Dashboards show zero log Volume in the Jfrog App for Splunk. Looking at the query in Search pane, they contain "log_source" field which is consistently blank. What field should be used and when will the JFrog app for Splunk be updated?
If this is the wrong place to ask question, please direct me to proper source. Thanks!
We're expecting the JFrog App for Splunk to show logs, we've installed it and aren't getting the metrics displayed that are otherwise available.
Related
I want to trigger an alert when there are no logs coming from our services in Splunk but not sure how to do that.
I can search our logs using this [| inputlookup app | search app=app_name env=prod service=app_name] where app is the csv lookup table with app, env, and service properties that provide lookup values for our search.
One other thing to note is I have access to the sourcetype or the source where
sourcetype=kube:container:app_name_env
source=*k8s_app_name_env_*
But again, not sure what search query I should create the alert based on. I know how to create alerts in splunk but not sure how to trigger it if there are no logs coming from the source above. Any suggestions? Thanks!
In the Alert actions, have it send a message when there are no results:
I am trying to preview the data coming from a SQL DB that is set as a reference input for my Azure stream analytics job.
I am getting this error:
We cannot locate the resource for the selected input. Please make sure its subscription has been selected in the global subscription filter.
I have looked online but can't seem to find how to resolve it.
I also have data coming from an event hub and that is working, error occurs only when previewing DB data.
We cannot locate the resource for the selected input. Please make sure
its subscription has been selected in the global subscription filter.
I can't reproduce your issue on my side.But based on above issue,i think you have multiple subscriptions. You could try to make sure the subscription (which your sql db resides in) has been selected in the global subscription filter.
Step is navigating to Subscription Management Page in the portal and check whether the subscription is selected with global subscription filter.It not,select it in the right box.
Add a reference for you :https://www.kunal-chowdhury.com/2018/06/azure-global-subscription-filter.html
I've run into a few different issues with the PagerDuty integration in Splunk Cloud.
The documentation on PagerDuty's site is either outdated, not applicable to Splunk Cloud or else there's something wrong with the way my Splunk Cloud account is configured (could be a permissions issue): https://www.pagerduty.com/docs/guides/splunk-integration-guide/. I don't see an Alert Actions page in Splunk Cloud, I have a Searches, Reports and Alerts page though.
I've configured PD alerts in Splunk using the alert_logevent app but it's not clear if I should instead be using some other app. These alerts do fire when there are search hits but I'm seeing another issue (below). The alert_webhook app type seems like it might be appropriate but I was unable to get it to work correctly. I cannot create an alert type using the pagerduty_incident app. . . although I can set it as a Trigger Action (I guess this is how it's supposed to work, I don't find the UI to intuitive here).
When my alerts fire and create incidents in PagerDuty, I do not see a way to set the PagerDuty incident severity.
Also, the PD incidents include a link back to Splunk, which I believe should open the query with the search hits which generated the alert. However, the link brings me to a page with a Page Not Found! error. It contains a link to "more information about my request" which brings up a Splunk query with no hits. This query looks like "index=_internal, host=SOME_HOST_ON_SPLUNK_CLOUD, source=*web_service.log, log_level=ERROR, requestid=A_REQUEST_ID". It it not clear to me if this is a config issue, bug in Splunk Cloud or possibly even a permissions issue for my account.
Any help is appreciated.
I'm also a Splunk Cloud + PagerDuty customer and ran into the same issue. The PagerDuty App for Splunk seems to create all incidents as Critical but you can set different severities with event rules.
One way to do this is dynamically is to rename your Splunk alerts with the desired severity level and then create a PagerDuty event rule for each level that looks for the keyword in the Summary. For example...
If the following condition is met:
Summary contains "TEST"
Then perform the following actions:
Set severity = Info
screenshot of the example in the event rule edit screen
It's a bit of pain to rename your existing alerts in Splunk but it works.
If your severity levels in Splunk are programmatically set like in Enterprise Security, then another method would be to modify the PagerDuty App for Splunk to send the $alert.severity$ custom alert action token as a custom detail in the webhook payload and use that as event rule condition instead of Summary... but that seems harder.
I work with a company who outsources their website. I'm trying to retrieve data from the site without having to contact those who run it directly. The table data I'm trying to retrieve can be found here:
http://pointstreak.com/prostats/scoringleaders.html?leagueid=49&seasonid=5967
My methodology thus far has been to use google chrome's Developer Tools to find the source page, but when I filter under the network tab for XHL, only the info of the current games can be found. Is there anyway to scrape this data (I have no idea how to do that; any resources or direction would be appreciated) or another way to get it? Am I missing it in the developer tools?
If I had to contact those who run the website, what exactly should I ask for? I'm trying to get JSON data that I can easily turn into my own UITableViewController.
Thank you.
Just load the page source and parse the html.
Depending on your usage there may well be a copyright issue, the page has an explicit copyright notice so you will need to obtain explicit permission for your use.
I need to get a list of users for a specific Push adapter/event source, and, I'm trying to use the API console requests, which says the format is:
http://{hostname}:{port}/{context-root}/console/api/{api-context}/{action}/{parameters}
and I'm using:
http://192.168.1.106:10080/Module_07_04_nativeAPIForiOSPush/console/api/Push/get/PushAdapter/PushEventSource
to search the demo project, which has one subscriber. However, I get 404 return from a browser request.
The first column of the docs is the "api-context", but, it lists "Push" and "Event Sources", which, obviously seems invalid.
What is the correct format to find users subscribed to a push for a specific adapter/event source?
WL server does not provide API for listing subscribed users. By design you should maintain your own DB of subscribed users, this is why you have onSubscribe onUnsubscribe callbacks in event source. As an alternative - you can look into WL's DB tables to find this info.