Splunk Documentation

https://help.splunk.com/en/
Admin
Splunk Documentation is a comprehensive guide covering Splunk Enterprise, Cloud Platform, Enterprise...
Tokens:4,311,884
Snippets:65,817
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Installation profile examples

Source: https://help.splunk.com/en/appdynamics-on-premises/virtual-appliance-self-hosted/26.1.0/install-virtual-appliance-on-your-own-kubernetes-cluster/install-services-charts-in-your-kubernetes-cluster

Examples of running the installation script with different profile configurations.

```bash
# Install with medium profile
./install.sh medium

# Install with Extra Large profile
./install.sh xlarge
```

--------------------------------

### Retrieve Content Pack Metadata

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0/itsi-rest-api-reference/itsi-rest-api-reference

Example JSON response structure for a content pack query, showing fields like entitlement status, installation state, and dependencies.

```json
{ "id": "da-itsi-cp-microsoft-exchange-msexchange-store-driver", "title": "MSExchange_Store_Driver", "description": "The store driver is a software component of the Hub Transport Server that delivers inbound messages to Microsoft Exchange stores, the databases that contain public folder stores and mailbox stores. " }
```

--------------------------------

### Retrieve Content Pack Key

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis

Example response for the content pack interface.

```json
{
   "_key":"794f8938-9780-4d1b-bf65-572f17312500"
}
```

--------------------------------

### Retrieve Content Pack Key

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0/itsi-rest-api-reference

Example response for a content pack version request.

```json
{ "_key":"794f8938-9780-4d1b-bf65-572f17312500" }
```

```json
{
   "_key":"794f8938-9780-4d1b-bf65-572f17312500"
}
```

--------------------------------

### Retrieve Content Pack Metadata

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis

Example JSON response structure for the itoa_interface/content_pack endpoint, detailing installed status and dependencies.

```json
The store driver also retrieves messages from a user's outbox, and submits them for delivery.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-store-interface", "title": "MSExchange_Store_Interface", "description": "Monitors the interface between the Exchange Information Store service on the Mailbox Server and the Hub Transport servers.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-availability", "title": "MSExchange_Transport_Availability", "description": "", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-database", "title": "MSExchange_Transport_Database", "description": "Monitors the activity of the MS Exchange Transport Database.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-disk", "title": "MSExchange_Transport_Disk", "description": "Monitors Logical and Physical disk latency.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-dumpster", "title": "MSExchange_Transport_Dumpster", "description": "Transport dumpster helps protect against data loss by maintaining a queue of successfully delivered messages that hadn't replicated to the passive mailbox database copies in the database availability group (DAG).", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-handling", "title": "MSExchange_Transport_Handling", "description": "Pertaining to add-ons in the hub transport intercepting mail delivery", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-performance", "title": "MSExchange_Transport_Performance", "description": "", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport-queues", "title": "MSExchange_Transport_Queues", "description": "Provides details about the Exchange Server Transport Queues", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange-transport", "title": "MSExchange_Transport", "description": "The Transport service handles all SMTP mail flow for the organization, performs message categorization, and performs message content inspection", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchange", "title": "MSExchange", "description": "", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchangeis-client-type", "title": "MSExchangeIS_Client_Type", "description": "Provides MS Exchange IS Client Type statistics.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchangeis-client", "title": "MSExchangeIS_Client", "description": "Provides MS Exchange IS Client statistics.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchangeis-mailbox", "title": "MSExchangeIS_Mailbox", "description": "Provides details about the MSExchangeIS Mailbox Store", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchangeis-public", "title": "MSExchangeIS_Public", "description": "Represents the MS Exchange IS Public activity.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true }, { "id": "da-itsi-cp-microsoft-exchange-msexchangeis", "title": "MSExchangeIS", "description": "Manages the mailbox databases on the server.", "entitlement_status": true, "installed": false, "duplicate_title": false, "has_dependency": true } ], "saved_searches": { "has_saved_searches": true, "has_consistent_status": true }
```

--------------------------------

### Retrieve Content Pack Configuration

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0

Example JSON response structure for an ITSI content pack configuration.

```json
{ "start_time": 1661985419, "cron_schedule": "", "recurrence": false, "object_type": "custom_threshold_windows", "status": "stopped", "next_scheduled_time": "", "end_time": 1662071819, "sec_grp_list": [ "default_itsi_security_group" ], "last_stopped_time": 1661989152, "mod_source": "unknown", "title": "nonrecurring2", "description": "", "duration": 24, "linked_services": [ { "linked_kpi_ids": [ "cd8bc6bc8ffc1c1eabc0adc0" ], "service_id": "e3871bfe-dd65-466c-b873-24ab5ea654ab" } ], "mod_timestamp": "2022-08-31T23:39:12.971953+00:00", "_version": "4.15.0", "identifying_name": "nonrecurring2", "pause_description": "", "window_type": "percentage", "window_config_percentage": 10, "window_config_static": {}, "is_overlapping": false, "overlapping_kpis": [], "_user": "nobody", "_key": "92101b7a-816d-445d-8fa2-f0618704af74", "can_view": true, "can_link": false, "can_edit": false, "can_transition": false, }
```

```json
{
    "start_time": 1661985419,
    "cron_schedule": "",
    "recurrence": false,
    "object_type": "custom_threshold_windows",
    "status": "stopped",
    "next_scheduled_time": "",
    "end_time": 1662071819,
    "sec_grp_list": [
        "default_itsi_security_group"
    ],
    "last_stopped_time": 1661989152,
    "mod_source": "unknown",
    "title": "nonrecurring2",
    "description": "",
    "duration": 24,
    "linked_services": [
        {
            "linked_kpi_ids": [
                "cd8bc6bc8ffc1c1eabc0adc0"
            ],
            "service_id": "e3871bfe-dd65-466c-b873-24ab5ea654ab"
        }
    ],
    "mod_timestamp": "2022-08-31T23:39:12.971953+00:00",
    "_version": "4.15.0",
    "identifying_name": "nonrecurring2",
    "pause_description": "",
    "window_type": "percentage",
    "window_config_percentage": 10,
    "window_config_static": {},
    "is_overlapping": false,
    "overlapping_kpis": [],
    "_user": "nobody",
    "_key": "92101b7a-816d-445d-8fa2-f0618704af74",
    "can_view": true,
    "can_link": false,
    "can_edit": false,
    "can_transition": false,
}
```

--------------------------------

### Retrieve Content Pack Information via GET

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis

Example of a JSON response structure returned by the ITSI REST API when querying content packs.

```json
{ "items": { "success": [ { "author": "", "description": "Content Pack for AWS Dashboards and Reports gives you critical operational insight into your Amazon Web Services accounts.", "icon": "app/DA-ITSI-CP-aws-dashboards/icon.png", "id": "DA-ITSI-CP-aws-dashboards", "help_links": [], "title": "AWS Dashboards and Reports", "version": "1.3.2", "installed_versions": [], "screenshots": [ { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/insight_overview.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/insight_overview_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/usage_overview.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/usage_overview_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/billing_cur_overview.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/billing_cur_overview_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/ebs_insights.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/ebs_insights_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/elb_insights.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/elb_insights_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_entities.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_entities_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_infra_overview.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_infra_overview_thumbnail.png" }, { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/entity_type_infra_overview.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/entity_type_infra_overview_thumbnail.png" } ], "main_screenshot": { "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/overview.png", "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/overview_thumbnail.png" }, "saved_searches": { "total": 45, "enabled": 45, "disabled": 0 }, "entitlement_status": true } ], "failure": [ { "title": "Monitoring Citrix", "error_code": 404, "error_message": "FileNotFound Error! manifest.json or rule.json absent", "action_detail": "Check the itsi_content_packs_retrieve.log for more details" } ] } }
```

```json
{
    "items": {
        "success": [
            {
                "author": "",
                "description": "Content Pack for AWS Dashboards and Reports gives you critical operational insight into your Amazon Web Services accounts.",
                "icon": "app/DA-ITSI-CP-aws-dashboards/icon.png",
                "id": "DA-ITSI-CP-aws-dashboards",
                "help_links": [],
                "title": "AWS Dashboards and Reports",
                "version": "1.3.2",
                "installed_versions": [],
                "screenshots": [
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/insight_overview.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/insight_overview_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/usage_overview.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/usage_overview_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/billing_cur_overview.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/billing_cur_overview_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/ebs_insights.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/ebs_insights_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/elb_insights.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/elb_insights_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_entities.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_entities_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_infra_overview.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/ec2_instance_infra_overview_thumbnail.png"
                    },
                    {
                        "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/entity_type_infra_overview.png",
                        "thumb": "app/DA-ITSI-CP-aws-dashboards/screenshots/entity_type_infra_overview_thumbnail.png"
                    }
                ],
                "main_screenshot": {
                    "path": "app/DA-ITSI-CP-aws-dashboards/screenshots/overview.png",

```

--------------------------------

### JSON Response for Update

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0

Example of the JSON response returned after updating a job.

```json
{ "_key":"<object identifier>" }
```

```json
{
   "_key":"<object identifier>"
}
```

--------------------------------

### GET /servicesNS/nobody/SA-ITOA/itoa_interface/custom_threshold_windows/linked_kpis

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis

Retrieves a list of KPIs linked to a specific Custom threshold window.

```APIDOC
## GET /servicesNS/nobody/SA-ITOA/itoa_interface/custom_threshold_windows/linked_kpis

### Description
Displays a list of KPIs linked to a specific Custom threshold window.

### Method
GET

### Endpoint
/servicesNS/nobody/SA-ITOA/itoa_interface/custom_threshold_windows/linked_kpis

### Parameters
#### Query Parameters
- **custom_threshold_window_id** (String) - Required - The Custom threshold window ID.
- **limit** (Integer) - Optional - The maximum number of entries to return. 0 will return all results.

### Response
#### Success Response (200)
- **linked_kpis** (Array) - A dictionary of objects containing kpi_key, kpi_title, service_title, and service_key.
- **count** (Integer) - The number of KPIs in the response.

### Response Example
{
   "linked_kpis":[
      {
         "kpi_key":"632fa0c67da8e736f747490d",
         "kpi_title":"0 - test service KPI 1",
         "service_title":"0 - test service",
         "service_key":"342de3d8-0008-4ac5-8929-645d295093a0"
      }
   ],
   "count":1
}
```

--------------------------------

### GET itoa_interface/content_pack/<name>/<version>

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0/itsi-rest-api-reference/itsi-rest-api-reference

Retrieves the configuration and threshold specifications for a specific content pack version.

```APIDOC
## GET itoa_interface/content_pack/<name>/<version>

### Description
Retrieves the KPI entity threshold configuration for a specified content pack version.

### Endpoint
itoa_interface/content_pack/<name>/<version>

### Parameters
#### Path Parameters
- **name** (string) - Required - The name of the content pack.
- **version** (string) - Required - The version of the content pack.

### Response
#### Success Response (200)
- **_key** (string) - Unique identifier for the threshold configuration.
- **object_type** (string) - The type of object, typically 'kpi_entity_threshold'.
- **entity_title** (string) - The title of the entity.
- **kpi_id** (string) - The unique identifier for the KPI.
- **service_id** (string) - The unique identifier for the associated service.
- **time_variate_thresholds_specification** (object) - The specification for time-variate threshold policies.
```

--------------------------------

### GET itoa_interface/kpi_entity_threshold

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0/itsi-rest-api-reference

Retrieves a list of configurations for KPI entity thresholds.

```APIDOC
## GET itoa_interface/kpi_entity_threshold

### Description
Get a list of configurations for entity thresholds.

### Method
GET

### Endpoint
/servicesNS/nobody/SA-ITOA/itoa_interface/kpi_entity_threshold

### Parameters
#### Query Parameters
- **sort_key** (string) - Optional - Key to sort results by
- **sort_dir** (string) - Optional - Direction to sort results
- **skip/offset** (integer) - Optional - Number of records to skip
- **limit** (integer) - Optional - Maximum number of records to return
- **fields** (string) - Optional - Comma separated list of fields to return
- **filter/filter_data** (JSON) - Optional - Filter criteria

### Request Example
curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/kpi_entity_threshold

### Response
#### Success Response (200)
- **List** (array) - List of KPIs configured with entity thresholds.
```

--------------------------------

### GET /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_entity_threshold

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis

Retrieves a list of configurations for entity thresholds in ITSI.

```APIDOC
## GET /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_entity_threshold

### Description
Get a list of configurations for entity thresholds.

### Method
GET

### Endpoint
/servicesNS/nobody/SA-ITOA/itoa_interface/kpi_entity_threshold

### Parameters
#### Query Parameters
- **sort_key** (string) - Optional - Key to sort results by
- **sort_dir** (string) - Optional - Direction to sort results
- **skip** (integer) - Optional - Number of records to skip
- **limit** (integer) - Optional - Maximum number of records to return
- **fields** (string) - Optional - Comma separated list of fields to return
- **filter** (string) - Optional - Filter criteria

### Request Example
curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/kpi_entity_threshold

### Response
#### Success Response (200)
- **List** (array) - List of KPIs configured with entity thresholds.
```

--------------------------------

### Example JSON Response for Single Export

Source: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/5.0/itsi-rest-api-reference

A sample JSON array containing the status of a single export object.

```json
[ { "mod_time": 1712666063.169315, "export_filename": "test1_2024-04-09_18:03:17.csv", "created_time": 1712665997.6362543, "status": "COMPLETED", "_owner": "admin", "object_type": "event_management_export", "_user": "nobody", "_key": "6615358d609b9126de51167c" } ]
```

```json
[
    {
        "mod_time": 1712666063.169315,
        "export_filename": "test1_2024-04-09_18:03:17.csv",
        "created_time": 1712665997.6362543,
        "status": "COMPLETED",
        "_owner": "admin",
        "object_type": "event_management_export",
        "_user": "nobody",
        "_key": "6615358d609b9126de51167c"
    }
]
```

--------------------------------

### Example: Start Transaction with Scaled Speed Evaluation

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/transactiontypes.conf

This example uses 'startswith' with an eval expression to start a transaction when 'speed_field' is less than one-twelfth of 'max_speed_field'.

```ini
startswith=eval(speed_field < max_speed_field/12)
```

--------------------------------

### Define a setup.xml configuration block

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.2-configuration-file-reference/setup.xml.conf

This example demonstrates how to structure a setup.xml file with blocks, text descriptions, and various input types for configuring app settings.

```xml
<setup>
  <block title="Basic stuff" endpoint="saved/searches/" entity="foobar">
    <text> some description here </text>

    <input field="is_scheduled">
      <label>Enable Schedule for $name$</label>   <!-- this will be rendered as "Enable Schedule for foobar" -->
      <type>bool</type>
    </input>

    <input field="cron_scheduled">
      <label>Cron Schedule</label>
      <type>text</type>
    </input>
    <input field="actions">
      <label>Select Active Actions</label>
      <type>list</type>
    </input>

    <!-- bulk update  -->
    <input entity="*" field="is_scheduled" mode="bulk">
      <label>Enable Schedule For All</label>
      <type>bool</type>
    </input>
  </block>
```

--------------------------------

### Basic setup.xml.conf Structure

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.1-configuration-file-reference/setup.xml.conf

This example demonstrates the basic structure of a setup.xml.conf file, including a block with text and input elements for configuring a saved search.

```xml
<setup>
  <block title="Basic stuff" endpoint="saved/searches/" entity="foobar">
    <text> some description here </text>

    <input field="is_scheduled">
      <label>Enable Schedule for $name$</label>   <!-- this will be rendered as "Enable Schedule for foobar" -->
      <type>bool</type>
    </input>

    <input field="cron_scheduled">
      <label>Cron Schedule</label>
      <type>text</type>
    </input>
    <input field="actions">
      <label>Select Active Actions</label>
      <type>list</type>
    </input>

    <!-- bulk update  -->
    <input entity="*" field="is_scheduled" mode="bulk">
      <label>Enable Schedule For All</label>
      <type>bool</type>
    </input>
  </block>


```

--------------------------------

### Events Service Installation Failure Example

Source: https://help.splunk.com/en/appdynamics-on-premises/events-service-deployment/events-service-deployment/prepare-the-events-service-host

An example error message indicating that the Events Service installation command failed due to a blocked port on the host.

```text
failed on host: <ip_address> with message: Uri [http://localhost:9080/_ping] is un-pingable.
```

--------------------------------

### GET Request for ITSI Entities

Source: https://help.splunk.com/en?resourceId=ITSI_RESTAPI_ITSIRESTAPIreference

Example of a GET request to retrieve entities filtered by title using regex.

```bash
curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/?fields=title,_key&'filter='{"title":{"$regex":".*mysql"}}'
```

--------------------------------

### Sample Installation Output

Source: https://help.splunk.com/en/appdynamics-on-premises/virtual-appliance-self-hosted/26.1.0/install-splunk-appdynamics-services-using-cli/standard-deployment

This is a sample output showing the installed services, their charts, versions, and durations.

```text
NAME               CHART                     VERSION   DURATION
cert-manager-ext   charts/cert-manager-ext   0.0.1           0s
ingress-nginx      charts/ingress-nginx      4.8.3           1s
redis-ext          charts/redis-ext          0.0.1           1s
ingress            charts/ingress            0.0.1           2s
cluster            charts/cluster            0.0.1           2s
reflector          charts/reflector          7.1.216         2s
monitoring-ext     charts/monitoring-ext     0.0.1           2s
minio-ext          charts/minio-ext          0.0.1           2s
eum                charts/eum                0.0.1           2s
fluent-bit         charts/fluent-bit         0.39.0          2s
postgres           charts/postgres           0.0.1           2s
mysql              charts/mysql              0.0.1           3s
redis              charts/redis              18.1.6          3s
controller         charts/controller         0.0.1           3s
events             charts/events             0.0.1           4s
cluster-agent      charts/cluster-agent      1.16.37         4s
kafka              charts/kafka              0.0.1           6s
minio              charts/minio              5.0.14         47s
```

--------------------------------

### Define setup.xml blocks

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.2-configuration-file-reference/setup.xml.conf

Examples of defining configuration blocks for search, event types, account information, and Windows log collection.

```xml
<!-- iterative update in this block -->
  <block title="Configure search" endpoint="saved/eventtypes/" entity="*" mode="iter">
    <input field="search">
      <label>$name$ search</label>
      <type>string</type>
    </input>
    <input field="disabled">
      <label>disable $name$</label>
      <type>bool</type>
    </input>
  </block>

  <block title="Create a new eventtype" endpoint="saved/eventtypes/" entity="_new">
    <input target="name">
      <label>Name</label>
      <type>text</type>
    </input>
    <input target="search">
      <label>Search</label>
      <type>text</type>
    </input>
  </block>

  <block title="Add Account Info" endpoint="storage/passwords" entity="_new">
    <input field="name">
      <label>Username</label>
      <type>text</type>
    </input>
    <input field="password">
      <label>Password</label>
      <type>password</type>
    </input>
  </block>

  <!--  example config for "Windows setup" -->
  <block title="Collect local event logs" endpoint="admin/win-eventlogs/" eai_search="" >
    <text>
      Splunk for Windows needs at least your local event logs to demonstrate how to search them.
      You can always add more event logs after the initial setup in Splunk Manager.
    </text>

    <input entity="System" field="enabled" old_style_disable="true">
      <label>Enable $name$</label>
      <type>bool</type>
    </input>
    <input entity="Security" field="enabled"  old_style_disable="true">
      <label>Enable $name$</label>
      <type>bool</type>
    </input>
    <input entity="Application" field="enabled"  old_style_disable="true">
      <label>Enable $name$</label>
      <type>bool</type>
    </input>
  </block>

  <block title="Monitor Windows update logs" endpoint="data/inputs/monitor">
    <text>
      If you monitor the Windows update flat-file log, Splunk for Windows can show your patch history.
      You can also monitor other logs if you have them, such as IIS or DHCP logs, from Data Inputs in Splunk Manager
    </text>
    <input entity="%24WINDIR%5CWindowsUpdate.log" field="enabled">
      <label>Enable $name$</label>
      <type>bool</type>
    </input>
  </block>
</setup>
```

--------------------------------

### Example Tenant Identifiers for Splunk Cloud Connect

Source: https://help.splunk.com/en/db/organizations/splunk/repositories/es8-8_5/content/documents/Security/ES_8/ES_RN/NewFeatures?resourceId=c31a7d1d2-80f5-4cf7-a06d-2164e73b76ad

These examples show valid formats for preferred tenant identifiers. They must start with lowercase alphanumeric characters, optionally followed by hyphen-separated segments of 3-63 characters, and segments cannot start or end with a hyphen.

```text
mytenant
```

```text
my-tenant
```

```text
t-name-123
```

--------------------------------

### Sample Boot Status Output

Source: https://help.splunk.com/en/appdynamics-on-premises/virtual-appliance-self-hosted/26.1.0/administer-your-virtual-appliance/hybrid-deployment

Example output showing successful service initialization status.

```text
NAME             | STATUS    | ERROR
------------------+-----------+-------
 enable-time-sync | Succeeded | --
 firewall-setup   | Succeeded | --
 hostname         | Succeeded | --
 microk8s-setup   | Succeeded | --
 ssh-setup        | Succeeded | --
 storage-setup    | Succeeded | --
 cert-setup       | Succeeded | --
```

--------------------------------

### Example: Start Transaction with Specific Username

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/transactiontypes.conf

This example shows how to use 'startswith' with a condition to begin a transaction only when the 'username' field is 'foobar'.

```ini
startswith=(username=foobar)
```
Tokens:
Raw