I would suggest creating a new top-level Question and be sure to include detail on what you have done and where you are stuck. Here's some general advice for getting better answers: https://opensource.com/life/16/10/how-ask-technical-questions. ... View more

Check out the "Embed Scheduled Report" feature. The steps are: Write search Save as report Enable embedding At this point, you're given an HTML iframe code snippet which looks like this: ... View more

Hey @jkat54, thankfully, this is actually no longer correct! Adding another answer below. ... View more

We now have security announcements available via RSS feed. I'll mention this in the linked question also. See https://www.splunk.com/page/securityportal Edit: I see that was already covered there. ... View more

if you haven't by now (I know this Q is old), be sure you are running Docker 1.13 so that you can take advantage of the latest JSON and RAW modes in our logging driver as detailed in this blog post. One of these modes (depending on whether you care about embedded JSON) should allow you to take better advantage of the processing pipeline and to be able to handle these events. If you continue to have issues, let us know. ... View more

At this point there are not, but I did speak with a customer today who was interested in creating one and possibly sharing it with the community (Edit: aha, that was you!). As to your surprise--I'm not surprised for two reasons: Splunk is very cross-platform, and DSC is Windows-only. Given that resources are limited, you'll see Splunk invest more generally in areas that can benefit all customers, regardless of their OS platform. The Splunk Deployment Server exists. Regardless of how you use DS (and whether you like it or not), the fact that it's there as a default option will tend to prevent folks from investing too much in an overlapping technology. Is it possible to use DSC to manage Splunk? Of course. In fact, depending on your scope, a DSC resource could be trivially easy to do. The devil would be in the details of how far you want to go, given that there may be advantages in keeping DS around. A minimal set of DSC resources might do the following: - Deploy Splunk MSI & ensure its installed - Copy a set of config files & ensure they are effected (by restarting splunkd service) I can imagine you'd have a matrix of these that maps to Splunk server and client roles, such as: - Search Head - Indexer - Deployment Server - Universal Forwarder The real question is whether you intend to mange all aspects of Splunk with DSC (very large project), or do you intend to simply use it for deployment client bootstrapping. If the latter, your DSC resource might have one step: deploy the MSI with a few parameters, one of which being the address to your DS. ... View more

What version of Splunk? Just want to make sure you are working with the built-in input as opposed to the older PowerShell input app from Splunkbase. ... View more

@joseph_caraccio are you using v1 or v2 of the custom search command API? See description of the options here: About Custom Search Commands. You should use v2. If you are using the Splunk-bundled interpreter, then you don't have to ship the SDK. If you use a system or other interpreter, you must use a .path file to call it correctly. A shebang won't work. And if going this route, you also must also install the Splunk SDK system-wide or package it in your app's folder like any Python module. Lastly, "splunk cmd python" is a great troubleshooting tool, but only works if using the embedded Python. ... View more

Thread has been started with @sloshburch and our docs team. Hopefully we'll get this cleaned up in short order, but I think this whole dev section is getting a major revamp, so changes may not be pushed out until next major release. ... View more

thx! I knew your solution was possible, but syntax was killing me. That "/text()" part in particular was not obvious even after reading specs and examples. ... View more

This reminds me of the old story about parsing HTML with regular expressions. 🙂 ... View more

After playing for another 30 min with the actual data, I could not get this technique to work. I've decided that it's me, and that I don't like XPath. 🙂 ... View more

Thanks! Accepting this one because: XPath makes my head hurt This solution feels really Splunky and I really needed a good mvexpand example. ... View more

Yup one event ... View more

This is the right answer in my book. @a212830, one reason there isn't a published XSD because Splunk isn't a fixed schema system. For example, look at the docs link below where the Content field is described: Container for content returned by the operation for an entry. Typically, responses returns content as dictionaries with key/value pairs that list properties of the entry. Content can be returned as a list of values or as inline plain text. Been a while since I delved deeply into XSDs, but I'm not sure if any search would ever remain valid to a spec because by altering the search you alter the structure of the Contents field. ... View more

I feel we would be better served to call this out as failures in design, not bad user behavior. Ideally, Splunk should NEVER cause the client to crash. ... View more

Back when I worked with NetApp on this, it was a private API, and we had not gone through the hoops to get access to it. I'm fairly sure this has not changed, so no. 😞 If you can find otherwise using your resources as a customer, let me know. ... View more

I'll answer this with an example for changes to a single file. Let's use server.conf just to show that this could be any file at all, not specific to searches. Here's our sample file: server.conf: [general] sessionTimeout=1h Dev1 clones the repo and wants to change the timeout to 8h. So he creates a branch so that the changes can be tracked separately from master. Edit is made and now our file reads: [general] sessionTimeout=8h Before Dev1 checks his changes in, Dev2 comes along and wants to enable SSL. So, they clone master, make a branch, and now the file might look like this: [general] sessionTimeout=1h [sslConfig] enableSplunkdSSL = true useClientSSLCompression = true ... Dev1 commits their change, and pushes it up to the central repo, so now the new branch is visible to all. At this point, maybe you'd have someone else review the change, or do a quick smoke test on a lab server. Or, if you are already down that path, you'd do a full suite of automated tests. Whatever. Then when you are happy that things are not broken, you merge into master and then on your production server(s), you sync them with master, and restart as needed. Dev2 comes along and is like, "somebody test my changes, I just enabled SSL". They commit the changes locally, then push them up to the server so that others can see and help test. Tests all looks good. When it's time for Dev2 to merge into master (but prior to syncing production to the new-new changes), this is what happens: Git (automatically, because this is a core feature of revision control features and git in particular) will do a line-by-line merge of "changeset dev1" and "changeset dev2". This is a pretty straightforward case, and the end result will be exactly as you predict, like this: [general] sessionTimeout=8h [sslConfig] enableSplunkdSSL = true useClientSSLCompression = true If git cannot figure out the changes, you can then take a variety of actions. The onus is on the one merging to figure it out in the end, and they will be shown all the changes that have been made by multiple contributors. There is a lot to read on this subject, which can make things confusing for folks new to source control systems. To simplify things, you could omit the branch step, and have everyone work in master, but this can make testing and merging more difficult. One of my favorite tips is to automate the "master sync" in production (have cron do a git pull && splunk restart during your maintenance window). This might sound scary at first--until you realize that you REALLY don't push to master until everything has already been thoroughly tested. So, in order to take advantage of this automated deployment step, at least use two branches. On a small team, you could get away with a "test" and "master" branch. One or more folks work in test, and then the person who gets the short straw merges test into master. To go back around to your initial question, file changes are compared line-by-line. Git will usually figure things out as if by magic. Many editors will allow you to show diffs visually for those times when you have to merge things manually. ... View more

You get all the credit for doing it first, and inspiring me to add some polish. 🙂 ... View more

Here's what I came up with for a very basic example taking the above into account: $token = "C3AD6A0B-2499-4070-AA51-765640DB9107" $server = "192.168.99.101" $port = 32771 $url = "http://${server}:$port/services/collector/event" $header = @{Authorization = "Splunk $token"} $event = @{event = "hello world"} | ConvertTo-Json Invoke-RestMethod -Method Post -Uri $url -Headers $header -Body $event Note: the reason there are curly braces around "server" above is to prevent the following colon from being picked up as a scope modifier. Otherwise it would parse to $server:32271 which is valid syntax, but would result in an empty result. And the one-liner to compete with curl! PS > irm -Method Post -Uri "http://192.168.99.101:32771/services/collector/event" -Headers @{Authorization = "Splunk C3AD6A0B-2499-4070-AA51-765640DB9107"} -Body '{"event": "hello world"}' text code ---- ---- Success 0 ... View more

This one needs an answer! ... View more

Great answer by @mdonnelly about flows, but I wanted to mention more about SNMP. All network gear speaks this protocol. The reason I bring it up is because of this part: ...to be alerted when a network link is approaching full capacity. When a switch port is experiencing degraded service... Flows won't tell you about the health of an individual switch directly. You can infer this by doing the math in Splunk to add up the bandwidth seen, and compare it to what you know about the switch capacity. Also, flows don't know anything about physical ports, they only see the IP address and no lower. However, you can inspect this detail more directly by querying the switch with SNMP. One way to work with SNMP is to use this app: SNMP Modular Input. Because Splunk doesn't do device discovery, you are going to need to configure this modinput to point it to your switches, and tell it which SNMP OIDs to query. This might be a non-trivial task, just warning you up front. But there's a wealth of detail to be found there. ... View more