having 5 different data inputs where I am taking same data from User. How to combine all data input into one data input. I want One data input where I will internally run 2 different data type with different polling interval. Is this possible with python SDK and How? Different polling intervals for “performance” and “inventory” data
... View more
How I can repair Data input index to normal state. I created Data input as per my Technical Add on , for some reason I changed my index in inputs.conf to new index, which apparently doesnt work in Splunk 9.3 though I created new index from UI. Later I changed my index to original but somehow that Data input stuck and never executing at all. I tried reinstalling my TA app and splunk restart multiple time but no luck and no error in spulnkd.log. Same scenario happened at client end. Can anybody please guide me for this repair or what can be RCA though we reverted all inputs to normal.
... View more
Hi @marnall , We are using Splunk python sdk in our App to configured custom data inputs. Please check below link for reference. https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtocreatemodpy/ Issue here is during creation or editing data input Stream_event function is called and it called after specific interval of time as well like each 15 min. We need to identify in Stream_event function from where it gets called, so accordingly we have 2 different algorithm to execute.
... View more
Hi @thellmann , We have our hosted apps on Splunk Enterprise and vetting is also completed and passed successfully. How can I unit test that app over splunk cloud without license or using any Dev license before release. Any workaround for this?
... View more