Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cnestrud
cnestrud
Explorer
Member since:
03-18-2016
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-18-2016 |
Activity Feed
- Got Karma for How should I configure a custom python generating search command to use the events pipeline?. 06-05-2020 12:48 AM
- Posted Re: How to make the Nessus plugin output available in Splunk events? on All Apps and Add-ons. 07-06-2018 11:13 AM
- Posted Re: How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 04-24-2017 01:32 PM
- Posted How should I configure the Stream app to have streamfwd not use SSL when connecting to HEC endpoints? on Getting Data In. 02-13-2017 03:53 PM
- Tagged How should I configure the Stream app to have streamfwd not use SSL when connecting to HEC endpoints? on Getting Data In. 02-13-2017 03:53 PM
- Tagged How should I configure the Stream app to have streamfwd not use SSL when connecting to HEC endpoints? on Getting Data In. 02-13-2017 03:53 PM
- Posted How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 02-01-2017 10:58 AM
- Tagged How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 02-01-2017 10:58 AM
- Tagged How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 02-01-2017 10:58 AM
- Tagged How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 02-01-2017 10:58 AM
- Tagged How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 02-01-2017 10:58 AM
- Tagged How should I configure a custom python generating search command to use the events pipeline? on Splunk Dev. 02-01-2017 10:58 AM
- Posted Re: Is it possible to use a deployed app on a UF to add local configuration files for a separate app? on Getting Data In. 03-21-2016 01:32 PM
- Posted Is it possible to use a deployed app on a UF to add local configuration files for a separate app? on Getting Data In. 03-21-2016 01:05 PM
- Tagged Is it possible to use a deployed app on a UF to add local configuration files for a separate app? on Getting Data In. 03-21-2016 01:05 PM
- Tagged Is it possible to use a deployed app on a UF to add local configuration files for a separate app? on Getting Data In. 03-21-2016 01:05 PM
- Tagged Is it possible to use a deployed app on a UF to add local configuration files for a separate app? on Getting Data In. 03-21-2016 01:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
07-06-2018
11:13 AM
I'm also having this problem. There are several fields including Synopsis, Description, Solution, See Also, and Plugin Output that I would like for Splunk to index. Please let me know if you came up with any solution.
... View more
04-24-2017
01:32 PM
I was able to get this to work by changing the decorator to:
@Configuration(type='events')
And also modifying our local copy of the Splunk Python SDK to allow ‘events’ as a valid option:
diff --git a/splunklib/searchcommands/internals.py b/splunklib/searchcommands/internals.py
index be57703..23989ad 100644
--- a/splunklib/searchcommands/internals.py
+++ b/splunklib/searchcommands/internals.py
@@ -326,7 +326,7 @@ class ConfigurationSettingsType(type):
supporting_protocols=[1, 2]),
'type': specification(
type=(bytes, unicode),
- constraint=lambda value: value in ('eventing', 'reporting', 'streaming'),
+ constraint=lambda value: value in ('eventing', 'reporting', 'streaming', 'events'),
supporting_protocols=[2])}
... View more
02-13-2017
03:53 PM
I am trying to use Splunk Stream with the HTTP Event Collector. I have set HEC to not use SSL. In inputs.conf on the servers with HEC enabled:
[http]
disabled=0
enableSSL=0
The HEC URLs are entered as http://host:port in the Stream app configuration. When the standalone streamfwd is run it gets the correct URLs from the stream app but it looks like it tries to use SSL.
From streamfwd.log:
2017-02-13 15:38:58 WARN 140663285286656 stream.SplunkSenderHTTPEventCollector - (#39) SSL handshake failed: unknown protocol
The HEC endpoints are on different servers from the SHC which has the Stream app. The streamfwd binary is on a separate server without Splunk.
... View more
02-01-2017
10:58 AM
1 Karma
I am trying to create a custom python generating search command which will be used with the events pipeline. It should generate events on the search head and should not distributed to indexers.
I am using splunk-sdk-python version 1.6.2 and Splunk version 6.5.1.
In commands.conf:
[abc]
filename = abc.py
chunked = true
In abc.py:
#!/usr/bin/env python
from __future__ import absolute_import, division, print_function, unicode_literals
from splunklib.searchcommands import dispatch, GeneratingCommand, Configuration, Option, validators
import sys
import time
@Configuration(type = 'eventing')
class AbcCommand(GeneratingCommand):
[...]
def generate(self):
[...]
yield event
self.finish()
dispatch(AbcCommand, sys.argv, sys.stdin, sys.stdout, __name__)
From the search log:
02-01-2017 12:26:54.489 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/myapp/bin/abc.py
02-01-2017 12:26:54.615 INFO ChunkedExternProcessor - Custom search command is a generating command.
02-01-2017 12:26:54.615 ERROR ChunkedExternProcessor - Invalid custom search command type: eventing
02-01-2017 12:26:54.716 ERROR ChunkedExternProcessor - Failure reading getinfo chunk
How should I configure this command so that it uses the events pipeline?
... View more
03-21-2016
01:32 PM
"scripted input" should be "python script", though I'm hopeful that someone will mention a better solution.
... View more
03-21-2016
01:05 PM
I'm considering using the deployment server to distribute an app per UF with settings specific to that UF. One app being used is splunk_ta_nix which uses local/inputs.conf to enable desired inputs. Is it possible to include this file in a separate app? The idea is that the OS of the UF would cause splunk_ta_nix to be installed, then the per-UF app would install splunk_ta_nix settings to enable specific inputs.
I considered using a scripted input to copy a file from the per-UF app directory to the etc/apps/splunk_ta_nix/local directory, but it doesn't look like that is possible on a universal forwarder.
... View more
