As per subject, when accessing my cluster master -> clustering panel, in Indexes tab I'm only shown _audit and _internal indexes, while for sure I have another one (index=cisco) with data in it but which is not showed. I distributed 2 new indexes (cisco + esx) via configuration bundle. ... View more

Hi all, I'm trying to integrate a Python script I wrote in Splunk in order to perform an external lookup to a SQL Server database. In order to do so, I used the pyodbc module installed on my OS Python 2.7 (I'm using Windows Server 2012). I then followed advices written here to try and test my script. Everything works fine and I'm able to enrich my input data with the query I provided. When involved in the integration with Splunk (defining a lookup in transforms.conf and so on) I faced the problem of using a wrapper script to call my system Python (the one with the pyodbc module installed) which in turns call my enrichment script. I followed these solutions ( first and second ) to no avail. What happens is that i run my lookup but it seems like the os.execv command doesn't run for some reason (I tried to add some logging but had no luck. The enrichment script is never called). If I call my wrapper from CLI with "splunk cmd python", it works great and returns me my enriched data. I attach the two scripts, hoping to get help to solve this strange issue. Regards, Stefano wrapper.py import os, sys import logging ### LOGGING ### LOG_FILENAME = 'C:\\Program Files\\Splunk\\var\\log\\lookupWrapper.log' #create logger logger = logging.getLogger("lookupWrapper") logger.setLevel(logging.DEBUG) #create file handler and set level to debug fh = logging.FileHandler(LOG_FILENAME) fh.setLevel(logging.DEBUG) #create formatter formatter = logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s") #add formatter to ch and fh fh.setFormatter(formatter) #add ch and fh to logger logger.addHandler(fh) logger.debug('========Wrapper=========') ### DELETING ENV VARS ### # Remove problematic environmental variables if they exist. for envvar in ("PYTHONPATH", "LD_LIBRARY_PATH"): if envvar in os.environ: del os.environ[envvar] logger.debug("env vars unset") ### USING OS INTERPRETER ### python_executable = "C:\Python27\python.exe" real_script = os.path.join(os.path.dirname(__file__), "test_wrapper.py") os.execv(python_executable, [ python_executable, real_script ] + sys.argv[1:]) db_data_enrichment.py ############################################################### ##### IMPORTS ##### ############################################################### import sys import os import csv import pyodbc import ConfigParser import logging LOG_FILENAME = 'C:\\Program Files\\Splunk\\var\\log\\lookup.log' ############################################################### ##### CLASSES ##### ############################################################### # Specific class to manage DB connections using pyodbc class ConnectionManager(object): ''' classdocs ''' def __init__(self, config): ''' Constructor ''' self.driver = config.get('connection','driver') self.host = config.get('connection','host') self.port = config.get('connection','port') self.database = config.get('connection','database') self.user = config.get('connection','user') self.password = config.get('connection','password') self.conn = pyodbc.connect('DRIVER={' + self.driver + '};SERVER=' + self.host + '\\' + self.database + ',' + self.port + ';;UID=' + self.user + ';PWD=' + self.password) self.cursor = self.conn.cursor() self.query = config.get('query','sql') # perform lookup with given fields def lookup(self, query_params, output_keys): i = 0 enriched_data = {} self.cursor.execute(self.query, query_params) try: data = self.cursor.fetchone() for key in output_keys: enriched_data[key] = data[i] i =+ 1 except: sys.stderr.write("Error executing query. Returning empty result.") pass return enriched_data def dummy_lookup(self, query_params, output_keys): i = 0 d = {} for key in output_keys: d[key] = "prova" + str(i) i =+ 1 return d def close(self): self.cursor.close() self.conn.close() ############################################################### ##### MAIN ##### ############################################################### if __name__ == '__main__': ### LOGGING ### logger = logging.getLogger("lookup") logger.setLevel(logging.DEBUG) #create file handler and set level to debug fh = logging.FileHandler(LOG_FILENAME) fh.setLevel(logging.DEBUG) #create formatter formatter = logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s") #add formatter to ch and fh fh.setFormatter(formatter) #add ch and fh to logger logger.addHandler(fh) logger.debug('========Lookup=========') ### CONFIGURATION ### cp = ConfigParser.RawConfigParser() cp.read('config.properties') iparams = cp.get('params','input_params').split('\n') oparams = cp.get('params','output_params').split('\n') if len(sys.argv) != (len(iparams + oparams) + 1): sys.stderr.write("Usage: python db_data_enrichment.py " + " ".join(map(str,iparams)) + " " + " ".join(map(str,oparams)) + "\n") sys.exit(0) # establishing connection to database cm = ConnectionManager(cp) ### VARIABLES ### r = csv.reader(sys.stdin) w = None header = [] first = True i = 0 ### EXECUTION ### for line in r: if first: header = line for elem in iparams + oparams: if elem not in header: print "All fields must exist in CSV data" sys.exit(0) csv.writer(sys.stdout).writerow(header) w = csv.DictWriter(sys.stdout, header) first = False continue result = {} i = 0 while i < len(header): if i < len(line): result[header[i]] = line[i] else: result[header[i]] = '' i += 1 w.writerow(dict(result, **cm.dummy_lookup([result[k] for k in iparams if k in result], oparams))) cm.cursor.commit() ### CLOSE CONNECTION ### cm.close() ... View more

Hi, we're trying to use a little piece of JavaScript (put in application.js) to perform column hiding for SimpleResultsTable in a dashboard. Here's the code: if(Splunk.Module.GraphicResultsTable) { var orig = Splunk.Module.GraphicResultsTable.prototype.onResultsRendered; Splunk.Module.GraphicResultsTable.prototype.onResultsRendered = function() { var elements = []; orig.call(this); $('th', this.container).each(function(i, el) { if(/^.*_hide\s*$/.test($(el).text())) { elements.push($(el).text()); $(el).hide(); } }); for(n = 0; n < elements.length; n++) { $("td[field|='" + elements[n] + "']", this.container).hide(); } } } As you can see, we're trying to tell Splunk, when building HTML table, to hide column headers and cells which are named _hide. With this piece of code everything works fine for a single column. When trying to put 2 columns in our SimpleResultsTable, the thing happening is that all "th" involved are correctly hidden, while only the first "td" is hidden, leaving the second perfectly visible (see the image attached, where we would want the column with "B24A" and "B24H" hidden) I've checked the HTML/CSS generated, and have seen that for the column not hidden there's not the same CSS class as for the hidden one, but I have no idea how to change my JS to fix this (not a big expert of JS 😞 ). Any suggestion would be very helpful! P.S.1: I took JS template code from Ziegfried in this answer Remove _raw field from table view P.S.2: as one might notice, my JS refers to a GraphicResultsTable, which is a custom module made by a colleague for custom SimpleResultsTable where it's possible to add custom CSS classes via Splunk ... View more