All Apps and Add-ons

Issue with OMS JSON Query

eskarthi
New Member

Hello,

Nowadays we are relaying on OMS query for pulling data into Splunk, however i have noticed some gaps in the OMS - Json query.

For example : we are querying azure activity for every hour and we got some intermittent network disconnection/timeout error for sometime. Once the network connection was resumed the oms connector is not pulling the data from where it left .

Technically the script is constructing values in end,start parameters for extracting the query, however OMS/Log Analytics is not listening to the value we set in end,top,start parameters, it takes only the "query" parameter and execute.

{"query": "AzureActivity | where TimeGenerated > ago(1h)", "end": "2019-05-01T00:00:00", "top": "1", "start": "2019-05-01T11:21:56"}

Furthermore, I have tested the above query using postman utility and the OMS is ignoring those values and i don't know why we are sending those values to Azure ?

is there any way to fix the intermittent connection issues in code ? Please advise.

Thanks
Karthik

0 Karma

jkat54
SplunkTrust
SplunkTrust

The app is a concept app based on the original OMS query language. The API the app used has been changed significantly.

If you can suggest any edits to code, I'd love to make patches for you and the community when I can.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...