Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bojanjanisch
bojanjanisch
New Member
Member since:
07-23-2018
11-15-2023
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-23-2018 |
Activity Feed
- Posted Re: Calculate event time, given a startup time and an offset per event? on Getting Data In. 11-14-2022 01:26 PM
- Posted Re: Bizarre bug with "head" on Splunk Search. 05-22-2020 02:18 PM
- Posted Re: Bizarre bug with "head" on Splunk Search. 10-11-2019 05:03 PM
- Posted Re: Bizarre bug with "head" on Splunk Search. 10-11-2019 04:45 PM
- Posted Re: Bizarre bug with "head" on Splunk Search. 10-11-2019 11:33 AM
- Posted Re: Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-30-2019 10:34 PM
- Posted Re: Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-29-2019 02:24 AM
- Posted Re: Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-28-2019 04:37 AM
- Posted Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-28-2019 02:37 AM
- Tagged Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-28-2019 02:37 AM
- Tagged Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-28-2019 02:37 AM
- Tagged Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-28-2019 02:37 AM
- Tagged Perfmon-Warnings when restarting Splunk UF Service on All Apps and Add-ons. 05-28-2019 02:37 AM
- Posted How to run a parameterized map command as a savedsearch report? on Splunk Search. 02-28-2019 11:39 PM
- Tagged How to run a parameterized map command as a savedsearch report? on Splunk Search. 02-28-2019 11:39 PM
- Tagged How to run a parameterized map command as a savedsearch report? on Splunk Search. 02-28-2019 11:39 PM
- Tagged How to run a parameterized map command as a savedsearch report? on Splunk Search. 02-28-2019 11:39 PM
- Tagged How to run a parameterized map command as a savedsearch report? on Splunk Search. 02-28-2019 11:39 PM
- Tagged How to run a parameterized map command as a savedsearch report? on Splunk Search. 02-28-2019 11:39 PM
- Posted Splunk Python SDK - How to call my custom search command only once? on Splunk Search. 09-13-2018 02:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-14-2022
01:26 PM
Hi @nplamondon, just curious if you have any usable results from your little Factorio ingest approach or if I need to re-invent the wheel myself 🙂 Would be glad to hear from you. Kind regards, Bojan
... View more
05-22-2020
02:18 PM
I posted both searches, working and failing... I only changed the labels / field values, not the commands... If you wish to continue the research I can see if I can reproduce the bug... We simply avoid the non working version
... View more
10-11-2019
04:45 PM
Can you explain the doubly tabled field more precisely? How does this look like?
... View more
10-11-2019
11:33 AM
To clarify the issue a bit:
@nick405060 is running a distributed Splunk environment. He indexed a CSV-file with no _time field and wanted to output the first 250 rows but he always got 0 results. So his search was looking something like search index=abc source=test.csv | head 250 | table a, b, c, d
We researched the search.logs a bit and found an interesting entry like "SimpleResultsCombiner - 236 events were discarded due to a missing or invalid _time field" .
However when he changed the search to "index=abc source=test.csv | table a,b,c,d | head 250" he got the results. He also got results if the first search was executed on an indexer. But if he executed it on a SearchHead, he never got results. So the issue must've originated somewhere in the distributed search mode.
So my guess is that if "head" is applied after a base search (with no reporting commands in between), the centralized streaming mode (https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Commandsbytype) first calls the SimpleResultsCombiner trying to merge/sort events by _time field. However there is no _time field in the CSV, so events are getting skipped. If we apply it on an indexer or after a reporting command, it'll use the distributed streaming mode, which does not seem to call SimpleResultsCombiner. Or maybe it does but not trying to merge/sort results as events by _time and therefore does not skip them.
Maybe there's some explanation from the Splunk devs regarding this issue and how we could avoid these in the future?
... View more
05-30-2019
10:34 PM
"Search" app is a placeholder. It doesn't matter in which app I put the configuration does it?
... View more
05-29-2019
02:24 AM
Yeah that capitalized "i" was a typo. I couldn't copy/paste the config since it lies in a military zone, so all I could do was write it manually. I also don't think this is a configuration issue, since I'm getting data from all counters.
However if the UF service is restarted, I get the stated warning in my _internal index and I don't know why. But only once during the restart.
... View more
05-28-2019
04:37 AM
Forgot to add the config-stanza
[perfmon://LogicalDisk]
counters = % Disk Time; %Disk Write Time; % Disk Read Time; % Free Space; % Idle Time; Avg. Disk Bytes/Transfer; Avg. DIsk Bytes/Write; Avg. Disk Bytes/Read; Avg. Disk Queue Length; Avg. Disk Write Queue Length; Avg. Disk Read Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Write; Avg. Disk sec/Read; Disk Bytes/sec; Disk Transfers/sec; Disk Write Bytes/sec; Disk Read Bytes/sec; Disk Reads/sec; Disk Writes/sec; Free Megabytes;
disabled = 0
instances = *
interval = 300
object = LogicalDisk
useEnglishOnly = true
index = os
showZeroValue = 1
... View more
05-28-2019
02:37 AM
Hi everyone,
I'm running a Splunk UF 6.6.8 on Windows Server 2012 and indexing perfmon data using the Splunk TA for Windows. Each time I'm restarting the service (due to server reboot for example), I'm getting the following Warnings in Splunk:
WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\apps\search\local\inputs.conf, line 100: Cannot parse into key-value pair: Disk Writes/sec;
I'm getting casual perfmon data during runtime, however I can repeat this behavior with every service-restart, I don't even need to reboot the server. I also tried using mode = multikv, but this had no effect, so I assume it may not really be a parsing issue but something else.
Does someone know the reason behind this behavior and maybe a workaround or bugfix?
Greetings
... View more
02-28-2019
11:39 PM
Hi everyone,
I have the following dummy search saved as a report:
| makeresults count=1 | eval test="Hello" | map search="| makeresults count=1 | eval test=\"$test$\""
Executing this search directly runs without issues. However when calling it using the savedsearch-command:
| savedsearch TestReport
I get the following error message:
Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'TestReport': Error while replacing variable name='test'. Could not find variable in the argument map.
I'm running Splunk 7.1.1 on a standalone machine. Does someone has a clue why it can be executed manually but not as a report and how I could execute it as a report?
Kind regards,
Bojan
... View more
09-13-2018
02:36 AM
Hi there,
I'm developing a custom search command to call a custom rest endpoint using Splunk's Python SDK and the command protocol version 2. The SDK supports the command development pretty well, however my command is executed at least twice each time and I don't really know why.
I've created a simple test case which could be installed using the following files in a new app folder under etc/apps/:
./bin/testexecution.py:
import sys
from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators
@Configuration()
class testexecutionCommand(ReportingCommand):
@Configuration(local=True)
def map(self, records):
for record in records:
yield record
pass
@Configuration(requires_preop=False, run_in_preview=False, local=True, streaming=False)
def reduce(self, records):
self.logger.warn("This should only be seen once.")
for record in records:
yield record
pass
try:
dispatch(testexecutionCommand, sys.argv, sys.stdin, sys.stdout, __name__)
except Exception as e:
print(str(e))
./default/commands.conf:
[testexecution]
filename = testexecution.py
chunked = true
./default/authorize.conf:
[capability::run_script_print]
[role_admin]
run_script_print = enabled
./metadata/local.meta:
[commands/testexecution]
access = read : [ * ], write : [ * ]
export = system
The generated search.log contains this information, please note that the marker "This should only be seen once." is logged twice:
09-13-2018 11:33:08.356 INFO dispatchRunner - Search process mode: preforked (first search in process) (build a0c72a66db66).
09-13-2018 11:33:08.356 INFO dispatchRunner - initing LicenseMgr in search process: nonPro=0
09-13-2018 11:33:08.356 INFO LicenseMgr - Initing LicenseMgr
09-13-2018 11:33:08.356 INFO LMConfig - serverName=test-splunk-d guid=68A1ADDC-9631-4A57-83C5-77403FAD4514
09-13-2018 11:33:08.358 INFO LMConfig - connection_timeout=30
09-13-2018 11:33:08.358 INFO LMConfig - send_timeout=30
09-13-2018 11:33:08.358 INFO LMConfig - receive_timeout=30
09-13-2018 11:33:08.358 INFO LMConfig - squash_threshold=2000
09-13-2018 11:33:08.358 INFO LMConfig - strict_pool_quota=1
09-13-2018 11:33:08.358 INFO LMConfig - key=pool_suggestion not found in licenser stanza of server.conf, defaulting=''
09-13-2018 11:33:08.358 INFO LMConfig - key=test_aws_metering not found in licenser stanza of server.conf, defaulting=0
09-13-2018 11:33:08.358 INFO LMConfig - key=test_aws_product_code not found in licenser stanza of server.conf, defaulting=0
09-13-2018 11:33:08.359 INFO LicenseMgr - Initing LicenseMgr runContext_splunkd=false
09-13-2018 11:33:08.359 INFO LMStackMgr - closing stack mgr
09-13-2018 11:33:08.359 INFO LMSlaveInfo - all slaves cleared
09-13-2018 11:33:08.359 INFO LMStackMgr - Skipping trial license as alternative license type in use
09-13-2018 11:33:08.360 INFO LMStack - Added type=enterprise license, from file=splunk.license, to stack=enterprise of group=Enterprise
09-13-2018 11:33:08.360 INFO LMStackMgr - created stack='enterprise'
09-13-2018 11:33:08.360 INFO LMStackMgr - Skipping trial pool stanza as alternative license in use
09-13-2018 11:33:08.360 INFO LMStackMgr - added pool auto_generated_pool_enterprise to stack enterprise
09-13-2018 11:33:08.360 INFO LMStackMgr - added pool auto_generated_pool_forwarder to stack forwarder
09-13-2018 11:33:08.360 INFO LMStackMgr - added pool auto_generated_pool_free to stack free
09-13-2018 11:33:08.360 INFO LMStackMgr - Initialized hideQuotaWarning = "0"
09-13-2018 11:33:08.361 INFO LMStackMgr - init completed [68A1ADDC-9631-4A57-83C5-77403FAD4514,Enterprise,runContext_splunkd=false]
09-13-2018 11:33:08.361 INFO LicenseMgr - StackMgr init complete...
09-13-2018 11:33:08.361 INFO LMTracker - Setting default product type='enterprise'
09-13-2018 11:33:08.361 INFO LMTracker - this is not splunkd, will perform partial init
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=Acceleration state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=AdvancedSearchCommands state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=AdvancedXML state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=Alerting state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=ArchiveToHdfs state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=Auth state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=CustomRoles state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=DeployClient state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=DeployServer state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=DistSearch state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=FwdData state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=GuestPass state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=KVStore state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=LDAPAuth state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=LocalSearch state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=MultifactorAuth state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=MultisiteClustering state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=NontableLookups state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=RcvData state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=RcvSearch state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=RollingWindowAlerts state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=SAMLAuth state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=ScheduledAlerts state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=ScheduledReports state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=ScheduledSearch state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=ScriptedAuth state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=SearchheadPooling state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=SigningProcessor state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=SplunkWeb state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=SubgroupId state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=SyslogOutputProcessor state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LMTracker - Setting feature=UnisiteClustering state=ENABLED (featureStatus=1)
09-13-2018 11:33:08.361 INFO LicenseMgr - Tracker init complete...
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'licenses'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'pools'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'stacks'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'groups'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'slaves'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'localslave'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'licensermessages'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'scriptedwarning'
09-13-2018 11:33:08.365 INFO AdminManagerDispatch - added factory for admin handler: 'licenseusage'
09-13-2018 11:33:08.365 INFO dispatchRunner - registering build time modules, count=1
09-13-2018 11:33:08.365 INFO dispatchRunner - registering search time components of build time module name=vix
09-13-2018 11:33:08.365 INFO dispatchRunner - Getting search configuration data from: /opt/splunk/etc/modules/parsing/config.xml
09-13-2018 11:33:08.367 INFO BundlesSetup - Setup stats for /opt/splunk/etc: wallclock_elapsed_msec=20, cpu_time_used=0.016, shared_services_generation=2, shared_services_population=1
09-13-2018 11:33:08.375 INFO UserManagerPro - Load authentication: forcing roles="admin, can_delete, power, user"
09-13-2018 11:33:08.376 INFO UserManager - Setting user context: splunk-system-user
09-13-2018 11:33:08.376 INFO UserManager - Done setting user context: NULL -> splunk-system-user
09-13-2018 11:33:08.376 INFO UserManager - Unwound user context: splunk-system-user -> NULL
09-13-2018 11:33:08.376 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.376 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.377 INFO dispatchRunner - search context: user="admin", app="search", bs-pathname="/opt/splunk/etc"
09-13-2018 11:33:08.380 INFO dispatchRunner - Executing the Search orchestrator and iterator model.
09-13-2018 11:33:08.381 INFO SearchOrchestrator - SearchOrchestrator getting constructed
09-13-2018 11:33:08.381 INFO SearchOrchestrator - Initialized the SRI
09-13-2018 11:33:08.381 INFO ISplunkDispatch - Not running in splunkd. Bundle replication not triggered.
09-13-2018 11:33:08.381 INFO SearchOrchestrator - Initialzing the run time settings for the orchestrator.
09-13-2018 11:33:08.381 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.381 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.381 INFO SearchOrchestrator - Creating the search DAG.
09-13-2018 11:33:08.381 INFO SearchPhaseGenerator - Disabling summaries in verbose mode
09-13-2018 11:33:08.381 INFO SearchParser - PARSING: | testexecution
09-13-2018 11:33:08.383 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/testCommand/bin/testexecution.py
09-13-2018 11:33:08.446 INFO AstOptimizer - SrchOptMetrics optimize_toJson=0.062923079
09-13-2018 11:33:08.447 INFO SearchParser - PARSING: | testexecution
09-13-2018 11:33:08.447 INFO ProjElim - Black listed processors=[addinfo]
09-13-2018 11:33:08.462 INFO AstOptimizer - SrchOptMetrics optimization=0.015610200
09-13-2018 11:33:08.462 INFO SearchPhaseGenerator - Optimized Search =| testexecution
09-13-2018 11:33:08.462 INFO ParallelReducePolicy - Current Search Head doesn't have any usable peers to use.
09-13-2018 11:33:08.462 INFO PhaseNodeGenerationVisitor - User lacking run_multi_phased_searches, rolling back to 2-phase mode.
09-13-2018 11:33:08.462 INFO PhaseToPipelineVisitor - Phase Search = | testexecution
09-13-2018 11:33:08.462 INFO SearchParser - PARSING: | testexecution
09-13-2018 11:33:08.462 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/testCommand/bin/testexecution.py
09-13-2018 11:33:08.520 INFO SearchPipeline - ReportSearch=1 AllowBatchMode=0
09-13-2018 11:33:08.520 INFO SearchParser - PARSING: testexecution phase="map"
09-13-2018 11:33:08.522 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/testCommand/bin/testexecution.py
09-13-2018 11:33:08.522 ERROR ChunkedExternProcessor - stderr: This should only be seen once.
09-13-2018 11:33:08.582 INFO SearchPhaseGenerator - Disabling timeliner since source is not an event index
09-13-2018 11:33:08.582 INFO SearchPhaseGenerator - Disabling timeliner since event search is empty
09-13-2018 11:33:08.582 INFO SearchPhaseGenerator - No need for RTWindowProcessor
09-13-2018 11:33:08.582 INFO SearchPhaseGenerator - Timeliner will not be executed
09-13-2018 11:33:08.582 INFO SearchPhaseGenerator - required fields list to add to different pipelines =
09-13-2018 11:33:08.582 INFO SearchPhaseGenerator - Search Phases created.
09-13-2018 11:33:08.583 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.583 INFO UserManager - Done setting user context: admin -> admin
09-13-2018 11:33:08.583 INFO UserManager - Unwound user context: admin -> admin
09-13-2018 11:33:08.583 INFO DistributedSearchResultCollectionManager - Stream search:
09-13-2018 11:33:08.583 INFO SearchPhaseGenerator - Result collation will occur at proc=testexecution
09-13-2018 11:33:08.583 INFO SearchParser - PARSING: | streamnoop
09-13-2018 11:33:08.583 INFO SearchParser - PARSING: streamnoop | testexecution phase="map" | testexecution
09-13-2018 11:33:08.583 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/testCommand/bin/testexecution.py
09-13-2018 11:33:08.584 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.584 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.584 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.584 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.585 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.585 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.585 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.585 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.585 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.585 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.652 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/testCommand/bin/testexecution.py
09-13-2018 11:33:08.767 INFO SearchOrchestrator - Starting the status control thread.
09-13-2018 11:33:08.767 INFO SearchOrchestrator - Starting phase=1
09-13-2018 11:33:08.767 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.767 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.767 INFO SearchStatusEnforcer - Enforcing disk quota = 10485760000
09-13-2018 11:33:08.767 INFO PreviewExecutor - Preview Enforcing initialization done
09-13-2018 11:33:08.767 INFO UserManager - Setting user context: admin
09-13-2018 11:33:08.767 INFO UserManager - Done setting user context: NULL -> admin
09-13-2018 11:33:08.767 INFO ReducePhaseExecutor - Stating phase_1
09-13-2018 11:33:08.767 INFO DispatchExecutor - BEGIN OPEN: Processor=testexecution
09-13-2018 11:33:08.771 INFO DispatchExecutor - END OPEN: Processor=testexecution
09-13-2018 11:33:08.776 ERROR ChunkedExternProcessor - stderr: This should only be seen once.
09-13-2018 11:33:08.779 INFO ReducePhaseExecutor - Ending phase_1
09-13-2018 11:33:08.779 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.779 INFO DispatchManager - DispatchManager::dispatchHasFinished(id='1536831188.107', username='admin')
09-13-2018 11:33:08.786 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.786 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.787 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.787 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.787 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.787 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.787 INFO UserManager - Unwound user context: admin -> NULL
09-13-2018 11:33:08.787 INFO UserManager - Unwound user context: admin -> NULL
I appreciate your help understanding Splunk better.
... View more
07-23-2018
04:14 AM
Better format of code:
view.getSearchJobObj().setFetchOptions(output_mode="json_cols", time_format=pt.TIME_RAW_FORMAT)
results = view.getSearchJobResults()
and
data = list()
for key in results[0].keys():
column = list()
for r in results:
column.append(r[key])
data.append(column)
Sorry for this comment, I couldn't find an option to edit it anymore.
... View more
07-23-2018
03:39 AM
Hey everyone,
I'm currently writing a custom search command for some reporting and I'm struggling with the result format that I get. Usually you get an array of json events that can be used for streaming commands, however what I need is an array of columns, where each element contains all values from a column of the resultset.
I know that in Splunk's internal libraries there is a function called "setFetchOptions()" which is also used by some visualizations to gather the results in a column array instead of row array, however I couldn't find an implementation of it directly.
from pdfgen_endpoint.py, line 698:
view.getSearchJobObj().setFetchOptions(output_mode="json_cols", time_format=pt.TIME_RAW_FORMAT)
results = view.getSearchJobResults()
I know that I can create this column array manually by iterating over the resultset like this:
data = list()
for key in results[0].keys():
column = list()
for r in results:
column.append(r[key])
data.append(column)
However I thought that maybe someone knows a more convenient, so to say: Splunk way of doing it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-15-2023
01:18 AM
|
