Here is my situation. I can use subsearch to get two column data, just like below. Data row is not aligned, so I can't simply use eval if to compare. Some of the value is identical, but some is not. I want to output the value existing in col1, but not exist in col 2 column1 column 2 AA            BB CC           AA DD           FF EE            ZZ FF            XX VV          MM ... View more

Deleted ... View more

Hello,   We have two deployment-App, named A and B.  They both have inputs.conf to monitor path /log/A and /log/B. If I use deployment server to push either A or B, it works fine. But If I push both A and B to the clients, only App path /log/A or /log/B is being monitored. Is this because two app's inputs.conf are located in /default folder?   Thanks, Mike ... View more

Deleted ... View more

I can't get any data from Azure . I understand that need to configure connection string and Event Hub name, but there is nothing show, even in internal index Paste the connection string from Step 1 Paste the Event Hub name from Step 2 From the server side, I can see traffics are being exchanged, assumed the connectivity is good. Is there anyway I can troubleshoot this issue to see what's going wrong? # tcpdump -i any host hsbc-multi-shrd-01-euw-evhub-mon-01.servicebus.windows.net -t tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [P.], seq 1506474280:1506474345, ack 958390525, win 340, length 65 IP gbl20060520.hc.cloud##########.35028 > 10.102.144.196.amqps: Flags [P.], seq 871485393:871485446, ack 2983679033, win 1027, length 53 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35032: Flags [P.], seq 2685114633:2685115149, ack 3374421201, win 2048, length 516 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35028: Flags [P.], seq 1:7589, ack 0, win 2048, length 7588 IP gbl20060520.hc.cloud##########.35028 > 10.102.144.196.amqps: Flags [.], ack 7589, win 1145, length 0 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35030: Flags [P.], seq 1:1962, ack 65, win 2048, length 1961 IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [.], ack 1962, win 370, length 0 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35030: Flags [P.], seq 1962:3630, ack 65, win 2048, length 1668 IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [.], ack 3630, win 397, length 0 IP 10.102.144.196.amqps > gbl20060520.hc.cloud##########.35030: Flags [P.], seq 3630:6891, ack 65, win 2048, length 3261 IP gbl20060520.hc.cloud##########.35030 > 10.102.144.196.amqps: Flags [.], ack 6891, win 447, length 0   Thanks, Michael ... View more

Deleted ... View more

I have a script that can be ran with alert, but if I run the script manually, the following error will showed. Any idea how I can run it manually? I have add the python location in first line. #!/data/splunk/bin/python [root@hostname scripts]# ./REST_1.py ERROR:root:code for hash sha1 was not found. Traceback (most recent call last): File "/data/splunk/lib/python2.7/hashlib.py", line 147, in <module> globals()[__func_name] = __get_hash(__func_name) File "/data/splunk/lib/python2.7/hashlib.py", line 97, in __get_builtin_constructor raise ValueError('unsupported hash type ' + name) ValueError: unsupported hash type sha1 Traceback (most recent call last): File "./REST_1.py", line 7, in <module> import requests File "/data/splunk/lib/python2.7/site-packages/requests/__init__.py", line 58, in <module> from . import utils File "/data/splunk/lib/python2.7/site-packages/requests/utils.py", line 25, in <module> from .compat import parse_http_list as _parse_list_header File "/data/splunk/lib/python2.7/site-packages/requests/compat.py", line 7, in <module> from .packages import chardet File "/data/splunk/lib/python2.7/site-packages/requests/packages/__init__.py", line 3, in <module> from . import urllib3 File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/__init__.py", line 16, in <module> from .connectionpool import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 36, in <module> from .connection import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/connection.py", line 43, in <module> from .util import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/util/__init__.py", line 10, in <module> from .ssl_ import ( File "/data/splunk/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py", line 2, in <module> from hashlib import md5, sha1 ImportError: cannot import name sha1 ... View more