Nice idea of chunking results in 10 blocks of multivalued fields, and I didn't expected rex to behave like that on multivalued fileds, interesting! I would use "list" instead of "values" to keep the order and maybe even duplicates (depends on your use case). ... View more

cool, thanks! ... View more

yep, this whole SDK could get more documentation. For the moment, I'm staying with my previous statement: It seems to work, but I have absolutely no idea what I'm doing. 😄 ... View more

mmmh... if your command is named "mycommand", then the class must be @Configuration() class mycommandCommand(ReportingCommand): ... View more

Hi Richie, looks like you have another problem. Did you configure the command in the /local/commands.conf correctly? i.e. something like: [toxlsx] filename = toxlsx.py requires_srinfo = true stderr_dest = message supports_getinfo = true supports_rawargs = true supports_multivalues = true run_in_preview = false (here my command is named toxlsx, and the file name and class name muss match). You need to restart Splunk to let it know about the new command. If it still doesn't work, try to make the example commands in the SDK, without changes. Good luck, Stéphane ... View more

I can't confirm this. I just downloaded 8.0.0, and the reportlab library is still the same, platypus is still having as default a Cell Alignment "Bottom". In the archive (linux download, tgz), Python is still under $HOME/lib/python2.7 and not under $home/Python2.7 Are you sure you haven't installed Python yourself? Or are you using a different version/platform? ... View more

One solution is to re-implement yourself a concurrency calculation. It involves creating an event when the call starts, and another when the call ends. Give the start a value of +1 and the end -1, and Streamstats will allow you to keep a running count of calls. Finally, with makecontinuous, you can fill the time stamps between "events" to get a visualisation of the actual concurrent calls. |eval end_time=_time+call_duration| eval time=mvappend(_time,end_time) | mvexpand time | sort 0 time |eval start_stop=if(end_time=time,-1,1)|makecontinuous time span=1m|streamstats sum(start_stop) as concurent | eval _time=time | fields _time concurent ... View more

So, I added a map function that returns all records: @Configuration() def map(self, records): return records It seems to work (no errors, my script receives all data and works as expected), but I have absolutely no idea what I'm doing. Is that the correct way to not do anything in the map phase? (especially, what is the difference with yield() vs what I'm doing here?) ... View more

I added a map function, but it leads to the same error: External search command 'toxlsx' returned error code 1. Script output = "error_message=TypeError at "/opt/splunk-6.5.2/etc/apps/ta-toxls/bin/splunklib/searchcommands/internals.py", line 519 : 'NotImplementedType' object is not iterable " @Configuration() def map(self, records): return NotImplemented ... View more

No, I haven't removed the condition in the prepare fuction... The (reporting command) template show nothing about it: #!/usr/bin/env python import sys from splunklib.searchcommands import \ dispatch, ReportingCommand, Configuration, Option, validators @Configuration() class %(command.title())Command(ReportingCommand): """ %(synopsis) ##Syntax %(syntax) ##Description %(description) """ @Configuration() def map(self, events): # Put your streaming preop implementation here, or remove the map method, # if you have no need for a streaming preop pass def reduce(self, events): # Put your reporting implementation pass dispatch(%(command.title())Command, sys.argv, sys.stdin, sys.stdout, __name__) and the prepare function is only found in the ReportingCommand class (splunklib/searchcommands/reporting_command.py) without info about overriding the prepare function... I tried to remove the map section completely, or keep the return only, but it doesn't help. It triggers other errors: with only return: /splunklib/searchcommands/internals.py", line 519 : 'NotImplementedType' object is not iterable (which shows that it tries to use the map() function of the base class, which returns "NotImplemented") without the if phase=='map' section: It triggers the exception, as the phase is not recognised. So basically, I think I need to implement a dummy map function that does nothing. Any idea how this would look like? ... View more

You need to modify your single IP values in the lookup by appending a /32, i.e. in your case it should be 10.10.1.1/32. ... View more

I've found in etc/system/default/ui-prefs.conf the following: display.prefs.events.count = 20 display.prefs.statistics.count = 20 but changing it (in etc/system/local/ui-prefs.conf) didn't help... any other idea? can we override it somewhere? ... View more

Hi @frobinson_splunk, I have setup such an alert that sends an email per event, and then pause for one week. I've seen that by changing the alert search definition, all events retriggered. So I was wondering how do the internals work, i.e. where are the values cached, when will they reset, ... By extension and being curious, I want to know more about the mechanism, and if there are ways to see the internal states. It's also about knowing the impact of changing something that will reset the state. Maybe, if I knew how it works, I could prepopulate the state with a query, so that I can avoid a flood of alerts when setting it up... Do these questions make sense? Regards, Stéphane ... View more

Hi @frobinson_splunk thank you for the pointer, however it describes how I can configure alert suppression, but not how it works. #******* # alert suppression/severity/expiration/tracking/viewing settings #******* alert.suppress = 0 | 1 * Specifies whether alert suppression is enabled for this scheduled search. * Defaults to 0. alert.suppress.period = * Sets the suppression period. Use [number][time-unit] to specify a time. * For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour etc * Honored if and only if alert.suppress = 1 * Defaults to empty string. alert.suppress.fields = * List of fields to use when suppressing per-result alerts. This field *must* be specified * if the digest mode is disabled and suppression is enabled. * Defaults to empty string. What I'm looking for: how many fields values are currrently being tracked (is there a limit?) which actual values are being tracked, and when will a particular value suppression expires? where are these tracked values stored/cached? How can I manually reset some/all? When does Splunk reset all tracking (for example, when the alert search is edited)? So any description of the internal mechanism would help a lot to understand how it works, limitations, and behaviour. Thanks a lot in advance for your investigations! Regards Stéphane ... View more

yes, yes, and yes! 🙂 My server is indeed CET, but as you mentionned, any date in 1970 fails. It still looks like a bug to my eyes. 😉 ... View more

I had a similar use case with PDFs. I finaly wrote a script to generate the saved searches and schedules based on a template and csv of parameters. http://answers.splunk.com/answers/200640/how-to-schedule-customized-dashboard-views-to-grou.html Maybe you can hack it to fit your use case. ... View more

The integrated PDF report generator has hard coded chart sizes... I manually changed it but it is global for the whole search head... ... View more

Have you looked at this answer: http://answers.splunk.com/answers/111602/trigger-a-pdf-via-the-command-line.html ? ... View more

Hi, I haven't found a built-in feature to do that, so I wrote a script that takes a dashboard template and a csv list of parameters in order to generate multiple individual dashboards and schedules. see: http://answers.splunk.com/answers/200640/how-to-schedule-customized-dashboard-views-to-grou.html I haven't published it, as it is quite ugly, but if you want I can send it to you. Regards, Stephane ... View more