About mgroves_splunk

mgroves_splunk · ‎11-20-2014

gfuente is correct, data in the KV Store does not count against index licensing.

mgroves_splunk · ‎11-06-2014

Hello, we are working on a solution. I don't currently have an ETA on a fix or work around yet. If you have a support agreement, please open a support ticket to help track the problem. Thanks Mark

mgroves_splunk · ‎10-30-2014

I've been able to reproduce the issue. -Mark

mgroves_splunk · ‎10-30-2014

This sounds like a different issue, can you create a new question with more details?

mgroves_splunk · ‎10-29-2014

Thanks for reporting this issue we are looking into the problem. -Mark,

mgroves_splunk · ‎03-28-2014

Your assumptions are correct, there is not a direct way to produce PDF reports from within the HTML pages of the Web Framework. Depending on your requirements, you can mix SimpleXML Pages with HTML Pages within your applications. These SimpleXML pages will still support PDF reports. My suggestion would be to build the pages required for PDF using SimpleXML.

mgroves_splunk · ‎01-29-2014

Hi Martin Can you try this: var search1 = new SearchManager({ "id": "search1", "search": "index=_internal error | localize | map search=search index=_internal earliest=$$starttime$$ latest=$$endtime$$", "status_buckets": 0, "latest_time": "now", "earliest_time": "-15m@m", "cancelOnUnload": true, "auto_cancel": 90, "preview": true }, {tokens: false}); I believe the quotes around the inner search for the map command is causing the problem and does not seem to be required. -Mark

mgroves_splunk · ‎01-22-2014

I have logged a enhancement request for this feature. Thanks for the feedback. -Mark

mgroves_splunk · ‎12-05-2013

Hello, This is a known issue with the Web Framework in Splunk 6.0. We have a fix that will be 6.0.1 that should be released before the end of the year. There is no current workaround, besides not using alternate root endpoints. Sorry about this. Thanks Mark

mgroves_splunk · ‎11-18-2013

The simplest way is do use single quotes to wrap the search and double quotes to handle the source. {% searchmanager id="search1" search='source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error' preview=True %}

mgroves_splunk · ‎11-14-2013

We are targeting the end of 2013 for a release of 6.0.1, but that is just an estimate.

mgroves_splunk · ‎11-11-2013

Hi aelliot, There is not a way to upload individual files into a Web Framework app using the Splunk Web UI. You can package your solution as an app, then installed the app via the web UI, but not individual files. Is there a specific problem you are trying to solve? Thanks Mark

mgroves_splunk · ‎11-01-2013

Glad to see you got it working, but I wanted to caution against this, for a couple of reasons: settings.py may be overridden during upgrades, which may remove your database definition. The Python libraries directories may also be overridden, which will remove the DB drivers. As a general concern, you may have some trouble with a Search Head Pooling scenario, but that may not be an issue for you. Overall, I completely understand that this is a great feature to have, but I wanted to be honest that it may not be the best approach at the moment. It is something we are looking at enabling.

mgroves_splunk · ‎10-25-2013

Thanks for the details and sorry about the problems. We are actively working on updated all of our SDKs to work with Splunk 6.

mgroves_splunk · ‎08-23-2013

Although users can still go to the Splunk Web port (default 8000), to get the integrated experience of both new Framework and existing Splunk apps users will need to hit the App Framework port (default 3000). Regarding SSO, the App Framework does not currently support SSO. So users hitting the App Framework interface will be prompted for login.

mgroves_splunk · ‎08-15-2013

When the Application Framework is installed it creates a proxy port (3000) that routes traffic to either to standard Splunk apps running on port 8000, or Framework Apps running on port 8080. The App Framework is running within Django outside of Splunk Web but communicating with splunkd. Thanks Mark

mgroves_splunk · ‎07-01-2013

The New Framework, that is currently in preview, is an early look at a new web stack for building Splunk Applications. If you have the experience building Splunk Apps on Mako/CherryPy that is a fine path. The new framework's goal is to make developing the web views of a Splunk App easier if you are familiar with standard web technologies. With the use of Backbone and Django the new framework provides more infrastructure to reduce the amount of code you need to write within your application. Additionally, use of the new application framework enables the web application to be deployed within another web server if needed. Splunk application written with the new application framework do have a dependency on the framework. Applications targeting Splunk 5 will also require an install of the application framework to work properly.

Posts	17
Solutions	4
Karma Given	0
Karma Received	13
Member Since	‎05-02-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Re: Are Key/Value Store data counted as Splunk lic...

Re: Why is the time range preset in web-framework ...

Re: Why is the time range preset in web-framework ...

Re: Why is the time range preset in web-framework ...

Re: Why is the time range preset in web-framework ...

Re: Web framework apps and PDF reports

Re: SplunkJS/HTML Dashboards + map command + $foo$...

Re: Django TableView: Open in search/Export option

Re: Redefine root_endpoint

Re: Search query in block manager of Splunk Templ...

Re: Multiple Dollar signs in Data cause issues whe...

Re: Uploading Custom Web Framework Files to direct...

Re: Splunk6 Django app -- Importing SQLite

Re: Splunk 6 SDK not connection

Re: framework and splunk both run?

Re: framework and splunk both run?

Re: What's the main differents between splunk App ...