@phoenixdigital what is the "self" object you are referring to here? I'm having issues getting session key in a scripted input running on windows, but it works in linux environments. Best regarss ... View more

Any success with this? I'm stuck at the same issue ... View more

Found any solution to this? ... View more

If i do the logic | where NOT 'exclude_me' in (mymvfield) the logic works. as soon as i put the exact same string as the argument to the boolean logic in mvfilter it breaks. ... View more

Hi rich, thanks for reply. I only get Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. when i do | eval excludes = mvfilter( NOT in(mymvfield, 'exclude_me') ) ... View more

This might work, but to play the devil's advocate here: Ponder that the list has an IP and host of example.com with ip 192.168.0.1 At some point, that key-value expires (i.e is old), perhaps because the IP has changed. At a later point in time, the ip 192.168.0.2 resolves to example.com , which then should be put in the KV store. At this point, without using timestamps and additional logic, you cant be certain the dedupped hostname (for example) removes the correct entry in the KV-store. I've had huge problems with the KV-store functionalities, where inputlookup is great in terms of providing data on a row by row basis, making it easy to discern duplicates etc, but has the requirement of being the first command in the pipe. lookup on the other hand can be anywhere in a search, but does not provide a way to separate colliding entries (i.e. the output will be similar to that of doing a | stats values(*) by x ... View more

Inputlookup has to be the first command of a search ... View more

A follow-up issue of is that I can't really remove IP collisions within the kvstore since there is no way of telling which of the values belong to which key or row or what have you. ... View more

Hi @jeffland, thanks for your reply! first question first - how do you tabulate your code lika that on answers? Second part - I have a list similar to the one you described, with ip, macs and hostnames, along with timestamps when each of these were added or updated. This is intended to be the representation of a machine. At any point in time, i need to, for example, look up a hostname, or a mac, or a timestamp for one of these values. If a hostname for example is apparent in several rows, there is no way for me to determine the exact values belonging to that row since all of them are bundled together. mvexpand on the other hand explodes the multi-values into every possible combination. A result which has 5 values in 5 fields will return 5^5 events. If the events that contained my value i wnated to search for, say host=jeffland would be represented on rows, i wouldnt have this problem. The only solution right now is to use a combination of the hostname and, say, the updated time for that value, by using two |lookup commands to first single out the host, and subsequently expand every value i need to search for and again use a | lookup filtering for that host and finding the time field i'm looking for. ... View more

Thanks, will check back with a current search ... View more

@niketnilay it's not necessarily a big KV-store, say around 3-10k entries. It has the use-case requirements of being read/written to constantly however and as such I don't see a csv file as being the right option for me. Additionally, since the data is time bound in a sense, indexes wouldn't suffice - I'm having a need for CRUD-like interfacing with the data which kv-stores give me. Each row (possibly) has an IP, and an IP may be apparent in several rows. ... View more

sorry, yes it meant to say default/app.conf... My bad ... View more

@lakshman239 thanks for your quick reply! I've made the app setup myself, e.g. not using a setup.xml or addon builder. I used the Dev-for-all app available on splunkbase for most of the interactions. Will check splunkd_ui_access.log for it. Restarting/reinstalling does not help unfortunately. ... View more

I can't. What about it should i look for? its very basic; <dashboard script="javascript/setup_titan.js hideEdit="true"> <label>label</label> <description>This app helps ...</description> <row> <panel> <title>Description</title> <html> </html> </panel> </..> </..> ... View more

Can I bump this question? There seems to be no way of telling splunk how to redirect properly. ... View more

Define "global" ? Do you want the value to be saved between reboots/visits to other dashboards/apps etc? or just for the duration of the current view? ... View more

Note; i made the app so I should have access to whatever is needed ... View more

Thanks, ended upp doing that and a few other modifications, and it worked. Not sure if the restart was the trick or some other hack, but it works now. ... View more