Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spyme72
spyme72
Path Finder
Member since:
04-25-2013
06-05-2020
Community Statistics
| Posts | 29 |
| Solutions | 1 |
| Karma Given | 9 |
| Karma Received | 8 |
| Member Since | 04-25-2013 |
Activity Feed
- Karma Re: How to access data from a Lookup table in another app to a custom dashboard in ES? for richkappler. 06-05-2020 12:49 AM
- Karma Re: Sideview Utils: How to display a button based on a field returned by a search result? for sideview. 06-05-2020 12:47 AM
- Karma Re: After migrating CSV lookups to kvstore, why does the lookup command no longer output results in a search? for jacobwilkins. 06-05-2020 12:47 AM
- Karma Re: Rest call for KV Store for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: How to display a button based on a field returned by a search result?. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: How to display a button based on a field returned by a search result?. 06-05-2020 12:47 AM
- Got Karma for After migrating CSV lookups to kvstore, why does the lookup command no longer output results in a search?. 06-05-2020 12:47 AM
- Got Karma for After migrating CSV lookups to kvstore, why does the lookup command no longer output results in a search?. 06-05-2020 12:47 AM
- Got Karma for Re: After migrating CSV lookups to kvstore, why does the lookup command no longer output results in a search?. 06-05-2020 12:47 AM
- Got Karma for Why does using Sideview Utils SearchControls module to export data into a CSV not work for any roles other than admin?. 06-05-2020 12:47 AM
- Got Karma for Does the map command support real-time search and is it streaming?. 06-05-2020 12:47 AM
- Got Karma for How to provide permissions for kvstore lookups?. 06-05-2020 12:47 AM
- Karma Re: How to monitor a windows service, send an alert and restart the service? for dwaddle. 06-05-2020 12:46 AM
- Karma Re: Extract Json data for somesoni2. 06-05-2020 12:46 AM
- Karma Re: creation of new index through ds not working for lguinn2. 06-05-2020 12:46 AM
- Karma Re: need to handle .ear files in splunk for Damien_Dallimor. 06-05-2020 12:46 AM
- Karma Re: custom javascript in an app for sideview. 06-05-2020 12:45 AM
- Posted How to provide permissions for kvstore lookups? on Splunk Search. 06-22-2015 01:42 PM
- Tagged How to provide permissions for kvstore lookups? on Splunk Search. 06-22-2015 01:42 PM
- Tagged How to provide permissions for kvstore lookups? on Splunk Search. 06-22-2015 01:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
06-22-2015
01:42 PM
1 Karma
I am setting up permissions for kv store collections.
I tried to give permission in local.meta in my app for all the collections, but still getting
" Error in 'outputlookup' command: the lookup table ' permission denied for collection 'win-l1'" is invalid
Please let me know how to provide permissions for kvstore lookups.
local.meta
[lookups]
access = read : [ * ], write : [ admin, win-l1,win-l2 ]
... View more
06-01-2015
07:01 AM
1 Karma
thanks a lot.. removing case_sensitive_match worked..
... View more
05-28-2015
07:13 AM
2 Karma
i am currently migrating all the csv to kvstore.
when i do an inputlookup or outputlookup, it works perfectly fine and returns the results.
but when i use the lookup in my search it doesn't do the lookup. The same search works fine when i use .csv.
This search works
index=perfmon counter="% Processor Time" | lookup windowsperfmon.csv counter OUTPUT playbook | table counter playbook
counter playbook
% Processor Time Page Windows Server Support
% Processor Time Page Windows Server Support
% Processor Time Page Windows Server Support
This doesn't work
index=perfmon counter="% Processor Time" | lookup windowsperfmon counter OUTPUT playbook | table counter playbook
counter playbook
% Processor Time
% Processor Time
% Processor Time
% Processor Time
collections.conf
[windowsperfmon]
enforceTypes = true
field.xxx = string
field.yyy = string
field.zzz = string
field.status = string
field.email = string
field.object = string
field.counter = string
field.instance = string
field.trigger = string
field.threshold = number
field.severity = string
field.time_freq = string
field.occurrence = number
field.playbook = string
Transforms.conf
[windowsperfmon]
external_type = kvstore
collection = windowsperfmon
fields_list = _key,xxx,yyy,zzz,status,email,object,counter,instance,trigger,threshold,severity,time_freq,occurrence,playbook
case_sensitive_match = false
... View more
05-19-2015
11:57 AM
The KVStore could be present inside an app and you may be running the search from search app.
The search is not able to reach the kvstore. try running the search from the app where the kvstore is created.
... View more
02-23-2015
05:59 AM
1 Karma
I am trying to use the map command to trigger a new search each time a new event comes through to Splunk. The new search would be a saved search which triggers an email.
The whole search works for the initial set of data in the index, but when new data comes in, the saved search is not triggered. Does the map command support real-time search and is it streaming?
search
index=abc |fields to,subject,message
|map savedsearchabc
saved search
|sendemail to="$Address$" subject="$msg$" message="$msg$
... View more
02-10-2015
12:27 PM
this is the view i am using. it uses a saved search along with postprocess
View
Adhoc
<param name="filter">*</param>
<param name="maxSize">2</param>
<param name="clearOnJobDispatch">False</param>
<param name="html"><![CDATA[
<h1>Adhoc Search</h1>
]]></param>
<module name="SavedSearch">
<param name="name">WaasMonitoring-30d</param>
<module name="HTML">
<param name="html">
<b>
</module>
<module name="TextField">
<param name="float">left</param>
<param name="name">EventCode</param>
<param name="label">EventCode</param>
<param name="template">EventCode="$value$"</param>
<module name="TextField">
<param name="name">NetworkCode</param>
<param name="label">NetworkCode</param>
<param name="template">NetworkCode="$value$*"</param>
<module name="TextField">
<param name="float">left</param>
<param name="name">Site</param>
<param name="label">Site</param>
<param name="template">Site="$value$"</param>
<module name="TextField">
<param name="name">location_id</param>
<param name="name">location_id</param>
<param name="label">Location Id</param>
<param name="template">location_id="$value$"</param>
<module name="TextField">
<param name="float">left</param>
<param name="name">SiteTier</param>
<param name="label">SiteTier</param>
<param name="template">SiteTier="$value$"</param>
<module name="TextField">
<param name="float">left</param>
<param name="name">SiteCategory</param>
<param name="label">SiteCategory</param>
<param name="template">SiteCategory="$value$"</param>
<module name="TextField">
<param name="name">Site_SubCategory</param>
<param name="label">Site SubCategory</param>
<param name="template">Site_SubCategory="$value$"</param>
<module name="HTML">
<param name="html"><![CDATA[
Note : Search is run for the past 30 days.
Wildcards can be used ]]>
<module name="Button">
<param name="allowAutoSubmit">False</param>
<module name="PostProcess">
<param name="search"><![CDATA[
search $EventCode$ $NetworkCode$ $Site$ $location_id$ $SiteTier$ $SiteCategory$ $Site_SubCategory$ | table _time EventCode priority NetWorkCode location_id Region Site SiteStatus SiteTier SiteCategory Site_SubCategory]]>
<module name="Pager">
<param name="maxPages">50</param>
<param name="count">20</param>
<module name="Table">
<module name="SearchControls">
<param name="sections">export </param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
... View more
02-10-2015
12:24 PM
thanks a lot for the response.
i am using splunk 6.2 and sideview utils 3.3..
any help on how to fix it?
... View more
02-10-2015
06:58 AM
1 Karma
i am using Sideview SearchControls module to export data from table into csv.
It works fine when i am the admin but it doesnt work for any other roles.
The file gets exported for other users but they get the following error message in the csv.
Can anybody help me to find the appropriate role for this capability?
ERROR:
<msg type="FATAL">User 'guest' could not act as: rkbask_na_p</msg>
... View more
01-06-2015
01:49 PM
I am trying to make rest call for KV store through python but i am having some issues.
I am new to python and rest call hence any help would be great.
i am trying to execute the following but i am not able to successfuly make the rest call.
am not sure what should be passed with data in the urllib2.Request.
I am getting the following exception.
exception:
Traceback (most recent call last):
File "httptest.py", line 19, in
request = urllib2.Request(base_url + '/servicesNS/nobody/XXX/storage/collections/data/windows_perfmon' % (username),
TypeError: not all arguments converted during string formatting
python program:
import sys
import sys, os, random, json, collections, time
import urllib, urllib2
from xml.dom import minidom
base_url = 'https://XXX:8089'
username = 'XX'
password = 'XX'
request = urllib2.Request(base_url + '/servicesNS/%s/search/auth/login' % (username),
data = urllib.urlencode({'username': username, 'password': password}))
server_content = urllib2.urlopen(request)
session_key = minidom.parseString(server_content.read()).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue
request = urllib2.Request(base_url + '/servicesNS/nobody/myapp/collections/data/windows_perfmon' % (username),
data ,
headers = { 'Authorization': ('Splunk %s' %session_key)})
search_results = urllib2.urlopen(request)
print search_results.read()
... View more
12-26-2014
08:01 AM
I am new to KV store,
I am trying to delete a key from the key value store using the rest call in splunk search window.
I am able to access my KV store from search bar using the following search command.
| rest /servicesNS/nobody/Monsanto-Monitoring-SelfService/storage/collections/config/windows_perfmon
but i am not sure how to use the GET POST and DELETE methods.
i tried the following searches but i was not sucessful,
| rest /servicesNS/nobody/Monsanto-Monitoring-SelfService/collections/data/windows_perfmon/549c692b6dfa175b773a2736 GET
| rest /servicesNS/nobody/Monsanto-Monitoring-SelfService/collections/data/windows_perfmon/549c692b6dfa175b773a2736 DELETE
please let me know the right way to call these rest api.
... View more
09-10-2014
07:33 AM
awesome that's good to know.
... View more
09-08-2014
08:41 AM
2 Karma
i want to display a button in my view and i am using Sideview utils.
i want the button to be displayed based on a field returned by a search result.
example:
index=abc | fields user, status,tobedeleted
if the field tobedeleted is true i want to display a button,else i dont want the button to be displayed.
... View more
07-17-2014
10:58 AM
i want to call a python script on the click of the button.
i have used sideview utils to setup the table and the button but i was not able to successfully call the python script.
I tried to use create a custom search but it returns an error.i want to invoke a search command and create a new event based on the key passed in the search.
search command used : | ack key
error: External search command 'ack' returned error code 1.
python script used
import sys, os, random, json, collections, time
sys.path.insert(0, os.path.join(os.path.dirname(file), "..", ".."))
import splunklib.client as client
from datetime import datetime, timedelta
import splunk.Intersplunk
def post(event):
print "connecting\n"
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
index = service.indexes['spogops']
index.submit(event, sourcetype='py-event')
splunk.Intersplunk.outputResults(event)
def acknowledge_e():
result = splunk.Intersplunk.readResults(None, None, false)
a = []
u_event = {}
u_event['key'] = sys.argv[1]
u_event['status'] = "Acknowledged"
u_event['date'] = datetime.utcnow().isoformat()+"Z"
ju_event = json.dumps(u_event)
a.append(ju_event)
post(ju_event)
print 'Posted ', ju_event
return a
acknowledge_e()
... View more
01-07-2014
08:39 AM
thanks for the response.
i am getting an exception in the configure input screen.
"Encountered the following error while trying to save: In handler 'command': Command name md5sum does not exist"
... View more
12-29-2013
09:40 PM
Hi Could you please let me know on how to use the Command Modular input.
I was not able to find any details documentation on how to use it.
i found that it was a TA and i was not sure on how to reach the command screen as shown in the screen shot.
... View more
12-04-2013
12:04 PM
i want to compare the .ear file present in production with the UAT environment in splunk.
i know there is a md5 command in eval function but i need to specify a field for it.
has anyone implemented anything similar where they compare zip ,war,ear files.
... View more
11-11-2013
11:55 AM
i think i have not posted my question clearly..
inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query
my second query is
index=equivalency sourcetype=json | spath | stats list() as | transpose
which would result all the fields in the JSON.
i want to pass the fields from the first query to the second query to filter the JSON data.
... View more
11-11-2013
11:12 AM
i think i have not posted my question clearly..
inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query
my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.
i want to pass the fields from the first query to the second query to filter the JSON data.
... View more
11-11-2013
11:12 AM
i think i have not posted my question clearly..
inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query
my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.
i want to pass the fields from the first query to the second query to filter the JSON data.
... View more
11-11-2013
11:11 AM
i think i have not posted my question clearly..
inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query
my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.
i want to pass the fields from the first query to the second query to filter the JSON data.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
