I've discovered issue with WebLogic add-on (1.0.0) for Splunk and I am having hard time figuring out how to fix props.conf to parse timestamp correctly. My Splunk instance is in CEST. There is string with timezone after timestamp and CEST/GMT are parsed correctly but UTC is not. Server #1 - Correct     ####<Oct 5, 2022 5:00:21 PM CEST> <Info> ... Parsed timestamp: 10/5/22 5:00:21.000 PM       Server #2 - correct     ####<Oct 5, 2022 3:24:11 PM GMT> <Info> ... Parsed timestamp: 10/5/22 5:24:11.000 PM       Server #3 - incorrect     ####<Oct 5, 2022 4:30:23 PM UTC> <Info> Parsed timestamp: 10/5/22 4:30:23.000 PM Should be: 10/5/22 6:30:23.000 PM          ... View more

I've created custom python input via add-on builder,  called events from API for last 24 hours and data are there. I can see them in the data builder in response. However, add-on I am trying to create needs to run on 60 seconds schedule. At Edit Data Input I've selected Collection Interval of 60 seconds and in my add-on I look to the past 60 seconds.  At Define & Test step I click on Finish, get confirmation about set up interval and that's all. There are no events and based on _internal logs it didn't even run once after saving. Any idea what could be wrong? Why the script isn't running on schedule?  ... View more

Hi,    how do I read results of finished Splunk search in Javascript with following function?   mvc.Components.get("search_id").on("search:done", function () { }) ... View more

Hi, There is issue in version 8.0.4.1 with user cookie/session being broken. Whenever I load Splunk, I do receive 404 on this address: http://localhost:8000/en-GB/splunkd/__raw/services/authentication/users/undefined?output_mode=json&_=1596704426231 As you can see used == undefined. After some time this issue goes away and returns back. Temporary solution: Just run Splunk in anonymous mode. Unfortunately, I didn't found a way how to reproduce it but I hope Splunk will fix that in new versions. ... View more

Hi, I have app that already has some translations and I need to add more of them to .po file. From what I understand, by using this script /c/Program\ Files/Splunk/bin/Splunk extract i18n -app appname Splunk should extract new strings that have been created to add them to .po file in folder appname/locale/de_DE/ . My issue is that this command goes successfully over 20 files and then fails with Failed cli cmd extract . Does any of you have idea how to debug this or where I can find logs of that command? ... View more

This issue is related to this https://answers.splunk.com/answers/777557/how-do-you-debug-custom-search-command-error-in-sc.html I have generatereport.py custom search commands that tends to fail on Logger registration. I have checked log files and found in generatereport.py.log that issue is probably in logger registration as Logger setup message runs multiple times and my logger.info() that is on start of def reduce(self, records) is not logged. Unfortunately, this is random. Sometimes I get logger registration message logged a few times and it fails with error (post img) and sometimes I get registration message a few times and then it continues with the script as it should. Example of log is on the bottom of this post. This is how I start logging, taken from answers.splunk.com def setup_logging(n): logger = logging.getLogger(n) if myDebug == 'yes': logger.setLevel(logging.DEBUG) else: logger.setLevel(logging.ERROR) LOGGING_DEFAULT_CONFIG_FILE = os.path.join(SPLUNK_HOME, 'etc', 'log.cfg') LOGGING_LOCAL_CONFIG_FILE = os.path.join(SPLUNK_HOME, 'etc', 'log-local.cfg') LOGGING_STANZA_NAME = 'python' LOGGING_FILE_NAME = '%s.log' % myScript BASE_LOG_PATH = os.path.join('var', 'log', 'splunk') LOGGING_FORMAT = '%(asctime)s %(levelname)-s\t%(module)s:%(lineno)d - %(message)s' splunk_log_handler = logging.handlers.RotatingFileHandler(os.path.join(SPLUNK_HOME, BASE_LOG_PATH, LOGGING_FILE_NAME), mode='a') splunk_log_handler.setFormatter(logging.Formatter(LOGGING_FORMAT)) logger.addHandler(splunk_log_handler) splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME) return logger # start the logger only if needed logger = setup_logging('logger started ...') After that I just use this to log messages. logger.info('message') In this log example I have run exactly Splunk search 3 times in the row and it worked only on third try. Example log: ## First try (NOT WORKING) 2019-10-16 10:35:49,177 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:35:49,178 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:35:49,575 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:35:49,575 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:35:50,088 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:35:50,089 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:35:50,631 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:35:50,632 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:35:51,161 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:35:51,163 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:35:51,755 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:35:51,756 INFO __init__:209 - Setting logger=splunk level=DEBUG ## Second try (NOT WORKING) 2019-10-16 10:50:40,921 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:40,928 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:50:42,482 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:42,484 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:50:44,338 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:44,341 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:50:45,828 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:45,831 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:50:45,846 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:45,848 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:50:46,973 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:46,974 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:50:47,016 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:50:47,019 INFO __init__:209 - Setting logger=splunk level=DEBUG ## Third try (WORKING) 2019-10-16 10:51:19,644 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:19,645 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:20,151 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:20,153 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:20,650 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:20,650 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:21,203 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:21,204 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:21,726 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:21,727 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:22,325 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:22,325 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:22,821 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:22,822 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:23,335 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:23,335 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:24,048 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:24,049 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:24,174 INFO __init__:171 - Using default logging config file: C:\Program Files\Splunk\etc\log.cfg 2019-10-16 10:51:24,174 INFO __init__:209 - Setting logger=splunk level=DEBUG 2019-10-16 10:51:24,178 INFO generatereport:284 - Genearting document ... View more

Hi, How should I approach debugging custom search commands v2 (chunked = true)? I have followed 2017 Splunk Conf slides about custom search commands they are very great but there is no info about debugging. How would you replace print statements in this example? import sys from splunklib.searchcommands import dispatch, ReportingCommand, Configuration @Configuration() class ReportingExampleCommand(ReportingCommand): @Configuration() def map(self, records): # print records return records def reduce(self, records): count = 0 for r in records: # print r count += 1 return [{'count': count}] if __name__ == "__main__": dispatch(ReportingExampleCommand, sys.argv, sys.stdin, sys.stdout, __name__) ... View more