There are two probable solutions to this problem. First of all this is CORS problem, means the browser will stop the request to send the request to Splunk server as the splunk is not authorized to response to different domains. Solution: You have to add the Allow-Control headers in splunk, check out server.conf and web.conf. for documentation. If you want to bypass the splunk config , and don't want to touch the web.conf files , then make a local request to application server and from there you can make a request to Splunk server. You will by pass the browser restrictions.Also you have to keep in mind that your management port is running on valid certificate ,otherwise at the application server side of your application you have to allow the unsecure connections(I got the same problem when i was connecting from node). ... View more

yes they are , these are spikes in the Total Errors and authorization and authentication failures respectively . ... View more

I know its too late to reply but not too late to contribute. I am working on same kind of thing here my query which worked for me . |where like(label,"%"+"$Token_Name$"+"%") OR like(label,"%"+"$Token_Name_part$"+"%") ... View more

I don't want to convert my xml into HTML dashboards ,i have to create an html panel in XML itself and use that js file . the only question is can i use search managers or any other thing to have search results in js file only for xml dashboards ... View more

You can enable the splunk at https or http port by adding the stanza in server.conf file located in /Splunk_Home/etc/apps/system/local [sslConfig] enableSplunkdSSL = true|false ... View more

Too Awesome.... ... View more

host and value are basically field value pairs of of your tag. So it will be like in in this format field=value.In the URL it is encoded as %3D(in my case).Also i observed one thing .When i tried to have my username it didn't work.So i added nobody in the username and altered the owner in the paramters.Try with that too. ... View more

Thanks @spause ... View more

I had a same problem.First Check your Splunk and Python Path .secondly check on which port python is running .Or some other application is running on the same port. ... View more

You can black list the data in inputs.conf or even can parse the data using Heavy forwarder or even writing a script for parsing or if you want cheap-fix you can decrease the throughput .It will reduce the speed for ingestion of data in splunk which will be under scheme. ... View more

Try this , it resolved my problem. |fillnull value="#" ... View more

Thanks a lot @polymorphic i really appreciate you time and efforts . 🙂 Got the answer finally : You can update the permission of tags through REST API having a POST request at the following url and parameters: https://localhost:8089/servicesNS/ks/search/saved/fvtags/tag_name/field%3Dvalue/acl -d owner="ks" -d sharing="app" -d perms.read="" -d perms.write="" Please check the following link https://answers.splunk.com/answers/388854/how-can-i-change-the-permissions-of-dynamically-cr.html ... View more

Then i suppose through this url i can change the permission, please correct me if i am wrong https://localhost:8089/servicesNS/ks/search/saved/fvtags/host=hostvalue/acl ... View more

Then i suppose through this url i can change the permission, please correct me if i am wrong https://localhost:8089/servicesNS/ks/search/saved/fvtags/host=hostvalue/acl ... View more

So in that case i cannot update the permissions of the tags through REST , right ? ... View more

If any one of the option worked for you ... View more

I am trying to create new tags through REST API. I had success in that ,creating new tags ,but then i noticed that it's in my name and also the permission is set to private.So have to change the permission of tag to public so that it can be used . And i can my find my tag using this url https://localhost:8089/servicesNS/ks/search/search/tags/testTag So , if my username ->ks tag_name-> testTag So i am hitting the URL with post request with following data https://localhost:8089/servicesNS/ks/search/search/tags/testTag/acl -d sharing="app" -d perms.read="" -d perms.write="" But its giving me Unknown EndPoint . ... View more

yes .. for sure . In the below comment i found about this link http://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing#Access_Control_List Here in the docs , it says many api's are supported . Is that mean not all . So can i change the permissions of tags or not ... View more

tried most of them ..didn't get any kind of success. In to documentation of ACL it is written many APi are supported but not all i suppose .So in that case can i change the permissions of tags ? There is no sure answer for that anywhere , just examples . ... View more