At the moment the only way that i found out to show dashboard in menu is using the dashboard url inside <a> tag. ... View more

For the moment we "solved" the issue modifyng the file binding.py. Inside function handler we modified the function reqeust from def request(url, message, **kwargs): scheme, host, port, path = _spliturl(url) body = message.get("body", "") head = { "Content-Length": str(len(body)), "Host": host, "User-Agent": "splunk-sdk-python/0.1", "Accept": "*/*", } # defaults for key, value in message["headers"]: head[key] = value method = message.get("method", "GET") connection = connect(scheme, host, port) try: connection.request(method, path, body, head) if timeout is not None: connection.sock.settimeout(timeout) response = connection.getresponse() finally: connection.close() return { "status": response.status, "reason": response.reason, "headers": response.getheaders(), "body": ResponseReader(response), } to def request(url, message, **kwargs): scheme, host, port, path = _spliturl(url) body = message.get("body", "") head = { "Content-Length": str(len(body)), "Host": host, "User-Agent": "splunk-sdk-python/0.1", "Accept": "*/*", } # defaults for key, value in message["headers"]: head[key] = value method = message.get("method", "GET") connection = connect(scheme, host, port) try: connection.request(method, path, body, head) if timeout is not None: connection.sock.settimeout(timeout) response = connection.getresponse() finally: # connection.close() pass return { "status": response.status, "reason": response.reason, "headers": response.getheaders(), "body": ResponseReader(response), } Basically we removed the connection.close() ... View more

We have python 2.6.6, so i'm not sure i can test the new sdk, it requires python > 2.7 ... View more

Still not tried. It worked the curl retreiving the session key. I will try with new SDK and write here the result ... View more

I tried and i got a session key, so what it means? An old sdk version? But why the problem is present only if i pass via LB URL? It's very strange ... View more

Yes LOAD balancer URL and a simple curl with -k it's working. It seems that the response is an empty body with SDK ... View more

In our case this show app installed on Heavy Forwarder not Universal Forwarder. Is there a way to list installed apps on Universal Forwarder if in the middle there also Heavy Forwarder? Thanks and regards ... View more

Hi, thanks very much for reply. The cron schedule could be every 5 minutes or maybe every 3 minutes. For example a search today run correctly at 11.38, with status "success", then it run again at 11.48 (even it's scheduled every 3 minutes) and it started to run with status "continued" about 50 times in 1 minute, logging also the message: WARN SavedSplunker - Max alive instance_count=1 reached for savedsearch_id="nobody;saved_search_name" Also now, for example, the same search at 12.39 (in Italy) got a status "continued" with scheduled time 12.15 and message reason="The maximum number of concurrent running jobs for this historical scheduled search on this instance has been reached" ... View more

Nice!! Thanks you! I tried mvexpand or makemv, but not together. Thanks! ... View more

Hi, you need to put the script in bin directory of your app and via javascript get the clicked event and run a splunk search like | your_script.sh Maybe you need to cenvert your dashboard in html dashboard. Have a look also here https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Writeasearchcommand Regards. ... View more

Hi, in our company we asked to people that managed uCMDB to create a job that get data from uCMDB, write a csv file and then copy the file on a universal forwarder machine via beta48 job, then we configured that universal forwarder to import that csv. Regards ... View more

Default in limits.conf is 50000. Search is an inputlookup | table and it returns more than 18.000 ... View more

At the end i was able to do the php curl with a simple GET and calling https://localhost:8089/services/search/jobs//results/?output_mode=csv&count=50000 Now the problem is that i get just 10.000 results (should be more than 18.000) ... View more

just arrived me too: | inputlookup lastReportTime.csv | rex field=last_report_time "(?<date>\d{4}-\d{2}-\d{2})\-" | eval _time=strptime(date,"%Y-%m-%d") | eval myrange=if(_time>relative_time(now(), "-90d@d"), "Last 3 months", "Older than 3 months") | stats count by myrange P.S: exactly somesoni2, thanks very much! ... View more

Thanks, this works! But i think that i took the hard way to solve my problem. What i need it's just to tell Splunk to consider the field 'last_report_time' as a date, because what i need is generate a pie chart (in an SDK application) with, for example, host with 'last_report_time' older than 3 month and all other host. ... View more

Hi, first of all for for answer. Basically i was asked to give to the customer the possibility to change the scheduled time of db input via beta48 batch on mainframe. For example: when new data are inserted on DB2, the user schedule a job that change the scheduled time of the DB input, for this reason i was thinking about python. Thanks and regards. P.S. Basically i need to run a DB input on demand, not scheduled. ... View more