Hi, Is there any limit on the size of the JSON the REST API Modular Input add-on can handle before the responsehandlers.py goes to work? I have written a custom response handler to parse a large JSON file into separate events before indexing in Splunk. In UAT and NFR environments everything works fine. The JSON is around 16.5k lines and 400K characters. In PROD the data fails to index. The JSON is around 100k lines and 3M characters. The sourcetype is set to the below. [RESTMAR] TRUNCATE = 0 TIME_PREFIX = lastModifiedDate I can hit the endpoint with POSTMAN for both UAT /NFR and PROD, with the separate consumer secrets and keys, and get a successful response for each Environment. I have edited the rest.py line 42 to put the logger on debug #set up logging logging.root logging.root.setLevel(logging.DEBUG) I will continue to investigate but has anyone else had this issue? Thanks, Dan ... View more

I have the following search index=iis | eval WebShellActive=if(match($Webshell$,"true"),"Yes",WebShellActive) | eval LauncherActive=if(match($cs_User_Agent_$,"NeoNative*"),"Yes",LauncherActive) | eval BrowserFlexActive=if($LauncherActive$="Yes","No",if($WebShellActive$="Yes","No","Yes")) | bucket span=1d _time | fillnull value="No" LauncherActive WebShellActive | stats count by _time GUID LauncherActive WebShellActive BrowserFlexActive For some users, that use multiple access methods in one day, the results will be as follows. _time GUID LauncherActive WebShellActive BrowserFlexActive count 1 2016-06-02 TESTER1234 No Yes No 156 2 2016-06-02 TESTER1234 Yes No No 112 3 2016-06-02 TESTER1234 Yes Yes No 34 The desired result would be to drop the count and only have one entry for each user. The entry would show, by day, by user, each access method used. _time GUID LauncherActive WebShellActive BrowserFlexActive 1 2016-06-02 TESTER1234 Yes Yes No Hope you can help! Thanks, ... View more

I have the following configuration on my forwarder. [tcpout] defaultGroup=indexer1,indexer2,indexer3 [tcpout:indexer1] server=[*indexer1*] [tcpout:indexer2] server=[*indexer2*] [tcpout:indexer3] server=[*indexer3*] The props.conf was configured incorrectly on indexer2. I need to re-index all the data on this server to indexer2. How can I do this without reindexing data for indexer1 and indexer3? There are hundreds of files, so oneshot does not seem to be an option. I know about deleting the fishbucket on the forwarder, but again, this would send data to all indexers. Hope you can help! Thanks, Dan ... View more

Hi, There are over 100 reports created by the admin and set to private. The request is to give the power user access to all the reports. I do not want to do this manually. All the reports are in Splunk\etc\users\admin\search\local\savedsearches.conf The meta data is in \Splunk\etc\users\admin\search\metadata\local.meta Can I just copy all the save searches to \Splunk\etc\apps\search\local\savedsearches.conf and add to the meta file in... \Splunk\etc\apps\search\metadata\local.meta ....the below for each search I have copied across? access = read : [ admin, power ], write : [ admin, power ] Will this cause any issues for the admin user? Is this the correct way to go about moving a large number of reports? Can I use the same method for lookups? Thanks, Dan ... View more

I have a search that ends with | stats sum(count) AS Hits by _time GUID cs_uri_stem Which results in a table I would like to reformat the table as follows, but have had some difficulty. Any help much appreciated! ... View more

Hi, I have a index of raw usage data (iis) and a separate index of entitlement data (rest_ent_prod), both indexes have a unique identifier for each user "GUID". I would like to be able to ad hoc search the raw usage index for user behavior of users with certain entitlements and also create summary indexes. The issue I have is the number of unique users with certain entitlements is around 30k and subsearches max out at 10.5k. Can anyone advise how I can get around this issue? Thanks, Dan ... View more

Hi, I pull data into Splunk using the REST API Modular Input. The data is returned in json format. I store the data in one index and run a scheduled search against this index once a day to populate a summary index to use with dashboards and analysis. The following in verbose mode returns 78k+, but when using to populate the summary index, it only returns 50,000 results into the summary index. index=rest_ent_prod | spath output=GUID path=users{} | bucket span=1d _time | stats count by _time GUID groupName groupId Can anyone help me populate the entire data set into the summary index? Thanks, Dan ... View more

Hi, I have a number of timecharts displaying KPIs over the last 30 days. What would be the most efficient way to add in overlay lines with the Mean, Upper Control Limit, Lower Control Limit, and Targets? The end result would be much like the below. http://www.kaushik.net/avinash/excellent-analytics-tip-9-leverage-statistical-control-limits/ Does anyone have any examples? Thanks, Dan ... View more

Hi, Is it possible to have an area chart with a chart overlay as a column chart only using simple XML? Thanks, Dan ... View more