Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About i2sheri
i2sheri
Communicator
Member since:
04-28-2015
06-05-2020
Community Statistics
| Posts | 42 |
| Solutions | 6 |
| Karma Given | 10 |
| Karma Received | 4 |
| Member Since | 04-28-2015 |
Activity Feed
- Karma How do I upload a file to a custom REST API endpoint? for fanatic. 06-05-2020 12:49 AM
- Karma Re: access custom Rest endpoint using javascript for lweber. 06-05-2020 12:47 AM
- Karma How to extract multivalue fields in multiple events from xml data? for chironc. 06-05-2020 12:47 AM
- Karma Re: How to extract multivalue fields in multiple events from xml data? for somesoni2. 06-05-2020 12:47 AM
- Karma Why am I getting "Status 401 call not properly authenticated" running a search using the Splunk Java SDK 1.4.0.0? for dimitrkovalsky. 06-05-2020 12:47 AM
- Karma Setting requireClientCert = true prevents "Splunk Add-on for Java Management Extensions" from communicating with splunkd for DimasSouza. 06-05-2020 12:47 AM
- Karma Re: Splunk App for VMWare: Why the DCN doesn't seem to collect anything? for belka. 06-05-2020 12:47 AM
- Karma Re: Parse XML file with repeating events and indexed as one event for somesoni2. 06-05-2020 12:47 AM
- Got Karma for Re: TransformsExtractionHandler - Unable to find stanza. Getting thousands of warnings in _internal splunkd. 06-05-2020 12:47 AM
- Got Karma for Re: splunk indexer does not show events from all indexes from same forwarder. 06-05-2020 12:47 AM
- Got Karma for Re: How do I parse my XML data in a single search?. 06-05-2020 12:47 AM
- Got Karma for Re: After deploying a new app to our search head cluster, why am I getting search error "Search process did not exit cleanly, exit_code=255"?. 06-05-2020 12:47 AM
- Karma Re: Add Custom Search Command to Search Help for Wiggy. 06-05-2020 12:46 AM
- Karma Re: Splunk App for Vmware 3.0 No data displayed for abhide_splunk. 06-05-2020 12:46 AM
- Posted Re: How do I upload a file to a custom REST API endpoint? on Getting Data In. 02-10-2020 05:21 AM
- Posted Re: How to use .splunkrc with Python SDK on Splunk Dev. 09-06-2016 07:06 PM
- Posted Re: Is there a way to distribute cluster-bundle through REST API? on Getting Data In. 06-28-2016 03:05 AM
- Posted Re: Is there a way to distribute cluster-bundle through REST API? on Getting Data In. 06-23-2016 02:07 AM
- Posted Re: Add Custom Search Command to Search Help on Splunk Search. 12-21-2015 10:11 PM
- Posted Re: How to run Splunk searches in a custom REST endpoint? on Splunk Search. 12-20-2015 09:04 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-10-2020
05:21 AM
I am also interested in this.
... View more
09-06-2016
07:06 PM
my bad.
I couldn't find link to these instructions so I copy pasted from README.md file from python SDK. Any ways now I have given the link to github page. Please feel free to provide splunk docs link, I did not find it.
... View more
06-28-2016
03:05 AM
Just checked with splunk support and Its not possible.
... View more
06-23-2016
02:07 AM
can we use --skip-validation if we use this rest point
... View more
12-20-2015
09:04 PM
I've tried singleshot search to services/search/jobs end point with python requests and it works.
... View more
12-20-2015
09:04 PM
I've already tried singleshot search to services/search/jobs end point with splunk.rest.simpleRequest() but I did not receive results. No luck with /services/search/jobs/export endpoint too.
... View more
12-20-2015
06:01 PM
1 Karma
I used the deployment server to deploy new app. extract the new app to etc/shcluster/apps/ and then apply shclusterbundle.
This command says it might restart the search heads, but it doesn't. So I've manually restarted one search head, launched new app and noticed this error.
Problem solved after restarting the other search heads. Before restarting the Captain, it (and other heads in cluster) doesn't know the new app, hence this error message. But i found this error message in Indexers log (inspect search->indexer log file) misleading me to deploy the app to indexer cluster before restarting all search heads.
I am not sure why this error appeared in search logs from indexers.
PS: I've noticed this on the same day, but could not post an update, sorry for the delay and thanks for the help
... View more
12-20-2015
05:57 PM
I used the deployment server to deploy new app. extract the new app to etc/shcluster/apps/ and then apply shclusterbundle.
This command says it might restart the search heads, but it doesn't. So I've manually restarted one search head, launched new app and noticed this error.
... View more
12-16-2015
06:58 PM
I can search on command line of indexer
./bin/splunk search 'index=*|head 10' -app reports
... View more
12-16-2015
06:49 PM
No results
index=_internal source=*searches.log log_level=WARN OR log_level=ERROR
... View more
12-16-2015
06:34 PM
Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
I've deployed a new app to our search head cluster and searches in this app are failing with above error.
The log files from all indexers says
ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: new_app
I've deployed the same app to indexer cluster
... View more
12-01-2015
10:17 PM
I have implemented a custom rest end point and it's working. Now I have another requirement to run Splunk searches in the same rest end point, so I would like to know the best practice for it.
I've tried calling search/jobs rest point, but I do not see actual search results
... View more
11-25-2015
07:56 PM
thanks, works with 6.3.
I can use this solution to get rid of frame work app, which does not work with requireClientCert=true and is deprecated now.
... View more
11-25-2015
01:41 AM
where did you link this end point to your python code ? in restmap.conf ?
... View more
11-25-2015
12:09 AM
also when requireClientCert=true is enabled the service = client.connect() fails
any information on this ?
... View more
11-04-2015
12:50 AM
Any solution or workaround for this problem without setting requireClientCert = false
... View more
11-04-2015
12:50 AM
it is a problem for python sdk too.
https://github.com/splunk/splunk-sdk-python/issues/123
Any solution for this problem without setting requireClientCert = false
... View more
10-09-2015
03:33 AM
Please see https://github.com/splunk/splunk-sdk-python/blob/master/README.md for detailed instructions.
... View more
10-09-2015
01:50 AM
1 Karma
Small correction, I cannot edit your answer
your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail
... View more
10-04-2015
07:53 PM
I want below from total/tag( or any other tag in ) in one search query
C 12 12
A 12 12
X 4 8
Y 8 10
with out joining above queries
... View more
10-02-2015
02:52 AM
I've an xml wth below structure
<root><stats>
<total>
<stat pass="12" fail="12">C</stat>
<stat pass="12" fail="12">A</stat>
</total>
<tag>
<stat pass="2" fail="4">X</stat>
<stat pass="10 fail="8">Y</stat>
</tag>
<more-sets/>
</stats></root>
What I need
...| table type fail pass
I can get this separately with below search (replace total with tag and so on)
base search | table root.stats.total.stat* | rename root.stats.total.stat{@*} as *
| eval temp=mvzip('root.stats.total.stat', mvzip(fail, pass, "#"), "#") | table temp | mvexpand temp
| rex field=temp "(?<Total>.*)#(?<Fail>.*)#(?<Pass>.*)" | fields Total Fail Pass
Is there a way to do it in single search ?
... View more
10-02-2015
02:34 AM
I've same problem. But I've the props.conf setting only on heavy forwarders and search heads. Do I need these settings on indexers too ?
[xml]
KV_MODE = xml
DATETIME_CONFIG = NONE
BREAK_ONLY_BEFORE = ^\<?xml
MAX_EVENTS = 500
TRUNCATE = 25000
... View more
09-28-2015
08:03 PM
Thanks @abhide # 3 is very helpful, I missed the roles for my user.
Now I see data but no performance data
... View more
