Hi, I have a field name Details. This field contains a lot of information in varying format. e.g. software installed on endpoints, updates installed etc. I need to extract this information from this field. Sample is below. What is the best approach? I need both from configuring field extraction for this in configs or in actual Splunk search using rex or eval. Fields to be extracted: Path Version/Installed Version: Both need to be extracted in a way that *Version* is used to cover variations. Method/Detection Method: Both need to be extracted in a way that *Method* is used to cover variations. Variation 1: <plugin_output> Path : /opt/AdoptOpenJRE/jdk8u332-b09-jre/ Version : 1.8.0_332 Binary Location : /opt/AdoptOpenJRE/jdk8u332-b09-jre/bin/java Details : This Java install appears to be Java Runtime Environment, since "jre" was found in the installation path and javac was not found (medium confidence). This Java install may be Oracle Java or OpenJDK Java due to "org.openjdk.java.util" in the binary (low confidence). Detection Method : "find" utility </plugin_output> Variation 2: <plugin_output> Path : /HP/hpoa/CADE2/HP/nonOV/openadaptor/1_6_5/classes/oa_jdk14_classes.jar Version : 1.1.0 JMSAppender.class association : Found JdbcAppender.class association : Found JndiLookup.class association : Not Found Method : MANIFEST.MF dependency </plugin_output> Variation 3: <plugin_output> Path : /opt/IBM/WebSphere855/AppServer/java_1.7_64/ Installed version : 7.0 Fixed version : 7.0.11.5 Path : /opt/IBM/WebSphere855/AppServer.old/java_1.7_64/ Installed version : 7.0 Fixed version : 7.0.11.5 Path : /opt/IBM/WebSphere855/AppServer.gagan/java_1.7_64/ Installed version : 7.0 Fixed version : 7.0.11.5 Path : /opt/IBM/InstallationManager/eclipse/jre_7.0.100001.20170309_1301/ Installed version : 7.0 Fixed version : 7.0.11.5 </plugin_output> Thanks in-advance!! ... View more

Hi, I am exploring some options for exporting data into text file from Splunk. I have a scheduled saved search which produces results like below in statistical table format. I need this to be written to a .txt file. Results written need to be appended to existing txt file.   count      index      sourcetype                      time                                               results  0                   A                      B               04/05/2022 00:00:00         Success exceeds Failures    Thanks in-advance!!!!!! ... View more

Hi, Snapshot: I had some alerts with script actions. Alerts are simply if value A exceeds value B by 10 more e.g. value A=411 and value B=400 then trigger that alert and trigger the respective script alert is pointed to. Whenever alerts were triggered, specific shell scripts were triggered. Script were simply a shell command . Whenever those command/s ran, they fed alerts to event pipeline of another tool. It worked perfectly fine as designed until we upgraded Splunk from 7.x to 8.x. After upgrade, Script actions option is still available but does not work anymore since functionality has been deprecated. Alternative: Suggested functionality to use is custom alert actions from Splunk. I have developed a TA using Splunk Add On builder. This allows users to create same alerts where Action section allows them to select the script of choice to attach with alert so whenever alert is triggered, script is trigged and event is initiated as before up tp event pipeline of another tool. This TA has a python script which simply call the shell scripts of choice if a condition is met for respective script. Issue/s: 1. When same shell command that in the script/s is ran manually from one of the Search Heads command line, it works perfectly. This is for testing to make sure it works. 2. When same shell command that in the script/s is ran via Splunk Add On Builder @ validation section, it gives syntax error for "-" in the command. When I escaped it with \ using "\-", syntax error resolves and test runs fine with success message. However, event that is supposed to be injected into another tools event pipeline, that event does not come at all. 3. When same shell command that in the script/s is ran WITHOUT "\-options" flags, it works. This is just for testing to make sure the most basic functionality is working. So what can I do to make this python script run the commands we want it to run to restore functionality which we had before via scripted alerts actions? I am suspecyting issue with Python. FYI, these scripts with shell commands and python script to trigger them are all in one package under same TA. Alerts are in a different application and are globally shared as always. We are on Splunk 8.x. Python is upgraded via Splunk upgrade to 3.x. I am suspecting issue with Python engine and libraries. I did some libraries check and some libraries are still @ 2.7 even after the upgrade. # encoding = utf-8 from __future__ import print_function from future import standard_library standard_library.install_aliases() import requests import sys,os import json import logging import logging.handlers import subprocess from subprocess import Popen, PIPE def process_event(helper, *args, **kwargs): helper.set_log_level(helper.log_level) dropdown_list = helper.get_param("dropdown_list") helper.log_info("dropdown_list={}".format(dropdown_list)) helper.log_info("Alert action alert_action_test started.") # Basic test command. Working and making it thru the event messaging queue if dropdown_list == 'abcscript.sh': execute=subprocess.run("/opt/OV/bin/opcmsg application=ABC object=ABC severity=Major msg_text=TESTTESTTEST, stdout=subprocess.PIPE, text=True) # Working syntax wise without any errors in Add On builder but not making it thru the messaging queue as desired for custom alert actions. Note: there is an option Description below that I need to take out to make it work because there is a syntax error with it because python is not aking values with spaces. (\-option Description>>>>) if dropdown_list == 'abcscript.sh': execute=subprocess.run("/opt/OV/bin/opcmsg application=ABC object=ABC severity=Major msg_t=TEST \-option CIHint=ABC_Abstract_Node \-option ETIHint=ABCPortal:Major \-option Description='The rate of SendSubmission failures to successes exceeded the threshold in the JVM logs' \-option category=ABC_JVM \-option subcategory=SendSubmissionRate", stdout=subprocess.PIPE, text=True) # There are 4 scripts in total so I have three more drop downs and 3 more commands respectively like above. Thanks in-advance!!! ... View more

Hi, I need to know if it is possible to create bar chart with patterns to differentiate along with colors. I already have colors portion but need to fill the bars with patterns. Thanks in-advance!! Example: Value with lowest count with fewer dots and value with higher counts with more dots. Any other pattern will work as well. ... View more

Hi, I have a situation where I have a large dataset. This dataset has a field named A. This field is large and passing Splunk's default character limit of 10250 characters. Almost 70% of this dataset is below default character limit. ~20% of field A's character length is around 30k. Rest of the 10% is very large. And these very large ones have characters in one field value over 3million and event size about 4MB a piece!!! 😞 Is there a way where I can create a logic in eval or rex to slice the field as below: Field A: Event 1 Master Event 1 Post Processing 1: Create event where characters FROM 1-10250 Event 2 Post Processing 2: Create event where characters FROM 10251-......and so on until it completes. There is a lot of rule matching that needs to happen in the work I have to do based on requirements. This rule matching looks for specific string in the field's text and outputs specific values. This rule matching works great so far except the issue is when field's values exceeds the character limit, Splunk ignores and I can not match after that. Not only this, Splunk's auto extraction does not extract any fields AFTER it stops because of character limit for that larger values in field's text. The dataset is ingested from MS SQL Server vis DBConnect on Splunk side. I also thought about using Python to pre-process the data but that adds complexity to the whole picture. Trying to keep it simple. Thanks in-advance!!! ... View more