About rroberts

rroberts · ‎03-30-2018

Marklar Marklar!!

rroberts · ‎07-24-2017

If you already have a token you can use the following construct. Or if you already have a session token s = client.Service(token="atg232342aa34324a") Check out: http://docs.splunk.com/DocumentationStatic/PythonSDK/1.5.0/client.html#splunklib.client.Service

rroberts · ‎07-24-2017

Have you tried event sampling? https://www.function1.com/2016/08/event-sampling-new-splunk-6-4-feature

rroberts · ‎07-24-2017

You could pass the arguments at run time : For example... import splunklib.client as client import sys if len(sys.argv) != 5: print "Syntax: login.py username password hostname port" sys.exit() uid = sys.argv[1]; pwd = sys.argv[2]; host = sys.argv[3]; port = sys.argv[4]; try: service = client.connect( username=uid, password=pwd, host=host, port=port) context=service.login() print 'Authenticated, token = [%s]' % service.token except Exception, err: sys.stderr.write('Error: %s\n' % str(err))

rroberts · ‎01-17-2017

This documentation might help: http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTsearch https://splunk.server.com:8089/services/search/jobs We also have an 8 hour SDK course covering REST API, etc ... http://www.splunk.com/view/SP-CAAAHSH Here's an example from the docs dispatching a search request: curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/search/jobs --data-urlencode search="search index=_internal source=*/metrics.log" -d id=mysearch_02151949 -d max_count=50000 -d status_buckets=300

rroberts · ‎01-13-2017

I think it has to do with the ..."Static assets for apps are cached on the client and server side. If you update an item in the /appserver/static directory, you can see changes by clearing both the client and server caches. See... http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/AdvancedDev/CustomizationOptions "http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/AdvancedDev/CustomizationOptions"

rroberts · ‎01-13-2017

Also, perhaps we can improve on the field extraction regex? Instead of using .* what exactly are you trying to extract? Word characters only? Digits?

rroberts · ‎01-13-2017

CDATA block is the way to go I think. Much easier.

rroberts · ‎10-25-2016

It seems to be taking much longer for dispatched search request to finalize. I see in search.log a lot of POST requests from Timeliner. Is Timeliner new in 6.5.0? 10-25-2016 23:01:47.210 INFO Timeliner - Sending POST request 'https://10.0.0.88:8089/services/search/remote/splunk02/1477436470.3/events?offset=231976&count=689' 10-25-2016 23:01:47.415 INFO Timeliner - https://10.0.0.88:8089 No work units available, moving to idle 10-25-2016 23:01:47.452 INFO Timeliner - Stats[10.0.0.88] 16 / 117.00 / 297.00 / 2879.00 / 558025.00 / 49.99 / 850457 10-25-2016 23:01:47.452 INFO Timeliner - Stats[10.0.0.99] 16 / 58.00 / 198.00 / 2179.00 / 362025.00 / 63.87 / 384405 10-25-2016 23:01:47.452 INFO Timeliner - Stats[Collections] 16 / 275.00 / 2872.00 / 24850.00 / 49518646.00 / 826.27 / 76817158 10-25-2016 23:01:47.459 INFO Timeliner - Stats[10.0.0.88] 1 / 93.00 / 0.00 / 93.00 / 8649.00 / 0.00 / 554549 10-25-2016 23:01:47.459 INFO Timeliner - Stats[Collections] 2 / 0.00 / 111.00 / 111.00 / 12321.00 / 55.50 / 291866418

rroberts · ‎09-21-2016

No, once youve download and installed the app and created a TA. The button within the app to download the TA doesnt work.

rroberts · ‎09-21-2016

Splunk Add-on Builder app download button doesn't work. (splunk_app_addon-builder 1.1.0) Splunk Version 6.4.3 (MacOS 10.11.6) After downloading and installing the app once Ive created a TA and Validated I cannot download the TA via the download button within the app.

rroberts · ‎05-18-2016

Same issue after upgrade to El Capitan.

rroberts · ‎01-26-2016

What version of ES are you on?

rroberts · ‎10-21-2015

It looks like this bug has already been reported to engineering as: SPL-93222 SPL-96621

rroberts · ‎10-20-2015

These are "matching terms" not matching previous searches. Shouldnt they be fetched from the index? In 6.2 I can see ..DEBUG SearchOperator: Typeahead ....loadtermsfromlex. In 6.3 when I put the SearchOperator:Typeahead in debug mode I dont see this "loadtermsfromlex" occurring. Also, to answer your question. I see my searchhead.csv file and it looks fine.

rroberts · ‎10-20-2015

I upgraded to Splunk 6.3 and it's working beautifully, however, I no longer get "matching terms" as I type in the search box. In previous versions of Splunk, if I typed: err in the search box, I would see error=300, errors=402, errored=23 as typehead matching terms. Now I only see the term error show up in "matching search". There seems to be no matching term as you search now? I have auto-open turned on the search assistant.

rroberts · ‎10-09-2015

Indeed. I could be wrong too!

rroberts · ‎10-09-2015

Yes, but you'll get the total repeated on each row with eventstats. I think he only wants the grand total displayed once?

rroberts · ‎10-09-2015

Have you tried adding ... | appendpipe [stats sum(count) as Total_Count]

rroberts · ‎10-09-2015

Splunk OOTB creates an audit trail in the audit index on config files: index=_audit sourcetype=audittrail *.conf NOT action=search You could create an alert off this search and you could also specifiy action values like add, update or delete.

rroberts · ‎10-09-2015

To enable notable event suppression for esanalyst role add edit-suppressions to the role and make sure they have write permission in the SA-ThreatIntelligence app.

rroberts · ‎10-02-2015

I would like to change the drilldown offset in my correlated search to last 10 minutes. Ive tried 10m in first offset box, but not sure what to put in the second offset box. Looks like the "Save" button is validating these fields and putting a "0y" in the second box? Why 0y? Shouldn't I be able to use now? Also, I notice you can use seconds IE 30s. It will automatically be changed to m (minutes)? Is this a correct assumption?

rroberts · ‎09-16-2015

1.They arent running in debug mode are they? 2. Have you upgraded or re-installed the UFs? (log.cfg will be overwritten. Use log-local.cfg instead.)

rroberts · ‎09-15-2015

Yes, the parameter element in the XML file is nested under a module called: "EntitySelectLister" param name="count" 250

rroberts · ‎09-15-2015

How many users do you have? The job_manager.xml file shows a count param of 250 max for that dropdown list.

Posts	299
Solutions	56
Karma Given	158
Karma Received	174
Member Since	‎04-28-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

After upgrading to 6.5.0, why are there so many Ti...

Splunk Add-on Builder: Why isn't the download butt...

Why does search typeahead no longer show "matching...

Splunk App for Enterprise Security 3.3.1: How to c...

Does SHC support ES app

Is this Splunk App for Stream free?

REST API endpoint for prebuilt panels doesnt seem ...

Is it possible to have a search string so long tha...

What is the purpose of fieldforLabel attribute?

Checking conf files for problems...

Re: So I get the obvious Simpsons reference but wh...

Re: How do I generate a session token that I can u...

Re: How to make Splunk stop searching after it fin...

Re: How do I generate a session token that I can u...

Re: We are getting an error when trying to create ...

Re: Custom CSS file not found

Re: How to improve Splunk search performance?

Re: passing two tokens using simple xml

After upgrading to 6.5.0, why are there so many Ti...

Re: Splunk Add-on Builder: Why isn't the download ...

Splunk Add-on Builder: Why isn't the download butt...

Re: Library no loaded

Re: Notable Event Metrics / SLA Tracking? (Dwell T...

Re: Why does search typeahead no longer show "matc...

Re: Why does search typeahead no longer show "matc...

Why does search typeahead no longer show "matching...

Re: How to add a separate column which displays th...

Re: How to add a separate column which displays th...

Re: How to add a separate column which displays th...

Re: How to create alerts for changes made on confi...

Re: Cannot suppress notable event

Splunk App for Enterprise Security 3.3.1: How to c...

Re: How to configure a universal forwarder to keep...

Re: In Activity -> Jobs -> Owner drop-down: Is the...

Re: In Activity -> Jobs -> Owner drop-down: Is the...

Are you a member of the Splunk Community?