Splunk

Converting Simplified Extended ISO8601 In Splunk

Wonder how to use the ISO8601 format in Splunk? Simplified extended ISO8601 is for example used in Javascript’s toISOString function. It’s a great way (readable and to timezone agnostic) to exchange timestamps between Splunk and Splunk Apps. Here’s how it’s done:

Using Any Html Page As Login Page In Splunk

The configuration options in Splunk to customize the login page are not sufficient? You want to use an arbitrary HTML page? This static login page can be used to customize the login experience for Splunk (Tested with Enterprise 8.2.3): To activate it, you have to copy this file to $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/login.html (it will be served by Splunk Web as a static file) and add the following entry to the settings stanza in the web....

Using username or token authentication in Splunk from Python

For either using username or token authentication in Splunk, I wrote a small wrapper for the connect function. The advantage compared to the existing connect function is that you can use the same line of code for both authentication methods depending on the parameters that you pass (here shown by using ENV variables):

Using URL path parameters in Splunk REST endpoints

If you wonder how to pass an URL path parameter to your custom REST endpoint in Splunk, please have a look:

Enforce arrays for multi-values in Splunk searches

The Splunk SDK for Python is returning for multi-values that only have one entry a string instead of an array. To enforce arrays, you can do the following workaround: