Hi fellow Splunkers! I have a question about editing/customizing the Splunk manager menus for web editing my app files. I have my working app which includes this structure (two sql queries that I will execute within the folder myapp/bin/SQL like so: + bin .| -- + SQL .| --- | - query1.sql .| --- | - query2.sql My question is, if there is a simple and easy way of make a text editor for qyery1.sql and query2.sql from Splunk's web UI, using the Splunk's config files/xml as "parent". Like you normally modify your savedsearches using the web editor. So, in summary, I will have two screens/xml pages: - The first one, where I can see the list of available files in /myapp/bin/SQL like so: And the second one where I can modify and save any of those files, like if they where savedsearches: So I will be able to change the queries via Splunk Web just as I can modify the savedsearches. I just need an xml for listing the files and another one with a textfield editor and a save button. I can move the .sql files to other folder if necessary. I spent two days searching for some examples but I couldn't find any. Do you have any ideas or examples that I can use as a base? My main goal is to make it simple and as if it was a Splunk default configuration file. Thank you very much! ... View more

Hi, I'm having some trouble with the Django inheritance on my test/production environment Splunk instances. I'm using Splunk 6.3.1 with a 3 SHs cluster architecture. I have a base_app defined with all the styles and dashboards, and my_app which inherits some of the code of the base_app. Within django/base_app/templates/configuration_panels i have an html with a table, called riesgo.html, which draws a table with background colors. I have the same structure in django/my_app/templates/configuration_panels with the file riesgo.html too wich draws a table without background colors. The problem here and the weird thing is that, having the same files (for both the base_app and my_app) in the testing environment and in production, Splunk is drawing the my_app/riesgo.html (one without background colors) file. And, with THE SAME files in production, Splunk is, however, drawing the base_app/riesgo.html (the one with background colors) file. My question here is: why is happening that? Is there an explicit way to tell Splunk's Django to use the son's file instead of the parent's? I don't understand why, if I'm uploading THE SAME repository in test and pro, in test uses the "good" file and in pro uses the paren'ts base file. Thank you very much. Regards. ... View more

Hi Splunkers! I'm having trouble with the Splunk JMX App. I used to work with version 3.0.2 but I needed to make an update to the current version 3.1.0 due to my clients' needs. The thing is that, I had a lot of dashboards using tags for the values of the previous 3.0.2 version for the field source, like: source=service:jmx:rmi://myhost1/jndi/rmi://myhost1:port/jmxrmi source=service:jmx:rmi://myhost2/jndi/rmi://myhost2:port/jmxrmi And, since the update, as pointed out here: http://docs.splunk.com/Documentation/AddOns/released/JMX/Releasehistory#New_Features, now the source field from JMX connection string (e.g., service:jmx:rmi:///jindi/rmi://127.0.0.1:8888/jmxrmi) has changed to to JMX MBean ObjectName (e.g., kafka.server.ReplicaManager.UnderReplicatedPartitions). So, now, my source fields are like this: source=java.lang:type=Memory source=java.lang:type=OperatingSystem And my dashboards doesn't show info anymore, since I'm using the tags for that previous values of source, like "Area1" for myhost2, "Area2" for myhost2 and so on. I need to recover this, because there are like A LOT of monitoring info from A LOT of computers. So, my main question here is: Is there a way to "recover" in the current 3.1.0 version, the values of the source field like in the previous 3.0.2 version?? Or maybe there are still there but in another java bean or property and I need to configure de JMX sourcetype to take those values in the xml conf?? Is this possible or is a matter of the app and the development and it can't be changed anymore?? Thank you very much! ... View more