Thanks for the additional information. Did you try connecting to Splunk Enterprise with the Python SDK through the connect function? See https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtoconnectpython. After that, you should be able to retrieve passwords following the example at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragepython/#Examples. ... View more

I'm not sure I understand. You need to pass in credentials in order to read passwords.conf, because this file is encrypted and you need to ensure secure access. In order to call the storage/passwords endpoint, the user needs to belong to a role with certain capabilities assigned. See https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac for more details. ... View more

Hello! Just to add to what Giuseppe posted, you can retrieve credentials from passwords.conf using the storage/passwords REST API endpoint and the Splunk SDK for Python. Here is the documentation explaining how to do this:  https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragepython Good luck! ... View more

Alternatively, if you want to avoid limts.conf all together, you can use the maxinputs setting in commands.conf. For example: [your_custom_search_command] maxinputs = 50,000 For more information about this method, see https://docs.splunk.com/Documentation/Splunk/latest/Admin/Commandsconf. ... View more

Hi! You should be able to limit search results for your specific command by creating a separate stanza for your command in limits.conf. Then, you can use the maxresultrows parameter to limit search results to 50,000. For example: [your_custom_search_command] maxresultrows = 50,000 For more information about using limits.conf to apply limits to specific search commands, see https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf. Hope this helps!  ... View more

Hi Ketaka! I would recommend creating custom search commands with the Splunk SDK for Python. The SDK contains all of the Python classes and templates that you need to build the command. For information about creating custom search commands with the Python SDK, please see http://dev.splunk.com/view/custom-spl/SP-CAAAFFT. These docs contain an overview of creating custom search commands as well as examples from the SDK. Please let me know if this helps! -Taylor ... View more

Hi! Are you attempting to run the custom search command from the default Search & Reporting app? If so, you need to enable the command to run across apps. You can do this in Splunk Web on the Settings > Advanced Search > Search Commands page. For more information, see Manage access to a custom search command. Please let me know if this helps! -Taylor ... View more

http://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search ... View more

Hi everyone, Automatic lookups do not work with metrics. The reason behind this is that automatic lookups are applied to individual events, whereas metrics are analyzed as an aggregate. Please see this documentation for more information on searching and monitoring metrics. ... View more