Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rantravee
rantravee
Path Finder
Member since:
09-28-2013
06-05-2020
Community Statistics
| Posts | 24 |
| Solutions | 0 |
| Karma Given | 16 |
| Karma Received | 3 |
| Member Since | 09-28-2013 |
Activity Feed
- Karma Re: Finding where multiple events have the same time for RicoSuave. 06-05-2020 12:46 AM
- Karma What is the difference between the Splunk App Framework and the Splunk SDKs? for sdaniels. 06-05-2020 12:46 AM
- Karma Re: Failing import in Splunk Framework app for ineeman. 06-05-2020 12:46 AM
- Karma Re: Newbie unclarities regarding App Frameworks for emiller42. 06-05-2020 12:46 AM
- Karma Re: Python script develop/debug tools for MuS. 06-05-2020 12:46 AM
- Karma What's the main differents between splunk App Framework and "new Framework preview",or the appfx? for fengl2. 06-05-2020 12:46 AM
- Karma Re: Seach query for timeseries does not work for all timeranges for lguinn2. 06-05-2020 12:46 AM
- Karma Re: In app setup screen for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: In app setup screen for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Edit Form/Dashboard XML manually , Splunk does not refresh unless XML edited through GUI for nfilippi_splunk. 06-05-2020 12:46 AM
- Karma Re: Reliable file path in script independent of OS for Ayn. 06-05-2020 12:46 AM
- Karma Re: Append field to event data for rroberts. 06-05-2020 12:46 AM
- Karma Re: Extract event fields in desired format for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Configure Event Timestamp for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Change splunk web server from the default setting of port 8000 to port 8081 for Ayn. 06-05-2020 12:46 AM
- Got Karma for Failing import in Splunk Framework app. 06-05-2020 12:46 AM
- Got Karma for Failing import in Splunk Framework app. 06-05-2020 12:46 AM
- Got Karma for Specify map height. 06-05-2020 12:46 AM
- Karma Re: How do you create custom modules for dbrezinski. 06-05-2020 12:45 AM
- Posted Specify map height on Dashboards & Visualizations. 05-08-2014 12:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-08-2014
12:59 AM
1 Karma
Hello,
I', using simple xml to display some geolocation data . However the map that is displayed occupies 100% width and only 50% height.
The code to define it is below
<row>
<map>
<title>Traffic Geo</title>
<searchString>....</searchString>
</map>
</row>
What options would there be in order to parametireze the aspect of the map so that it also occupies 100% height ?
Thanks
... View more
05-07-2014
11:00 AM
Hi,
With the Simple XML and using the following :
<row>
<map>
<title>Traffic Geo</title>
<searchString>...</searchString>
</map>
</row>
I plot on a map information.
I'd like to have the equivalent of this, using Advanced XML, however I cannot find the specialezed module to plot on the map
Cheers
... View more
05-07-2014
10:48 AM
it also needs to have specified the layoutPanel
... View more
05-07-2014
09:48 AM
Hi,
As the title mentions I would like to know if it is possible to have a single timerange picker to control some other hiddensearches . Whenever the timerange value would change that would trigger all the hidden searches to start
At the moment I have something like this :
<module name="TimeRangePicker">
<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Applications" autoRun="True">
<param name="search"> .... </param>
<module name="HiddenChartFormatter">
........
</module> <!-- HiddenChartFormatter --
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col2" group="Dynamic Apps" autoRun="True">
<param name="search">...</param>
<module name="HiddenChartFormatter">
<param name="chart">pie</param>
.........
</module> <!-- HiddenChartFormatter -->
</module>
</module>
Thanks
... View more
10-16-2013
05:35 AM
Hi,
I would like to know how to configure Splunk so that for each event that I'm feeding to it the system time is used as the event timespamp.
I need to do this because the JSON objects that are fed to Splunk contain keys/value that describe the time(in millies) of some things and this makes Splunk to mismatch the event timestamps for some value that it finds within the JSON object.
Any hint would be greatly appreciated,
... View more
10-15-2013
05:34 AM
The json obj comes in the format described in the question from a network resource :
resp, content = http.request(statistics_url,
method='POST',
headers={'Content-Type': 'application/json', 'charset':'UTF-8','Connection':'keep-alive', 'Host':'theHost'}, body=json_body)
and then I call printResponseToSplunk(), passing the content object to it
... View more
10-15-2013
05:23 AM
def printResponseToSplunk(self,s):
jdata = json.loads(s)
# Augment json object with additional information
stats = jdata[JSON_STATS_OBJ_NAME]
for innerOBj in stats
innerOBj[JSON_CHASSIS_KEY]=self.getHost()
print (json.dumps(innerOBj))
sys.stdout.flush()
... View more
10-15-2013
05:07 AM
How could I achieve that ? I realize that my question may sound ridiculous , but I just recently crushed Pyhton Programming.
... View more
10-15-2013
04:37 AM
It seems Splunk is incapable of automatically extracting the fields .Only the default fields are extracted . I see a long string ,containing all the key/pair values . Something like
{'stat_1': 0, 'stat_2': 0, 'stat_3': 0, 'stat_4': 0, 'stat_4': 0, ....., 'stat_n': 0 }
... View more
10-15-2013
03:13 AM
hi,
I'd need some hints regarding the propertiesI should have in in props.conf and transforms.conf so that I have data in the needed format. So I within my scripted input I print to standard output a json object of the following format
{
"statistics" :[{stats_resource_json_obj_1},....,{stats_resource_json_obj_n}]
}
each stats_resource_json_obj_i has the folowing format
{
"id":value,
............
"stat_i":"val_i"
}
I would like to have an event for each stats-resource-json-obj and to have recognized/extracted as fields (at search time) every pair of key/value within the object .
Thanks a lot
... View more
10-14-2013
12:57 PM
Interesting, but there seems to be a limitation.
If I understood correctly, one can create new fields/values , but they must be somehow related to the event through an field that is already contained by the event.
I need to add/inject a field=value pair to my event , that is completely unrelated to any of it's fields.
And I need to do it on the fly . Is there any possibility to allow me to do this
... View more
10-14-2013
07:47 AM
hello,
Using a custom script input I can obtain some data from a particular network resource. I would like to know if is possible to inject/append a field to the generated event indexed by splunk , so that I can augment my knowledge about each event.
Thanks
... View more
10-14-2013
05:36 AM
As a Python beginner I'm surprised every day of what it has to offer
... View more
10-13-2013
01:13 AM
Hi,
I' using a custom Python script to index data into Splunk. Within the script I refer some dependencies and conf files using code like this :
conf_file = os.environ['SPLUNK_HOME']+'/etc/apps/my_app/default/my_conf_file.conf'
APP_BIN_DIR = SPLUNK_HOME + "/etc/apps/my_app/bin/"
Since this script is going to run both on Windows and Linux I wonder what would be a reliable pattern to use when referring to the location of other dependecies/resources within the file system
... View more
10-08-2013
06:11 AM
I meant something like that, but that is not showed only once when the app is first opened. Instead it is available within the app at any time the user desires ti reconfigure some params
... View more
10-08-2013
12:59 AM
Hi,
Is it possible to define a setup screen to capture credentials and other important information and have this setup screen available within the application like a separate navigation tab ? . I need this because I want to allow the user to be able easily to customize what the app is polling .
... View more
10-07-2013
12:38 PM
Hi,
I'm using a script to poll at each minute a WebApi for statistics. The result is a json object that is then indexed into Splunk. Next I want to visualize some of the statistics, therefore I employ a couple of dashboards/forms , each coupled with a search to render timeseries about that statistic.
The search query is like "source="mysource" | timechart span=1m avg(json_response.statistic_x)"
This works OK for some time ranges (15min, 60min, 4h) but for 24h interval or greater nothing is plotted. It is like in this case no event matches the query which is very strange,since there is data.
If I remove the span then for the 15 min interval I get around 15 unconnected points in the graph representing each indexed event. Additionally in this case I see there are much more results than matching events.
Could someone throw some light on what is happening and how could a consistent behavior for all time samples be obtained ?
... View more
10-02-2013
01:36 PM
I've written a script that polls a WebApi and after receiving the response streams the data into Splunk to be indexed . The response that is intended to be indexed is a large Json Object with more than 100 keys . I would aspect to see only one event after the script is runned containg the indexed json Object. Instead I see several events with the same timestamp ,each containing s subset of keys from the received Json Object. Is this correct ? Can there be something done so that the entire Json object belongs to the same event ?
I index the data into splunk through the following lines of code :
print jsonObject
sys.sdout.flush()
Thanks
... View more
10-01-2013
12:36 PM
Hello,
I find it quite exhausting to use notepad++ for writing a pyhton script for Splunk . Any mistake takes a lot to debug (by opening splunkd.log) and fix .Plus there are a lot of typos and API misuse that go undetected into runtime problems. Being a beginner with Python I am wondering, is there any alternative available to optimize the developing/debuggin process ?
Thanks
... View more
09-29-2013
02:05 PM
Hi ,
After browsing a while through the docs I realized that there exist actually two application frameworks :
one that is shipped with the splunk distribution and is described here
a new application framework that is downloaded separately is described here and integrates Python and Javascript SDKs .
Regarding this realization could someone provide feedback for the following unclarities :
Is it possible to deploy an app created using the "new framework" into splunk app store?
Why apps created with the "new framework" don't behave correctly when runned from SplunkWeb ? They are after all visible from SplunkWeb.
Is there something particular that must be done (package/deploy/etc...) for an app created using the "new framework" to run as expected in SplunkWeb even if the app uses the Python SDK ?
Thanks
... View more
09-29-2013
01:23 AM
2 Karma
Hi ,
I am trying to write my first Splunk Application Framework app . However I am running into trouble when it comes to the python code associated with my custom module. The problem seems to originate in an import :
"import splunklib.client as client"
Looking into web_service.log I can see the following lines :
2013-09-29 11:10:02,743 ERROR [5247e059c217902b0] root:555 - Unable to start splunkweb
2013-09-29 11:10:02,743 ERROR [5247e059c217902b0] root:556 - No module named splunklib.client
....
ImportError: No module named splunklib.client
Since splunklib is a part of the Python SDK and the Python SDK is available on the Application Framework I thought it would be straightforward to access it . What am I missing here ? How would someone proceed in order to employ the Python SDK in his app ?
Thanks
... View more
