Hi there, Is there anyway on Splunk search peer or Forwarder to filter the data. Like log messages that contain DEBUG or INFO should be filtered before getting indexed in Splunk? ... View more

I have many URI's and a user field available and want to count the times URI has been accessed by user. Like: URI user count /google.com testuser1 1000 /bing.com testuser2 2 /bing.com testuser1 100 ... View more

I want to enable the _internal index but cant from UI. Authorize.conf (etc\search\local) is also attached and has _internal index added in srchIndexesDefault for both Admin and User roles. I have admin role. [role_can_delete] deleteIndexesAllowed = *;main indexes_edit = enabled srchMaxTime = 8640000 [role_power] rtsearch = disabled schedule_rtsearch = disabled srchMaxTime = 8640000 srchTimeWin = 0 [role_user-marttestuser] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 rtSrchJobsQuota = 0 srchDiskQuota = 0 srchIndexesAllowed = * srchIndexesDefault = main srchJobsQuota = 0 srchMaxTime = 0 [role_admin] admin_all_objects = disabled edit_modinput_web_ping = disabled grantableRoles = admin importRoles = can_delete;power;user indexes_edit = disabled schedule_rtsearch = disabled srchIndexesAllowed = *;gb_bed_app_dev;gb_bed_app_qa;gb_bed_iis_dev;gb_bed_iis_prod;gb_bed_iis_qa;main;main_uat;prod_sharepoint_iis;tam;uat_sharepoint_iis srchIndexesDefault = *;_*;aem;aem_test;apac;appserver;aws_bdl_dev;aws_haproxy_dev;aws_haproxy_prd;aws_haproxy_stg;casd_2018;gb_bed_app_dev;gb_bed_app_et2;gb_bed_app_log;gb_bed_app_prod;gb_bed_app_qa;gb_bed_app_uat;gb_bed_ihs_uat;gb_bed_iis_dev;gb_bed_iis_prod;gb_bed_iis_qa;gb_bed_iis_uat;gb_exe_app_et2_uat;haproxy_test;jenkins;jenkins_artifact;jenkins_console;jenkins_statistics;la_fkl_app_dev_ohs;la_fkl_app_prod_ohs;main;main_uat;marsh-aws-dev;marsh_aws_apigee_dev;marsh_aws_apigee_prod;marsh_aws_apigee_stg;marsh_aws_dev;marsh_aws_prd;marsh_aws_stg;marsh_aws_tableau_dev;marsh_onprem_dev_qa;marsh_onprem_dr;marsh_onprem_perf_uat;marsh_onprem_prod;ping;prod_sharepoint_iis;summary;tam;uat_sharepoint_iis;us_dfw_apigee_dev;us_dfw_apigee_prod;us_dfw_apigee_stg;us_dfw_app_prod_access;us_dfw_app_prod_apigee;us_dfw_dbint_prod_postgres;us_dfw_etl_prod;us_dfw_prod_app_csvaudit;us_dfw_prod_webext_ping;us_dfw_prod_webint_ping;us_dfw_springboot_stg;us_dfw_webext_aws_dev;us_dfw_webext_aws_prod;us_dfw_webext_dev_devops;us_dfw_webext_prod_devops;us_dfw_webext_prod_tam;us_dfw_webext_prod_temp;us_dfw_webext_stg_devops;us_dfw_webint_dev_devops;us_dfw_webint_prod;us_dfw_webint_prod_access;us_dfw_webint_prod_devops;us_dfw_webint_prod_haproxy;us_dfw_webint_prod_tam;us_micredit_cloud_web_prod_iis;webserver;wineventlog;_internal srchMaxTime = 8640000 [role_user] admin_all_objects = enabled rtsearch = enabled srchIndexesAllowed = *;gb_bed_app_dev;gb_bed_app_et2;gb_bed_app_log;gb_bed_app_qa;gb_bed_iis_dev;gb_bed_iis_prod;gb_bed_iis_qa;gb_bed_iis_uat;main;prod_sharepoint_iis;tam;uat_sharepoint_iis srchIndexesDefault = *;gb_bed_app_dev;gb_bed_app_et2;gb_bed_app_log;gb_bed_app_qa;gb_bed_iis_dev;gb_bed_iis_prod;gb_bed_iis_qa;gb_bed_iis_uat;main;prod_sharepoint_iis;tam;uat_sharepoint_iis;us_dfw_prod_velocity_log4j;us_dfw_uat_velocity_log4j;us_urb_prod_web_access;_internal srchMaxTime = 8640000 ... View more

I have a CSV file with region , status , hostname as Columns - field extraction works and gives them as region , status and hostname. Instead I want extraction to work like "Region " "Hostname " Status". Is there any setting in source type advance to achieve this? ... View more

So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection - ... weekEnding All weekEnding weekEnding <query>index=db_compliance_audit| top limit=20 weekEnding</query> <earliest>0</earliest> <latest></latest> <panel> <title>Host Summary Dashboard</title> <table> <search> <query>index=db_compliance_audit weekEnding = $weekEnding$ | xyseries hostname compName status</query> <earliest>0</earliest> <latest></latest> </search> <option name="count">10</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="totalsRow">false</option> <format type="color" field="Failed"> <colorPalette type="list">[#DC4E41]</colorPalette> <scale type="threshold"></scale> </format> <format type="color" field="Passed"> <colorPalette type="list">[#53A051,#DC4E41]</colorPalette> <scale type="threshold">100</scale> </format> <format type="number" field="Passed"></format> <format type="number" field="percentage"></format> <format type="color" field="percentage"> <colorPalette type="minMidMax" maxColor="#53A051" minColor="#DC4E41"></colorPalette> <scale type="minMidMax"></scale> </format> <drilldown> <set token="field1">$row.field1$</set> <set token="form.field1">$row.field1$</set> </drilldown> </table>...... ... View more