Hi, I'm having a problem using tokens set with JavaScript inside my XML, specifically inside input tags. I have a dashboard with tabs and I'm using js to set a token when I move between them. Then I use the token in my dashboard queries so they'll run only when their respective tab is active. All work's well for most queries, but for those inside an input tag, there's a problem: splunk doesn't acknowledge the token set within the js code. it does recognize tokens set within the xml. js code that sets the token: var tokens = mvc.Components.getInstance("submmited"); tokens.set(tabToken, ''); dashboard xml: <!-- Doesn't work! --> <input> <search> <query> index=$index$ sourcetype=$sourcetype$ $control_token$ </query> </search> </input> <!-- Work! --> <table> <search> <query> index=$index$ sourcetype=$sourcetype$ $control_token$ </query> </search> </table> This behavior repeats throughout the dashboard, so I don't think it is caused by a faulty query. (also it starts working immediately after expelling the control_token) Any ideas on why might this occur? thanks in advance. ... View more

I'm trying to delete kvstore collection using REST API via Python: url = "https://localhost:8089/servicesNS/nobody/myapp/storage/collections/config/deleteme" request = urllib2.Request(url, headers = {"Authorization" : "Splunk "}) request.get_method = lambda: "DELETE" results = urllib2.urlopen(request) This returns HTTP Error 400: Bad request. The code works for other kvstore functions (when changing the URL) such as deleting collection's data, and I used the correct URL according to the documentation so I can't figure out why this doesn't work. ... View more

Hey there, Two problems with searching and viewing json sourcetypes: 1) Anybody know what's the deal with the json extracted field names? we get the dict "{}" thing inside the field names and it drives me crazy. For example, for this dict: {"match_number":64,"location":"Estadio do Maracana","datetime":"2014-07-13T16:00:00.000-03:00","status":"completed","home_team":{"country":"Germany","code":"GER","goals":1},"away_team":{"country":"Argentina","code":"ARG","goals":0},"winner":"Germany","winner_code":"GER","home_team_events":[{"id":1410,"type_of_event":"yellow-card","player":"Schweinsteiger","time":"29"},{"id":1411,"type_of_event":"substitution-out","player":"Kramer","time":"31"},{"id":1412,"type_of_event":"substitution-in","player":"Schürrle","time":"31"},{"id":1413,"type_of_event":"yellow-card","player":"Höwedes","time":"34"},{"id":1423,"type_of_event":"substitution-in","player":"Götze","time":"88"},{"id":1422,"type_of_event":"substitution-out","player":"Klose","time":"88"},{"id":1424,"type_of_event":"goal","player":"Götze","time":"113"},{"id":1425,"type_of_event":"substitution-out","player":"özil","time":"120"},{"id":1426,"type_of_event":"substitution-in","player":"Mertesacker","time":"120"}],"away_team_events":[{"id":1415,"type_of_event":"substitution-in halftime","player":"Aguero","time":"46"},{"id":1414,"type_of_event":"substitution-out halftime","player":"Lavezzi","time":"46"},{"id":1416,"type_of_event":"yellow-card","player":"Mascherano","time":"64"},{"id":1417,"type_of_event":"yellow-card","player":"Aguero","time":"65"},{"id":1419,"type_of_event":"substitution-in","player":"Palacio","time":"78"},{"id":1418,"type_of_event":"substitution-out","player":"Higuain","time":"78"},{"id":1420,"type_of_event":"substitution-out","player":"Perez","time":"86"},{"id":1421,"type_of_event":"substitution-in","player":"Gago","time":"86"}]} we get field names like "away_team_events{}.type_of_event" and we would really like it to not contain the "{}". 2) Drilldown doesn't work from the "syntax highlight" view, the one that shows them collapsed/expanded. Clicking just does nothing! Thanks ahead! EDIT: Field names - 1. it's annoying while writing searches, I think it's more harm than good. 2. we have been using XML up until now and it was great Drilldown - Yes, I meant modyfing the search according to the field values. It's just really buggy, sometimes it gives field names that don't exist and then we get no results. sometimes it simply doesn't work at all, clicking a field value nothing happens. Example for the first case - I can't upload the other case, but it's very simple, clicking any of the search modifying options just does nothing. ... View more

how do i choose time range for the search in pivot? the timerange picker just doesn't work. ... View more

Hey, quite a long post, but I'm going crazy here trying to solve this problem: I have a connection log of: id, username, start_time, end_time there are many users and I want to be able to analyze connection times for those users. ie top users that are connected at different times of the day (night, morning, afternoon). also looking at specific users and seeing their overall connection plotted over a 24 hour chart. So, I went on a quest to find relating posts, found a few, with this helpful one: timechart-of-open-sessions-per-user But here I don't have seperate "login" and "logout" events, it's all in one event. What I did (for the time being for one user) find events related to that user (_time is start_time) eval a field dif=1 to all those events append the same events to the events I found (this time _time=end_time) eval a field dif=-1 to those events now i'm at a state in which I should be in the starting position of the guy from that post and use his search ... | eval dif=1 | append [search ... | eval _time=strptime(end_time,"%Y-%m-%d %T") | eval dif=-1 ] | sort +_time | streamstats sum(dif) as openSessions by username | timechart max(openSessions) by username | filldown Problem #1: VERY VERY VERY weird thing, looks to me like a bug - in every search (which has more than a 100 events in it) there is one event missing from the search that I appended. and it screws all the stream stats up, i get something like: 00:00:00 logon 01:00:00 logoff 01:30:00 logon 01:50:00 logoff 02:30:00 logon 04:00:00 logon 04:30:00 logoff between 2:30 and 4:00 there was a logoff, and it's there in the 2:30 event, let's say at 03:00. but for some reason it doesn't get appended. What the hell? Problem #2: Even if I make this go away, it still doesn't solve my wish to get statistics over all of the users. what i would like to get is a table of all the users something like, user/hour 00 01 02 03 04 ... 23 user1 user2 Every cell would say the number of times the user was connected at that time: That append would really kill it, and I also don't know how to do those sums withot specifically stating all the users somehow in the stats that i will do on the timechart. Is there a way? ... View more

Hello, I have been using the DBConnect app for splunk for a few weeks, indexing just fine. The problem came up last week, when I noticed events were not up to date. I checked dbx.log for errors and found the following error for all inputs: Error:Scheduler - Error while reading stanza=[dbmon-tail://DatabaseName/InputName]: com.splunk.config.SplunkConfigurationException: No output.format defined for stanza. This error occurs even though output.format=kv EXISTS in the stanza in inputs.conf! I tried restarting Splunk unsuccessfully. When I used the CLI command: splunk.exe cmd btool inputs list dbmon-tail://DatabaseName/InputName the output showed me that all inputs are automatically disabled ( disable=1 ). How can I prevent this from happenning? Help please! ... View more