if you are using EVENT_BREAKER on UF why do you even need LINE_BREAKER on indexers would not defeat the purpose of putting EVENT_BREAKER on UF as indexer would again run same regex on data that is already regexed by UF? ... View more

Thanks everyone!! ... View more

Thanks so much for two answers!! so, I need inputs.conf with two ports one for one port for non-ssl(default 9997) and another for SSL? Then just use SSL configs in outputs.conf for each forwarders where we need SSL? is there some splunk docs out there which I can take a look? ... View more

Hi Damien, Optionally set your JAVA_HOME environment variable to the root directory of your JRE installation.If you don't set this , the input will look for a default installed java executable on the path. where is the default path "the input will look for a default installed java executable on the path"? -Jatin ... View more

I am using this /services/streams/diag endpoint and its created 3GB file, it does not make sense. The usual diag creates file around 400MB. Also i cannot find any documentation on using this endpoint. ... View more

Below is the class i have added in est_ta/bin/responsehandlers.py. Thanks to Damien!!! class MyClass: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): print_xml_stream(raw_response_output) now = datetime.now() thirtym = timedelta(minutes=30) newtime = now + thirtym time_fmt = '%Y-%m-%dT%H:%M:%S' if not "params" in req_args: req_args["params"] = {} req_args["params"]["starttime_thirtym"] = now.strftime(time_fmt) req_args["params"]["timenow"] = newtime.strftime(time_fmt) ... View more

Now it makes sense...is there a extended documentation for this app? I feel lot of it is not documented in the App page. ... View more

Damien, Response handler are only after we get the response from REST endpoint and used more to act on the data before it indexes. But if i am unable to get the data from right time range how does it matter on using this approach? Also if its keep using the same token value with every run what is the point of defining dynamic tokens in the tokens.py? I could just hardcode the value in the endpoint. Thanks, -Jatin. ... View more

Hi Damien, Below example will give me count between 5-5:30PM yesterday. http://internalendpoint.internaldomain.com/service/Service.svc/GetCountInTimeRange?minTime=2015-09-24T17:00:00&maxTime=2015-09-24T17:30:00 below are the inputs.conf that i have tried [rest://Order_Data2] auth_type = none endpoint = http://internalendpoint.internaldomain.com/service/Service.svc/GetCountInTimeRange?minTime=$starttime_thirtym$&maxTime=$timenow$ http_method = GET index = main index_error_response_codes = 0 polling_interval = 1800 response_type = text sequential_mode = 1 sourcetype = TestTotalCount streaming_request = 0 disabled = 1 [rest://Order_Data_tc2] auth_type = none endpoint = http://internalendpoint.internaldomain.com/service/Service.svc/GetCountInTimeRange?minTime=$starttime_thirtym$&maxTime=$timenow$ http_method = GET index = main index_error_response_codes = 0 polling_interval = */5 * * * * response_handler = TotalCount response_type = text sequential_mode = 0 sourcetype = TestTotalCount2 streaming_request = 0 disabled = 1 sequential_stagger_time = ... View more

i am not sure why i don't see the xml part above. let me try again: ... View more

sorry for late reply, but it did not work.. ... View more

I tried but that is creating too many unwanted fields like over 5000. I only need few fields from the XML data. Search also becomes pretty slow. ... View more