From 8.1 + : You can now use a more intuitive and better readable Syntax like index=main mysearchterm ```This is a comment``` | stats count by host   ... View more

Check out asset table on your ES app. This table contains field called "is_expected" which determines if host is going to be reported by the mentioned correlation search. If you are getting incorrect values as hostname check the asset table and update it as required. ... View more

Interesting, looking at the last error - TypeError: string indices must be integers . The following speaks about it - TypeError: string indices must be integers, not str ... View more

Thanks for the bug report. I've filed it and will get into a future release. ... View more

If I recall correctly, the map name was set within Intermapper and got imported during the Configure App process. It may have been possible to edit the files after this process, but the Configure App process didn't parse it properly. ... View more

Edit the lines relating to logging near the top of loadImData.py to; if debug: logger.basicConfig(level=logger.DEBUG, format='%(asctime)s log_level=%(levelname)s %(message)s',filename=os.path.join(dirname(__file__),'..','local','imDebugLog.log'),filemode='a') else: logger.basicConfig(level=logger.INFO, format='%(asctime)s log_level=%(levelname)s %(message)s',filename=os.path.join(dirname(__file__),'..','local','imAppLog.log'),filemode='a') where the lines after if debug and else: are on a single line and not wrapped as above 🙂 A new version with a fix should hopefully be coming shortly, in the meantime this will fix it up. ... View more

Hello, I used the following modification in /etc/profile PROMPT_COMMAND='logger -i -p local5.info -t bash "$USER $(tty): $(history 1)"' or trap 'logger -i -p local5.info -t bash "$USER $(tty): $(fc -ln -1)"' DEBUG And rsyslog.d/shell.conf to store it on a common file for all users : local5.* -/var/log/shell.log My only issue is that I can't get sh or ksh commands with this. any suggestions ? Rgds ... View more

Yes, I did warn you of this in my answer 🙂 Anything that changes index time parsing requires a start of splunkd, anything you change in props/transforms that affects search time extractions only requires a search to be re-run ... View more

I do have this working and it is awesome, but I have 2 questions: 1: Can I get the location data on other views/dashboards? 1.5: If so how? 2: Can I put the other info such as region_name & postal_code in there and retrieve it with geo lookups? ... View more