This JavaScript executes on input. Can you help me with the same problem but I want the JavaScript execute when the user clicks on a html button instead (i.e. it grabs the content of the textarea and creates a splunk token)? ... View more

What some companies does is use an apache reverse proxy and create a sso user in splunk, that sso user has access to one app that has your dashboards. The problem are the interdependencies with other modules. Some dashboards require access to search, other to dbx (depending if you use db connect). And the worst part is that you need also to block the drilldowns in such dashboards so nobody can access to the search and do their on queries. ... View more

So if http proxy is required why do you provide the code example having no any mention of it like this one? http://dev.splunk.com/view/javascript-sdk/SP-CAAAEDD Another issue - even with proxy it doesn't work. In my case the local splunk server is located on different domain, and there is no any description or clue how to provide the right address to it. Because all the data used in object as a second parameter in service.login is not used. ... View more

Okay, rolling with it I shall. ... View more

I finally got it to work but how I got it to work does not make sense. I had to turn off the wifi or internet access in order to finally log into the splunk web interface. Why did it suddenly start working after that? ... View more

Thank you good sir you are a gentleman and a scholar. ... View more

Here are couple of options for your requirement that can be tried Lookup values as giant OR condition (assuming your lookup file has one field called 'IP') - good if no of IP in your lookup is less your base search giving field src_ip and dest_ip | search [| inputlookup yourIpLookup.csv | eval src_ip=IP | eval dest_ip=IP | table src_ip dest_ip | format "(" "(" "OR" "" ") OR" ")" ] Regular Lookup command (assuming your lookup file has two field IP and flag, add flag field with all values as '1') your base search giving field src_ip and dest_ip | lookup yourIpLookup.csv IP as src_ip OUTPUT flag as SrcIPFound | lookup yourIpLookup.csv IP as dest_ip OUTPUT flag as DestIPFound Use the flags SrcIPFound and DestIPFound to see if the src_ip and/or dest_ip was found in lookup. ... View more

Thank you very much ... View more

Why not use a scripted input: http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/ScriptedInputsIntro You can have it run at an interval and write to a file that is read by Splunk. ... View more

That my original approach however the field does not take other fields as an accepted argument. For example, if on of the field is called email, using to=email will make an attempt to send an email to email . ... View more

I never install the app to begin with. ... View more

Hi, In URL argument you pass the twitterId of the user as below. You can get twitterId from http://gettwitterid.com/ by passing Twitter user name. This way it worked for me. follow=359714389^stall_warnings=true ... View more

To think of this another way, I'd like to create strings/tuples/whatever based on combining a few fields from entries in my search results and then iterate through all of those and return those records where the tuples I have formed match. ... View more

I am already using haversine to find the distance between 2 location. What I want to know is that is how would you go about find the distance between more than 4 points. For example, want to find the distance between location 1 and 2 and have a new field created for that location. Then I want to find the distance between location 1 and 3, and create a new field for that location. Next would be 1 and 4 while creating new fields. Then 2 and 3, etc...... How would I go about doing this. ... View more

host=schroeder index=os sourcetype=ps COMMAND=udpub |dedup PID|stats count AS udpub_cnt by host |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=aimglog |dedup PID|stats count AS aimglog_cnt by host] |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=bimglog|dedup PID|stats count AS bimglog_cnt by host] |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=smm |dedup PID|stats count AS smm_cnt by host] |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=sm |dedup PID|stats count AS sm_cnt by host] |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=sbcs |dedup PID|stats count AS sbcs_cnt by host] |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=syncd "_"|dedup PID|stats count AS syncd_cnt by host] |appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=cleanupd |dedup PID|stats count AS cleanupd_cnt by host] | eval udpub_status=case(udpub_cnt==8,"OK",udpub_cnt!=8,"NOT OK") | eval smm_status=case(smm_cnt==1,"OK",smm_cnt!=1,"NOT OK") |eval sm_status=case(sm_cnt==1,"OK",sm_cnt!=1,"NOT OK") | eval sbcs_status=case(sbcs_cnt==1,"OK",sbcs_cnt!=1,"NOT OK") |eval syncd_status=case(syncd_cnt==2,"OK",syncd_cnt!=2,"NOT OK") | eval cleanupd_status=case(cleanupd_cnt==1,"OK",cleanupd_cnt!=1,"NOT OK") | eval aimglog_status=case(aimglog_cnt==4,"OK",aimglog_cnt!=4,"NOT OK") | eval bimglog_status=case(bimglog_cnt==4,"OK",bimglog_cnt!=4,"NOT OK") |fields host *status *cnt |collect index=cactus_summary ... View more

I tried that and it did not work. Does this only work for 6.0.2 because I have 6.2.2. ... View more