Hi folks, I need to create an alert action in C #, how can I do that? I have an alert_actions.conf that describes a Python alert action, how can I add a new alert action using C #? [send_mail] is_custom = 1 python.version = python3 label =  Send mail icon_path = appIcon.png payload_format = json     Thanks and have a nice day! ... View more

Hi folks, Just a quick question. For example, a have a dataset _time field_x field_y 14:01 0 0 14:02 0 1 14:03 0 2 14:04 1 3 14:05 1 0 14:06 0 0 14:07 1 1 14:08 1 0   If describe this logic in text: field_x is a random number 0 or 1. field_y is how many 0 was in previous events for field_x. ... View more

Hi everyone, Can I read the value of a field from each previous result using a search? Something similar to:   | streamstats current=f last(status) as lastStatus by _time | eval status = if(isnull(lastStatus), 0, lastStatus+1) | table status, lastStatus   I want to get the result: status lastStatus 1 0 2 1 3 2   Is it possible? Thanks ... View more

Hello, I have data with fields kind of "Field Id", "Second Id". And I wanna merge these two fields into one, but when I make EVAL-sourcetype = "Field Id"+"Second Id" as a result I get merge fields name but not value. Also, I used this configuration in props.conf, but without success [.stanza.] FIELDALIAS-extract_fieldId = "Field Id" as FieldID FIELDALIAS-extract_secondId = "Second Id" as SecondID EVAL-sourcetype =FieldID+SecondID ... View more

Hello, I have a little trouble with using REST API in Splunk via curl and postman. I have my own Splunk application with a python script which is available by link http://splunk:8000/en-US/splunkd/__raw/services/appname/pyscript. And I wanna get access to this file via PostMan or Curl. In the first step, I created sessionsKey - successful. But when I want to use this key in the header "Authorization: Splunk <key>" via POST/GET then via curl I see "303 see other", and via postman - "Splunk relies on JavaScript to function properly. Please enable JavaScript and then refresh the page to login."   Where I wrong? ... View more

Hi everyone, I am interested in the question, how can I parse data which sent via POST to the dashboard. I mean, I have two dashboards. From the first dashboard, I send big data using JS to the second dashboard. How to parse this data in the second dashboard.   Thanks for your help! ... View more

Hi everyone,   I have installed Boss of the SOC v3 by manual from GitHub and after all actions, I have the error "404 Not Found" on page ".../en-US/custom/SA-ctf_scoreboard/scoreboard_controller/submit_question?Number=101&Question..." when I tried to send an answer.   What is the root cause of this issue and how to fix it? Thanks ... View more

Hi everyone, I installed Machine Learning Splunk Tools for testing from Splunkbase, and after trying run ml I got error. What can I do to resolve it? Error in 'fit' command: External search command exited unexpectedly with non-zero error code 1. Thanks. ... View more

Hi all, I have little issue with input made via Add-on Builder (Python3). I have been made some inputs and all other inputs work correctly, but only one does not run, and in _internal a have error "Invalid key in stanza [input_http] in /opt/splunk/etc/apps/application-for-splunk/default/inputs.conf, line 68: python.version (value: python3)." I use Add-on builder version 3.0.1 and Splunk Enterprise 7.3.1.1. How I can fix it? Thanks. ... View more