About davidoff96

davidoff96 · ‎03-21-2023

I tried to do this, as did another person I spoke to privately on here, and we have determined it is not possible: https://community.splunk.com/t5/Dashboards-Visualizations/400-Error-while-rendering-splunk-into-an-iframe/m-p/568621 Essentially the cookies are "3rd party cookies" as they are not from your site. I believe there is actually a setting in your browser you can change to allow these. This worked for me a while ago. I am not sure if it works currently as I do not have Splunk in an iframe anymore. When I told my manager this, they immediately dropped the ask and stopped the idea of the iframe.

davidoff96 · ‎01-19-2023

One other thing to note is you may need to change your "MAX_TIMESTAMP_LOOKAHEAD" in the props.conf since the default is 128. Wouldnt explain why it works in default vs local, but something to consider.

davidoff96 · ‎01-19-2023

If I understand this correctly, this is for this add-on: https://splunkbase.splunk.com/app/3757 Which sourcetype are you seeing _time issues with? Each sourcetype has a different method of getting _time (some use "createdDateTime", others use CURRENT).

davidoff96 · ‎10-26-2022

Extremely late to the party, but I was also having this same issue. Figured I'd answer here in case anyone else was wondering. I was thinking of trying to get the input name and appending it to the checkpoint. This, of course, cannot be found in the documentation of the AOB from what I've seen. Here's what I've ended up doing. If you call "helper.get_input_stanza()", it will give you a dictionary of a single dictionary. The key for that dictionary is your inputs name. So you could just do a "list(helper.get_input_stanza().keys())[0]". That dictionary looks like this: HOWEVER! This does not look the same in the AOB. You should still be able to use that .keys()[0] in the code, but the output will look different. So I guess be forewarned if you want to try to access name/disabled in your code. Hopefully this helps, and I will be using this in my custom add-ons now as well too. I now use this function: def get_input_name(helper): return list(helper.get_input_stanza().keys())[0] Another thing to note that is if you change your input's name, it will lose that checkpoint value. So there may be duplication there.

davidoff96 · ‎10-06-2022

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.

davidoff96 · ‎10-06-2022

This is through the add-on builder. When I send the metric through to a normal index, it looks like this: And my code for generating it looks like this: data = { 'metric_name:tests_performed:testing': 4 } event = helper.new_event(source=helper.get_input_type(), index='test-metrics', sourcetype=helper.get_sourcetype(), data=json.dumps(data)) ew.write_event(event) Where index test-metrics is an index I have set up with the metrics type

davidoff96 · ‎10-05-2022

Hello, I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is defined as an input in the add-on configuration. However, when I try to send events to the metrics, I don't get anything showing up there. I have tried the following: Prepending "metric_name:" to the field name for the metric Making a new add-on to only send data to metrics (very simple create an event and send it) In that same add-on, create the event, and send it to the index defined in the config, and defined my metrics index in that config None of these worked. Is there a special way to send these to metrics indexes?

davidoff96 · ‎06-02-2022

As an update, I found the solution. What you need to do is increment the version number in the add-on properties. So if you make it 1.0.0, and then later on you add a new input, you need to update it to 1.0.x or whatever. Once that is done, the app will show the new input. I only found this by changing it on a whim, since I couldn't find anything about this in the docs.

davidoff96 · ‎05-27-2022

Hello. I am making an app in the add-on builder with multiple inputs. So naturally, once I am done and have saved the add-on, I end up with something like this: However, when I make any updates to the app (adding a new input/ deleting an existing input) this drop down refuses to update. Is there another file I need to make a change to within the app? I looked in the UI/Nav folders but nothing stood out to me.

davidoff96 · ‎09-30-2021

I am also currently having this issue. Has anyone found some sort of work around?

davidoff96 · ‎09-30-2021

Okay, so I now realize it isn't only an issue with splunk. If signing into the iFrame from splunk on chrome, it fails, and it also displays that "No Cookie Support Detected". However, if I do it from firefox, the issue no longer shows up. I believe this is due to how the browsers render these iframes? Is there anyway to resolve this in chrome?

davidoff96 · ‎09-28-2021

Hey efav, so my company doesn't want a dashboard being embeded, they want the entire application. By that I mean they want to be able to access search and reporting from the iframe, the settings for a user, etc. So that wouldn't work since it's only for 1 dashboard. I made a topic previously trying to ask if I could change the style of some "_Layout"-esque file, but the consensus seemed to be no.

davidoff96 · ‎09-27-2021

Hello. I am trying to show our splunk instance inside another one of our application's webpages, so it can have our styling applied to splunk. (basically putting our company sidebar on the left, then with the rest of the page rendering our splunk application). Initially had the problem that it wouldn't load because of the same-origin header, so I was able to resolve that. However, now when I try to login through that iframe, I get a 400 error. The only information returned by that error is "{"status":2}". It also says server error under the login. Any ideas what this error might be, and why it may be happening?

davidoff96 · ‎09-13-2021

Thats a great idea Jhan. I needed it to be site/application wide though. Is there an xml file I can edit to change the layout on every page? Sort of like a _Layout.cshtml in asp.net?

davidoff96 · ‎09-10-2021

Hey Ismo, Thanks for the reply. I believe my company is actually currently doing that, so the navbar at the top looks correct. Its just that we want a sidebar on the left. Or is there some js file I can edit that will run on page load, where I can modify the html? I could add it through that if needed (though I'd rather not write the html in the javascript)

davidoff96 · ‎09-09-2021

Hello, My company has a sidebar that is consistent throughout all our other internal applications, and we were trying to get that same sidebar on our Splunk instance as well. We wanted to add a custom sidebar, with links to other pages from there (sort of looks like the bootstrap 5 sidebar https://getbootstrap.com/docs/5.0/examples/sidebars/), within all the apps (home/search/etc). Is there anyway this can be done? When I looked elsewhere for tips on styling the UI, most of them were for styling the dashboards themselves. Is there also a way to include a custom javascript file within that UI as well? I am new to splunk, so maybe I am not looking in the right areas.

Posts	16
Solutions	2
Karma Given	6
Karma Received	5
Member Since	‎09-09-2021

Online Status	Offline
Date Last Visited	3 weeks ago

Add-on Builder and Metric Indexes- Why aren't even...

Why is Add-on Builder "New Input" not updating?

400 Error while rendering splunk into an iframe

Adding Custom Sidebar to Splunk UI

Re: Embedded Splunk Iframes

Re: Splunk TA for Microsoft Office 365 can't parse...

Re: TA-MS-AAD data indexing delays- How is how_tim...

Re: How to avoid duplication of events for multipl...

Re: Add-on Builder and Metric Indexes- Why aren't ...

Re: Add-on Builder and Metric Indexes

Add-on Builder and Metric Indexes- Why aren't even...

Re: Add-on Builder "New Input" not updating

Why is Add-on Builder "New Input" not updating?

Re: SameSite cookie

Re: 400 Error while rendering splunk into an ifram...

Re: 400 Error while rendering splunk into an ifram...

400 Error while rendering splunk into an iframe

Re: Adding Custom Sidebar to Splunk UI

Re: Adding Custom Sidebar to Splunk UI

Adding Custom Sidebar to Splunk UI