I am using Splunk version 7.3.2. I am trying to find the runtime input configuration on a Splunk heavy forwarder using Rest API endpoint. I have noticed a difference in results when accessing the input configuration on a heavy forwarder using btool in comparison to Splunk API endpoint. Some of the monitoring input stanzas that appear on the Splunk instance when using btool are not part of the API call results. Rest API Call: The Rest API call uses the ‘GET’ method to retrieve the configured inputs from the endpoint ‘https://somethingishere:8089/services/data/inputs/monitor’. The btool command: Command used for ‘btool ‘ and filtered on the keyword syslog: ./splunk btool inputs list Is there an endpoint to capture the current running monitor input configurations?? ..or another way of doing this. ... View more

I am using a bin command on _time field to have 10 minute sections of data. Like below: |bin _time span=10m minspan=10m | stats sum(myField) as myField by _time |streamstats avg(myfield) as avg by another field I am trying to compare the most current value in the completed 10 minute block with the average of 10 minute blocks of data. My understanding is that span should create 10 minute buckets on the data and minspan should filter out buckets that are not 10 minute yet. So if right now its 10.25 then the bucket that is for 10.20 should not be created. But that is not the case, I am getting the 10.20 bucket that has partial values data comparing to the average. Any workaround or a better options or a much efficient way of doing this will be very helpful. Thanks in advance!! ... View more

I am fairly new to python and I am trying to use a python script to get the health of my HEC in JSON format. When I am using a curl command like below: curl -k -s -u 'username:password' -X GET https:myServername:8088/services/collector/health I get the below response: {"text":"HEC is healthy","code":17} But when I am using the same command in python to get json event such as above its giving me an error saying the "NO json objects could be decoded" and when I hash out the json.loads() variable from the below script, the output says in an html format "The request your client sent was too large". This might be sending me an html response no matter what. Can you please suggest how to get a JSON response from 8088 port for the /services/collector/health endpoint. python script below: !/usr/bin/python import json import os import re import sys import urllib import httplib2 import credentials import requests username = credentials.username baseurl = credentials.baseurl password = credentials.password hecBaseUrl = 'https://myServer:8088' myhttp = httplib2.Http(disable_ssl_certificate_validation=True) try: cmdurl = '/services/auth/login' serverResponse = myhttp.request(baseurl + cmdurl, 'POST', headers={}, body=urllib.urlencode({'username':username, 'password':password,'output_mode':'json'}))[1] print serverResponse parsed_json = json.loads(serverResponse) sessionKey = parsed_json['sessionKey'] print "sessionKey is %s" % sessionKey hecUrl = '/services/collector/health' totalUrl = (hecBaseUrl + hecUrl) print totalUrl hecServerResponse = myhttp.request(hecBaseUrl + hecUrl, 'GET', headers={}, body=urllib.urlencode({'output_mode':'json'}))[1] parsed_json_hec = json.loads(hecServerResponse) print parsed_json_hec print hecServerResponse except Exception, err: sys.stderr.write('Error: %s\n' %str(err)) ... View more

Hello, I am trying to write an SPL to do the below but hitting a road block. Can someone please help!! Date randomNumber 8/1/18 127 8/1/18 155 8/1/18 115 8/1/18 115 8/2/18 150 8/2/18 143 8/2/18 151 9/1/18 102 9/1/18 117 9/1/18 198 9/2/18 122 9/2/18 111 9/2/18 139 9/2/18 184 10/1/18 148 10/1/18 121 10/1/18 108 10/2/18 160 10/2/18 166 Scenario: Considering that the current month is October (10). I am trying to compare the current count of random numbers that I have received on the 10/1 and 10/2 to the average of the counts that I have received on the 1st and 2nd of September(09) and August(08). The results that I would get would be: day1Actual = 3 for October 1st day2Actual = 2 for October 2nd day1Average = 3.5 for August and September average (7 divided by 2) day2Average = 3.5 for August and September average (7 divided by 2) ... View more

I have a user who is getting an alert but when he clicks to view the alert he is able to go to the alert page, but when he clicks on "view results" on the alert page it takes him to search bar and says permission denied. He has access to the index where this alert is set up. He is also able to see the results pop up when he pastes the alert search query on the search bar. He also has access to the application and this alert is shared in the app. His permissions: Power User What can I do so that this user is able to see the results when clicking on the "View Results" button on the alert page. Your help is much appreciated. Thanks, Rohit ... View more

I have a .html file that I need to show as a panel on a dashboard. I have been searching quite a bit and have not been able to find anything that seems to relevant. Can this be done on Splunk? If yes, please explain how to do it in as much detail as possible. Please let me know if you need any more information. Thanks in advance. ... View more