Hello, we are trying to get data from Netapp server. Trying to understand the process on onboarding the data. I have already installed add-on available on Splunk base. (One main add-on with 3 other supporting add-ons) https://splunkbase.splunk.com/app/5396/ https://splunkbase.splunk.com/app/5616/ https://splunkbase.splunk.com/app/3418/ https://splunkbase.splunk.com/app/5615/ My question is do I need to install Splunk forwarder on Netapp server Or its API based data collection ? In attached screenshot there are 2 option. I configured "ONTAP Collection Configuration".  but there is option of "Add data collection node" which require forwarder details.   Thanks Ankit ... View more

Hi, I have to run python script as an alert action. My Splunk is on windows. I tried my script running like this and its working. Its very basic hello world script. C:\Program Files\Splunk\bin>splunk cmd python hello_world.py This message will be displayed on the screen. commands.conf   [hello_world] filename = hello_world.py I have placed commands.conf in C:\Program Files\Splunk\etc\apps\search\local and C:\Program Files\Splunk\etc\system\local when I am trying running this script from command line  its not working. | script python hello_world  OR | script hello_world Error Message:  Error in 'script' command: Cannot find program 'hello_world' or script 'hello_world'. Not sure why its not be able to find the script. I have placed it to multiple location. $SPLUNK_HOME$\etc\apps\search\bin\scripts\hello_world.py $SPLUNK_HOME$\bin\hello_world.py   (from command line it take this script) My ultimate goal is to run this script as an alert action. but I dont think there is option to run python script. I have option as run a script but seems like that is only for shell script. Thanks   ... View more

Hello,I am trying to connect App to get data in Splunk using REST API. The issue is that REST API request need to be implemented in 2 steps. Send POST request to get the token (valid for 24 hrs) Send GET request to fetch the results using token from first request. I am able to implement two separate requests. But looking to automate this process. My idea is to write a script which will periodically copy the token values to input configuration file. FYI:I have used Rest API Modular input app for these request. Problems: Splunk Server is on windows. Using Rest API Modular Input App, It sending token results directly to Splunk server not sure how to get that on windows machine. If its linux I would have write a bash script which use curl to fetch token value and paste it to input configuration. Not sure how to perform this on windows. Thanks ... View more

Hello, I am trying to connect NetBackup app to Splunk using REST API Modular Input App (https://splunkbase.splunk.com/app/1546/). Our use case is slightly complicated.  Request can be fulfilled in 2 steps.  1. Need to send POST request and we get some token value as a results. 2. Send GET request using that token to get required data from NetBackup server. Does anyone had similar situation earlier or having any suggestions to implement this scenario. Update: I am able to implement 2 separate requests. Splunk is on windows platform. If it was on linux then I would have write a script which will  execute the first request using curl and copy  the token value to the input config of 2nd request. Not sure how to handle on windows platform. Thanks ... View more

Hi, I am using a multi-select input in the dashboard, which displays a list of machines.  I am looking to access this dashboard with  URL having multiple machine comma separated. My requirement is when I open the link it should have all the machines mentioned in the URL in the multi-select filter example ( "," replaced with %2C in url)  http://<URL>?host_token=xxx&form.time_token.earliest=1618437600&form.time_token.latest=1618610400&form.MACHINE_TOKEN=hp707srv%2Cdell970srv%2Cdell429srv%2Cdell477srv%2Cdell432srv   ... View more

Hello All, I am looking to use customize time picker where user can select only latest date/time and earliest time will always -1 min from selected time. I don't want to change default time picker. This will be secondary time picker for specific dashboard.Not sure if this is possible. Thanks ... View more

Hello, I am running a search query on search head and getting below errors. When I am running same query in another environment (single node installation) its working fine.  Is there a way to fix this query.  Both machines are indexers  [hp924srv] Field 'x' does not exist in the data. [hp925srv] Field 'x' does not exist in the data. Query:     | tstats summariesonly=false avg(All_TPS_Logs.duration) AS average, count(All_TPS_Logs.duration) AS count, stdev(All_TPS_Logs.duration) AS stdev, median(All_TPS_Logs.duration) AS median, exactperc75(All_TPS_Logs.duration) AS perc75, exactperc95(All_TPS_Logs.duration) AS perc95, exactperc99.5(All_TPS_Logs.duration) AS perc99.5, min(All_TPS_Logs.duration) AS min, max(All_TPS_Logs.duration) AS max,earliest(_time) as start, latest(_time) as stop FROM datamodel=TPS_V7 WHERE (nodename=All_TPS_Logs host=AMBER_PSC47 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*") NOT All_TPS_Logs.overflow=true GROUPBY All_TPS_Logs.fullyQualifiedMethod | rename All_TPS_Logs.fullyQualifiedMethod as fullyQualifiedMethod |eval time_slice_per_min = (stop-start)/60 | eval Throughput_per_minute=count/time_slice_per_min | eval Throughput_per_second=count/(stop-start) | append [ tstats summariesonly=false avg(All_TPS_Logs.duration) AS average, count(All_TPS_Logs.duration) AS count, stdev(All_TPS_Logs.duration) AS stdev, median(All_TPS_Logs.duration) AS median , exactperc75(All_TPS_Logs.duration) AS perc75 , exactperc95(All_TPS_Logs.duration) AS perc95, exactperc99.5(All_TPS_Logs.duration) AS perc99.5, min(All_TPS_Logs.duration) AS min, max(All_TPS_Logs.duration) AS max,earliest(_time) as start, latest(_time) as stop FROM datamodel=TPS_V7 WHERE (nodename=All_TPS_Logs host=AMBER_PSC47 All_TPS_Logs.duration <= 1000000000000 All_TPS_Logs.duration >= -10000000 All_TPS_Logs.overflow=true (All_TPS_Logs.user=* OR NOT All_TPS_Logs.user=*) All_TPS_Logs.operationIdentity="*" ) GROUPBY All_TPS_Logs.fullyQualifiedMethod | rename All_TPS_Logs.fullyQualifiedMethod as fullyQualifiedMethod |eval fullyQualifiedMethod = fullyQualifiedMethod." (overflow)" | eval time_slice_per_min = (stop-start)/60 | eval Throughput_per_minute= count/time_slice_per_min | eval Throughput_per_second=count/(stop-start) ] | eval average = round(average, 1) | eval stdev = round(stdev, 1) | sort - average             ... View more

Hello, We are planning to migrate single instance splunk installation to clustered deployment (1 MasterNode, 1 Search Head, 2 Indexer). we are using an App with accelerated datamodels.   As per my understanding we can manage all datamodels from Search Head and datamodel should be accelerated on search head only. Query 1: Can we deploy our full app with datamodels on indexers as well ? if no then what files need to be avoid deploying to indexers. when we tried deploying full app on indexers its showing all accelerated datamodels on indexers as well. which I think wrong. Query 2. Same question but for lookups. we are using many lookups as well. where should we keep all lookups ? (Search head OR indexers)   Thanks       ... View more