Dear Splunkers,   I am trying to forward a specific sourcetype (let's call it "mySourcetype") to a third party software with a Heavy Forwarder. The Heavy Forwarder receives the data on a udp port with a splunk input: [udp://xxxxx:514] connection_host = dns sourcetype = mySourcetype _SYSLOG_ROUTING = mySyslogRouting   We added the _SYSLOG_ROUTING line to also send it to the third party software as described in outputs.conf: [syslog:mySyslogRouting] type = udp priority = NO_PRI syslogSourceType = sourcetype::mySourcetype server = yyyyyy:3000   Unfortunately, the destination "yyyyyy:3000" receive all data (not just this sourcetype) from the HF. So that means all the other sourcetype and internal Splunk logs...   We tried to use the props.conf and transforms.conf to route it: props.conf [mySourcetype] TRANSFORMS-changehost = routeSourcetype   transforms.conf [routeSourcetype] DEST_KEY=_SYSLOG_ROUTING REGEX=(.) FORMAT=mySyslogRouting   The result is the same : the destination receive too much data.   Any idea to limit the Syslog forwarding to just one sourcetype?   Thanks   EDIT: I found an old post that seems to be talking about the same issue but with no answers... https://community.splunk.com/t5/Getting-Data-In/Route-syslog-from-heavy-forwarder-to-3rd-party-but-only/m-p/535722 ... View more

Hello,   I was wondering if a new event time-generated 1 month ago but indexed today (with the correct _time, meaning "a month ago") will be accelerated by the Summarization process? Or is there a way to change the earliest time in the Summarization search for the Data Model Acceleration?   Thanks ... View more

Hello, I am coding a custom command and I am using splunklib to interact with Splunk SDK. I am also using the Splunk Platform Upgrade Readiness App that allows me to spot if my code is compatible with Python 3. My issue is that this app tells me that some python files in the splunklib are only compatible with Python 2 runtime. I've updated the Splunklib to the very latest release... You can see the result of the app scaning below: Is this normal ? is there a way to make it compatible with Python 3? ... View more

Hello, Let me give you an example. I've got the following table to work with: src_group dest_group count A B 10 B A 21 A C 32 B Z 6   I'd like to have something like this for result: group src_count dest_count A 42 21 B 27 10 C 0 32 Z 0 6   As you can see, I have now only one colomn with the groups,  and the count are merged by groups while the direction (src or dest) is now on the counts : we sum the count for each group depending of whether the group was the source or the destination in the first table.   Any clue?   Edit: to help me, you can use this search that will generate the first table: | stats count | eval src_group="A", dest_group="B", count=10 | append [| stats count | eval src_group="B", dest_group="A", count=21 ] | append [| stats count | eval src_group="A", dest_group="C", count=32 ] | append [| stats count | eval src_group="B", dest_group="Z", count=6 ] ... View more

Hello, I set up the Deeplearning toolkit and started the Tensorflow CPU container. On the containers dashboards, on the panel listing the containers I've got an error throwed by the indexer: [myIndexer] Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/mltk-container/status?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Does the DeepLearning toolkit needs to be also installed on the indexers? When I try to run the "Neural Network Classifier Example" dashboard, I also get an error, even though the dashboard is returning some results: MLTKC error: /fit: ERROR: unable to load algo code from module. Ended with exception: No module named 'model.binary_nn_classifier' Any help would be much appreciated. ... View more

Hi, I am setting up the Deep Learning Toolkit (https://splunkbase.splunk.com/app/4607/) but the connexion to the docker instance does not work. What I did: - Install docker and add the containers needed - Docker runs as root - Install Splunk + Machine Learning Toolkit (+ python maths librairies) + Deep Learning toolkit - The user running Splunk belongs to the docker group When I fill in the form in the set up page of the app with the information about docker (single-instance type), I get this error: UnixHTTPConnectionPool(host='localhost', port=None): Max retries exceeded with url: /v1.35/_ping (Caused by : [Errno 13] Permission denied) In the internal logs, I also see logs like this: ConnectionError: UnixHTTPConnectionPool(host='localhost', port=None): Max retries exceeded with url: /v1.35/containers/json?size=0&filters=%7B%22label%22%3A+%5B%22mltk_container%22%5D%7D&limit=-1&all=0&trunc_cmd=0 (Caused by : [Errno 13] Permission denied) Can you help me to make this work? ... View more