Hello, I want to monitor rolling logfiles with extension x.log0 to x.log9. The problem is, that I only can monitor the files when I monitor the parent directory of the log files. If I try to set the stanza like this: [monitor://tmp/logs/x.log*] nothing happens! How can I monitor every single file from x.log0 to x.log9 without using the parent directory? Thanks ... View more

Hello, I'm looking for a possibility to delete all eventdata of one index at a specific time on every day! It is not important to use the "splunk clean eventdata -index" command. It can also be just an "search index = any |delete". Whats the best method to get this working? Greetings ... View more

Hello, I'm looking for a possibility to use one token $token2$ as part of the value of another token. For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this: <input type="dropdown" token="token1" searchWhenChanged="false"> <label> any </label> <choice> value="field = $token2$">Test</choice> </input> If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros?? Thanks for help Greetings ... View more

Hello, I have the problem, that space characters are not saved in the simple xml structure of my dashboards. This is a part of one of my dashboards: <input type="multiselect" token="group" searchWhenChanged="true"> <label>group by...</label> <choice value="ChangeDay">Day</choice> <prefix>by </prefix> <delimiter> </delimiter> </input> You can see that I have a space character at delimiter and one after by. That one at deleimiter is saved correctly, but that after by is deleted after a reload. How can I save all space characters permanently? Greetings ... View more

Hello, I'm looking for a possibility to create a statistic like this one: directupload.net/file/d/3630/jzf8nu84_png.htm Is that possible with the splunk search language? Greetings ... View more

Hello, is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready: sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] This gives me all events where field Number1 and field Number2 are equal and not equal. How can I get just these events now, where they are not equal? Thanks for help. C_Sparn ... View more