Thanks for your reply. Yes, CM will push out the bundle, I guess we will have to test and see if it requires rolling restart, I know in our environment, the rolling restart can cause a lot of issues. I was just wondering if there is a better or an official way to handle this rather than writing our own script. ... View more

Hi, Giuseppe, thanks for the comment. For some integrations, we do index the external data into Splunk, but for some others, we don't index the external data because there is no reason to, the data is already stored somewhere, we don't want to copy that data in Splunk. The way we are doing it is similar to what DBConnect does, through custom search commands. ... View more

Thanks, that makes sense. One of the reasons that we love Splunk is how easy it is to integrate Splunk with other tools. Let's see if anyone from Splunk wants to comment on this. ... View more

Thanks for the answer! This should work. Although just wanted to go one step ahead and check if i can also avoid the whole "id" all together? Basically is there an equivalent call to Components.get() that will accept a tag name or may be even array of DOM elements? ... View more

No indexing at all. You either connect to DB using Python or like what i showed there using subprocess to create a child process to connect to DB, that child process can be in any language of your choice, for me, I use Java. ... View more

With this script, Splunk will NOT connect to MySql, this script will, and Splunk will NOT index any data and will NOT keep any data in local. If the data is not indexed, then you will not have duplicate events issue. ... View more

Assuming you already have a script or program that can get data from DB, the following code should be able to get you going. import splunk.Intersplunk import sys import string import subprocess import os results = [] proc = subprocess.Popen(['script_dir' + os.path.sep + 'script_name', 'any', 'number', 'of', 'arguments'], stdout=subprocess.PIPE, stderr=subprocess.PIPE) while True: output = proc.stdout.readline() output = output.strip() if output != '': arr = string.split(output, ',') row = {} row['field_1'] = arr[0] row['field_2'] = arr[1] results.append(row) else: break splunk.Intersplunk.outputResults(results) ... View more

You will need to create a custom search command which will query your database. I just followed the official doc here. http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/SearchScripts If you are like me who is not fammiliar with python, you can use python subprocess to call another script/program to query database. ... View more

I would try one of these 2 things. 1. For such a small DB table, I would write a custom search command instead of using DB Connect app. Using custom search command means you don't index any data, so you always get the latest data from DB and there is no duplicates events since there are no events at all, just results. 2. If you have to index the data, I had similar issue recently as well with a scripted input, the same data can be returned by the script again and again. This is what I did. your_search | eventstats max(_time) as maxtime | eval diff=(maxtime - _time) | where diff < 300 Here, eventstats will add a new column "maxtime" that contains the timestamp of the latest collection, and basically any row that is 5 minutes older than the latest collection time will be excluded. This way, you pretty much always have the latest data. ... View more

Thanks for the answer. You are right that sparkline does create time buckets like timechart does, but in timechart, null values are not treated as zero, if you pick line style, the line will just connect all your actual data points and skip those null values which is the way it should be. But unfortunately sparkline treats null as zero, and I can't find a way to change that. I don't think I can find a time span that always has a value in every bucket, you are assuming the data is always coming in at the same rate which is not the case. Unless the time span is very big which then it will lose the density. Anyone has other ideas? Thanks. ... View more