About ppeeters_splunk

ppeeters_splunk · ‎01-28-2022

I uploaded the source code to https://github.com/bakermat/ta_garmin. I was hoping it was just a matter of updating the `garminexport` package to the latest version (0.4.0) but even with that I'm still getting an authentication error. I see the upstream package also has reports of authentication issues, so perhaps Garmin changed the authentication again. Unfortunately I don't have the bandwidth to look at this further, however I welcome pull requests. In the meantime you can use the Strava app as a workaround as suggested if you're only after activities.

ppeeters_splunk · ‎01-28-2022

I'm the developer of the app. I stopped using Garmin so wasn't aware it stopped working until a colleague mentioned it and I found this issue. I will update the app and release a new version and publish it on GitHub shortly, stay tuned. In the future you can then use GitHub's pull requests or issues to flag items like these.

ppeeters_splunk · ‎06-19-2021

The docs example for Dashboard Studio on docs.splunk.com seems to do exactly what you want, although I guess you found that as your code looks very much like it. They have a default value but you can remove that, as you have done in your code. I tried it with success in my own environment a few days ago on 8.2.0, what is your search from ds_applications returning? With your code below both the value and label are the first result that come up (e.g. primary[0])

ppeeters_splunk · ‎11-17-2020

Managed to get it done via Python's pandas module, specifically pandas.DataFrame function. It works great for series and dataframe data like the one I had. The result: [ { "time": 1580539600, "distance": 0, "altitude": 45.7, "heartrate": 77, "lat": -33.895302, "lon": 151.228177 }, { "time": 1580539601, "distance": 0, "altitude": 45.7, "heartrate": 77, "lat": -33.895302, "lon": 151.228177 }, { "time": 1580539602, "distance": 0, "altitude": 45.7, "heartrate": 77, "lat": -33.895325, "lon": 151.22817 } ]

ppeeters_splunk · ‎11-16-2020

I got it by importing the Script class and using the following line: from splunklib.modularinput import Script, Scheme, Argument, Event session_key = self._input_definition.metadata["session_key"]

ppeeters_splunk · ‎11-16-2020

I assume you tried something like this to get the output? args = {'token': 'your_session_key'} service = client.connect(**args) for storage_password in service.storage_passwords: if storage_password.username == username and storage_password.realm == 'your_app': clear_pw = storage_password.content.clear_password That works in my case. I've seen something like your output when analysing passwords/secrets that I used when coding using the Splunk Add-on Builder but it's been a long time so not sure if it's related.

ppeeters_splunk · ‎11-16-2020

I have a JSON input with different types, all representing a data point at a certain time. I have the start time of the event and am looking for a way to get all the data organised without having to revert to custom Python code - how do I do this? The 'time' type in JSON depicts how many seconds since the start time a data point is happening across all these types. Ideally I'm looking for something that looks like this based on the data below assuming the start time is 12:00:00, probably latlng even split but that's secondary for now: _time distance altitude latlng 12:00:00 3.8 51.5 -33.895627, 151.228228 12:00:01 5.2 51.6 -33.895627, 151.228228 12:00:03 6.7 51.5 -33.895627, 151.228228 12:00:04 8.9 51.5 -33.895627, 151.228228 [ { "type": "time", "data": [ 0, 1, 3, 4 ] }, { "type": "distance", "data": [ 3.8, 5.2, 6.7, 8.9 ] }, { "type": "altitude", "data": [ 51.5, 51.6, 51.5, 51.5 ] }, { "type": "latlng", "data": [ [ -33.895627, 151.228228 ], [ -33.895627, 151.228228 ], [ -33.895627, 151.228228 ], [ -33.895627, 151.228228 ], ] }, ]

ppeeters_splunk · ‎05-28-2020

That just means ll doesn't exist. Please do some more troubleshooting or provide steps of what you've done so far, as mentioned it works fine on my instance.

ppeeters_splunk · ‎05-28-2020

And you are in the actual container and not in your VM? use the Docker exec command from above.

ppeeters_splunk · ‎05-28-2020

Are you actually setting a password and are you in the Docker container? Both commands work fine for me, granted I set SPLUNK_PASSWORD=password to get started, otherwise it won't work.

ppeeters_splunk · ‎05-28-2020

It depends on how you setup and run the scripts, e.g. inside Splunk or from outside Splunk etc. and who's running or executing them. Too many variables to discuss on the forum, I recommend reading the documentation to see what's possible and how to do it.

ppeeters_splunk · ‎05-28-2020

I'm not too familiar with the exact syntax to refresh or kill jobs so can't help you with that, apart from advising you to look at try, except, continue blocks. Keep in mind though that your query is generating ~500MB of disk space (at times, seemingly not always) so unless you do something about the query or increase the disk space there is little you can do. Worst case is that you catch the error and ignore it, and continue with other operations in case the script needs to do those. You can't 'undo' the quota anyway and restarting the same query will likely result in the same error anyway. I recommend looking at the API documentation or at the SDK examples, I don't know this off the top of my head.

ppeeters_splunk · ‎05-28-2020

The correct directory on a UF is /opt/splunkforwarder/ , you can use .bin/splunk start from there. Keep in mind the default user is ansible when logging in with docker exec -it uf /bin/bash , that user has restricted rights.

ppeeters_splunk · ‎05-28-2020

Ah ok, in my case I had already used sourcetype=_json when indexing the data. In that case you can use | rex field=_raw mode=sed "s/\\\n/\n/g" as there is no log field. It won't make it pretty JSON format though, just show the event slightly better. The issue you'll have is that the log field is not proper JSON in the first place, it's just a long string. You might get it to work with some regex trickery or in a complex way but you might be better off seeing if you can get the source data properly formatted first.

ppeeters_splunk · ‎05-28-2020

Case 1 Well to catch that particular error, you'll have to do something like below. However the biggest issue you have is that you're running over the disk quota for that search. Even if you catch the error (and you can continue or retry for example) you're probably better off addressing the root cause in the first place. try: <do something> except HTTPError as e: <try something else, or wait and try again> Case 2 This is a separate issue but it's pretty straightforward, you have to convert the OrderedDict to a JSON object, which can be done with json.loads . json_payload = OrderedDict([('id', '1'), ('name', 'my_name')] json.dumps(json_payload, default=str) Please try to use code blocks whenever you're pasting code, it's much easier to read and to assist.

Posts	24
Solutions	1
Karma Given	4
Karma Received	1
Member Since	‎12-18-2019

Online Status	Offline
Date Last Visited	‎11-02-2022 09:09 AM

Correlate data in JSON file without timestamp

Re: Garmin Add-On for Splunk Issue

Re: Garmin Add-On for Splunk Issue

Re: Dashboard Studio: populate dropdown via dataso...

Re: Correlate data in JSON file without timestamp

Re: Python SDK - getting username and password (wi...

Re: Python SDK - getting username and password (wi...

Correlate data in JSON file without timestamp

Re: UF installation in docker

Re: UF installation in docker

Re: UF installation in docker

Re: Splunk SDK Python error handling on quota err...

Re: Splunk SDK Python error handling on quota err...

Re: UF installation in docker

Re: In a JSON Payload, parse out \n to newline

Re: Splunk SDK Python error handling on quota err...