Hello, UPDATE TO MY QUESTION - i made it more clear: All the embedded reports i created using splunk "embed" function are showing the earliest artficat result and not the latest one. I tried re-creating the report, edit them but no success. I also tried to workaround it by setting report ttl so the earilest artifiact will be deleted, but the it's not deleting. instead the expiration time is just pushed by the number of seconds i set for TTL. When i manually delete the earliest artifact the embed report will show the next earliest one. This is happening on all my embedded reports. Thanks Dori ... View more

Hey, I am looking for a way to change permissions to a saved search via splunk python SDK. I tried using the splunklib.client post method: import splunklib.client as client app = "app_name" cred = {"user": "admin", "password": "changeme", "port": 8089, "host": "localhost","owner":"admin"} service = client.connect(app=app,**cred) service.post('saved/searches/report_name/acl', sharing="app" ) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.6/site-packages/splunk_sdk-1.2.3-py2.6.egg/splunklib/binding.py", line 238, in wrapper return request_fun(self, *args, **kwargs) File "/usr/lib/python2.6/site-packages/splunk_sdk-1.2.3-py2.6.egg/splunklib/binding.py", line 62, in new_f val = f(*args, **kwargs) File "/usr/lib/python2.6/site-packages/splunk_sdk-1.2.3-py2.6.egg/splunklib/binding.py", line 657, in post response = self.http.post(path, all_headers, **query) File "/usr/lib/python2.6/site-packages/splunk_sdk-1.2.3-py2.6.egg/splunklib/binding.py", line 1089, in post return self.request(url, message) File "/usr/lib/python2.6/site-packages/splunk_sdk-1.2.3-py2.6.egg/splunklib/binding.py", line 1109, in request raise HTTPError(response) splunklib.binding.HTTPError: HTTP 404 Not Found -- In handler 'savedsearch': Could not find object id=report_name When i try using curl i get no problem: curl -k -u admin:changeme https://localhost:8089/servicesNS/admin/app_name/saved/searches/report_name/acl -d sharing=app Maybe i am doing something wrong? Or maybe there is other way to do it and i am missing it? Regards, Dori ... View more

Hey, I am working with splunkdj. I created a view, added it to urls.py and created view function in views.py that handles the get parameters (using request.GET parameters dict). It is working when i specify the URL with the parameters directly, but when the request is passing thought the redirect (redirect.tmpl) the get parameters are not passed to the function. i added a raise exception in the views.py and i can see the querydict empty: Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/django/core/handlers/base.py", line 115, in get_response response = callback(request, *callback_args, **callback_kwargs) File "/opt/splunk/etc/apps/framework/server/splunkdj/decorators/render.py", line 74, in wrapper output = function(request, *args, **kwargs) File "/opt/splunk/lib/python2.7/site-packages/django/contrib/auth/decorators.py", line 25, in _wrapped_view return view_func(request, *args, **kwargs) File "/opt/splunk/etc/apps/Ingest/django/Ingest/views.py", line 20, in fxreport raise Exception("Report was not provided %s %s" % (str(request.GET),request.get_full_path())) **Exception: Report was not provided /dj/en-us/Ingest/fxreport <QueryDict: {}> /dj/en-us/Ingest/fxreport** Does anyone have an idea on how to solve it? Regards, Dori ... View more

Hi, According to the document splunk should use empty string for non-matching lookup by default. Yet, when i set an automatic lookup, i can see it uses the "NONE" string by default. I need it to be either empty string or null(). I tried setting default (in transforms.conf file) to NULL or null() but it just sets a string with that value. Here is how my auto-lookup is set: props.conf: LOOKUP-check = valid_sc_users user_id [valid_sc_users] filename = valid_sc_users.csv max_matches = 1 min_matches = 1 disabled = 0 Thanks You ... View more