About akew

akew · ‎04-01-2022

You can get the index from the title field, and also filter for enabled (isReady) or internal indexes. Also, run a stats on the list to remove duplicates from different internal Splunk paths on each "index": | rest /services/data/indexes ``` remove internal indexes from the list (if needed)``` | search isInternal=0 | fields title id isInternal isReady | rename isReady as enabled | stats count by title, enabled | fields - count

akew · ‎02-16-2022

This answer solves an issue I am having. I like the way this is structured. @woodcock, if I'm reading this correctly (and a test verifies this), as soon as a condition fires, all other conditions are ignored. There is no nesting her, but an elegant trigger condition, or an "else" condition that fires to do other business logic (show/hide here). Very nice.

akew · ‎10-01-2021

Hi, I am trying to install the ITSI Module for Kafka smart monitoring App, and its related Kafka streaming platform logging management TA, but I received notification from my support case that the app/addon is incompatible for jQuery reasons. The TA came back with unspecified incompatibilities. Guilhem Marchand is the author of the work. Does anyone know if the TA/App combo is being maintained? Thanks in advance, Alex

akew · ‎01-11-2021

I used this query to list all the scheduled searches (alerts) I had in Splunk using the MS Teams alert action: | rest /services/saved/searches | search action.ms_teams_publish_to_channel=1 disabled=0 | table title author disabled action.ms_teams_publish_to_channel.param.alert_ms_teams_activity_title action.ms_teams_publish_to_channel.param.alert_ms_teams_fields_list, action.ms_teams_publish_to_channel.param.alert_ms_teams_fields_order | sort disabled | where isnull('action.ms_teams_publish_to_channel.param.alert_ms_teams_fields_order') Since I couldn't figure out a way to get the name of the scheduled search (for the REST query), I updated all alerts that were missing the parameter by hand, and set the ms_teams_fields_order parameter. if there is an easier way, or if anyone knows how to get the name of the alert (for REST endpoints, not the alert title), please let me know.

akew · ‎01-07-2021

Hi all, I recently had our MS Teams Alert Action addon upgraded from 1.0.11 to 1.0.18, and have been seeing errors with older alerts due to a missing parameter, this one: action.ms_teams_publish_to_channel.param.alert_ms_teams_fields_order What indicates this missing parameter failure is this error message in the MS Teams App → Logging Reports → MS Teams - modular action failures menu that contains this: signature="Error: 'in <string>' requires string as left operand, not NoneType. Please double check spelling and also verify that a compatible version of Splunk_SA_CIM is installed." action_name="ms_teams_publish_to_channel" The fix appears to be going in to the MS Teams action through the alert interface, and toggling the field ordering dropdown, this adds the missing parameter. Is there a way to review all the existing alerts in my Splunk Cloud instance, and check for a missing parameter? Thanks in advance, Alex.

Posts	5
Solutions	0
Karma Given	8
Karma Received	1
Member Since	‎02-19-2020

Online Status	Offline
Date Last Visited	‎04-01-2022 08:53 PM

ITSI Module for Kafka smart monitoring - not able ...

MS Teams Alert Action - failures after upgrade fro...

Re: Is it possible to get a list of available indi...

Re: Set multiple tokens using "condition match"

ITSI Module for Kafka smart monitoring - not able ...

Re: MS Teams Alert Action - failures after upgrade...

MS Teams Alert Action - failures after upgrade fro...