About phagunbaya

phagunbaya · ‎03-12-2017

Issue was that HEC accepts data in specified format. Sending data as {"time": "", "event":{"hello": "world"}} worked.

phagunbaya · ‎01-30-2017

Working with Splunk 6.5.2. Using following curl command data ingestion fails: $ curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk D61EE079-8108-4DC8-ADF6-F139402993" -d "{\"hello\": \"world\"}" Response: {"text":"No data","code":5} This was working fine with Splunk 6.3 and 6.4.

phagunbaya · ‎01-08-2016

Yes. response was 200.

phagunbaya · ‎12-23-2015

I'm seeing a behaviour where some of my events are missing after been sent to http event collector. I'm sending single event per request. Sometimes it shows all the events and sometimes it does not. Normally it happens if the frequency is high (4-5 events per second).

phagunbaya · ‎08-12-2015

Issue resolved by using Splunk receiver API http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTinputExamples#receivers.2Fsimple_POST

phagunbaya · ‎07-15-2015

I'm using following config but nothing was returned from export API. kwargs_export = { "earliest_time": "rt-15m", "latest_time": "rt", "search_mode": "normal", "output_mode" : "csv", "auto_cancel" : 0, "auto_finalize_ec" : 0, "auto_pause" : 0 } searchquery_export = "search \"auto-0037.1\" | dedup val2 | table time,val1,val2" exportsearch_results = service.jobs.export(searchquery_export, **kwargs_export) reader = results.ResultsReader(exportsearch_results) reader is returned always empty

phagunbaya · ‎07-13-2015

So, which api should I use for realtime search ?

phagunbaya · ‎07-09-2015

I'm using export API for streaming the data. The use case is : I want to open a stream for a search query and want to push the data outside splunk. I'm hoping that export API will stream the live data as it gets indexed in splunk and will remain live. Is it the right way to approach ? code snippet kwargs_export = { "earliest_time": "-15m", "latest_time": "now", "search_mode": "normal", "output_mode" : "csv", "auto_cancel" : 0, "auto_finalize_ec" : 0, "auto_pause" : 0 } searchquery_export = "search " + self.search exportsearch_results = self.request.service.jobs.export(searchquery_export, **kwargs_export) reader = results.ResultsReader(exportsearch_results)

phagunbaya · ‎07-07-2015

I have created an alert which triggers a script based on a condition defined in alert. After the script triggers, it should pull the data based on the search and sends the data to an external server by calling it's POST API. I'm having trouble getting data based on the search alert because the Splunk search API needs to be authenticated to get the data. Is there any different approach to deal with this? My goal is to create an alert programmatically and upon trigger I need to send the data to external server.

phagunbaya · ‎07-01-2015

That's the default behaviour. I was thinking of if I could change it. Also if I mention "source" and "sourcetype" column in my cvs data then these are renamed as "extracted_source" and "extracted_sourcetype".

phagunbaya · ‎07-01-2015

My requirements are to save a csv formatted data into splunk from a custom app. I'm using django bindings. Was not able to figure out which API should I use for inserting data with custom source and sourceType field values from within the python script.

phagunbaya · ‎06-30-2015

Currently, the "Save As" option near search bar allows to store the result as Report or Dashboard Panel. I was wondering if there is any way to add a new options sourced from a custom splunk app.

Posts	12
Solutions	2
Karma Given	0
Karma Received	4
Member Since	‎06-30-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk 6.5.2: Why am I unable to add data via HTTP...

Events missing via http event collector

Trouble using Export API for streaming data

Suggestion on sending search output to external se...

How to add data to splunk with custom source and s...

Is there any way to add a new "Save As" option oth...

Re: Splunk 6.5.2: Why am I unable to add data via ...