Modify the "all_data_dashboard" object within the app and remove the module information. I've highlighted the lines with > to remove the information. <view template="dashboard.html" onunloadCancelJobs="True"> <label>Indexed Data</label> <module name="AccountBar" layoutPanel="navigationHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="navigationHeader"> <param name="showActionsMenu">True</param> </module> <module name="SearchBar" layoutPanel="mainSearchControls"> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <module name="TimeRangePicker"> <param name="selected">Last 24 hours</param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> > **<module name="StaticContentSample" > layoutPanel="panel_row2_col1" > group="All indexed data" > autoRun="True"> > <param name="text">This lists all of the data you have loaded into > your default indexes over all > time.</param> > <module name="GenericHeader" layoutPanel="panel_row2_col1_grp1"> > <param name="label">Sources</param> > <module name="HiddenSearch"> > <param name="search">| metadata type=sources | sort > -totalCount</param> > <module name="Paginator"> > <param name="count">20</param> > <param name="entityName">results</param> > <param name="maxPages">10</param> > <module name="LinkList"> > <param name="initialSortDir">desc</param> > <param name="labelFieldSearch">*</param> > <param name="valueField">totalCount</param> > <param name="labelField">source</param> > <param name="labelFieldTarget">flashtimeline</param> > <param name="initialSort">totalCount</param> > </module> > </module> > </module> > <module name="GenericHeader" layoutPanel="panel_row2_col1_grp2"> > <param name="label">Sourcetypes</param> > <module name="HiddenSearch"> > <param name="search">| metadata type=sourcetypes | sort 300 > -totalCount</param> > <module name="Paginator"> > <param name="count">20</param> > <param name="entityName">results</param> > <param name="maxPages">10</param> > <module name="LinkList"> > <param name="initialSortDir">desc</param> > <param name="labelFieldSearch">*</param> > <param name="valueField">totalCount</param> > <param name="labelField">sourcetype</param> > <param name="labelFieldTarget">flashtimeline</param> > <param name="initialSort">totalCount</param> > </module> > </module> > </module> > </module> > <module name="GenericHeader" layoutPanel="panel_row2_col1_grp3"> > <param name="label">Hosts</param> > <module name="HiddenSearch"> > <param name="search">| metadata type=hosts | sort 300 > -totalCount</param> > <module name="Paginator"> > <param name="count">20</param> > <param name="entityName">results</param> > <param name="maxPages">10</param> > <module name="LinkList"> > <param name="initialSortDir">desc</param> > <param name="labelFieldSearch">*</param> > <param name="valueField">totalCount</param> > <param name="labelField">host</param> > <param name="labelFieldTarget">flashtimeline</param> > <param name="initialSort">totalCount</param> > </module> > </module> > </module> > </module> > </module> > </module>** </view> ... View more

Yea, that seemed to do it ... Thank You. I can't recall why it was added ... Management Console (Master) -> Settings (on the green bar not the top black bar) -> General Setup 1) Edit Actions on the Master 2) Edit Server Roles 2) remove indexer role ... View more

I didn't realize my question was already asked ... sorry about that. A recent issue I had concerning getting the data in ... I had to remove my * and pull in the whole directory. My [monitor:///Logs/isam/reports/access.log*] became [monitor:///Logs/isam/reports/access.log/] and that worked for me.. It had to monitor the whole directory instead of the wildcard on the log name. I also kept running into a problem with the whitelist parameter so I dropped that. I worked with $SPLUNK_HOME/bin/splunk list monitor to show me which files/directories are being monitored (ran on my UF)... This highlighted a regex issue I had with escaping a character incorrectly in another stanza. Good Luck. ... View more

I didn't realize my question was already asked ... sorry about that. A recent issue I had concerning getting the data in ... I had to remove my * and pull in the whole directory. My [monitor:///Logs/isam/reports/access.log*] became [monitor:///Logs/isam/reports/access.log/] and that worked for me.. It had to monitor the whole directory instead of the wildcard on the log name. I also kept running into a problem with the whitelist parameter so I dropped that. I worked with $SPLUNK_HOME/bin/splunk list monitor to show me which files/directories are being monitored (ran on my UF)... This highlighted a regex issue I had with escaping a character incorrectly in another stanza. Good Luck. ... View more

It looks like a pretty standard inputs.conf stanza.... How about the CRTLog.log* in your monitor line ... [monitor:///apps/Logs/*/www/Reporting/CRTLog.log*] ... Have you tried without the * at the end and just have [monitor:///apps/Logs/*/www/Reporting/CRTLog.log] otherwise I like the blacklist idea from woodcock or maybe have the log-roll name changed? ... View more

Good question.. I just happen to be reading up on the ML-Toolkit and was in this section concerning Algorithms in the kit. ML-Toolkit Algorithms .. There is also some more info in the Assistants category on the left side of the page that may provide additional assistance to you while you wait for a real answer. ... View more

I exported a .csv using a specific name and searched for the name. I found the results using index=_internal filename=* . I'm on Splunk 6.5.2 ... View more

Types of Splunk Deployments Index Clustering - Tons of info/links that branch into more info all over this page Things I wish I knew then - This has some useful all around info Decide on FIPS before starting the upgrade/migration The toughest part for me was when I upgraded to an indexer cluster, I wasn't able to bring over the indexed data from the stand alone. There is a complex option of renaming bucket GUIDs to match the new GUIDs structure but I didn't go that route. I was able to search the standalone from the new SH but once I turned off the old Splunk I lost the data. Oh and create a deployment plan filling in all of your decision points and formula/values/IPs/IndexNames/Forwarders/etc, pass4symkey and other items .. this was invaluable. Good Luck! ... View more

Thank you for your advice. I totally forgot about the add data_input tool to develop/view sourcetype ... ... View more

This is resolved. I had to add the ending / This works: [monitor:///logs/sam/ct/sact0*/*/web/] ... View more

I corrected the whitelist = request.logs*$ to whitelist = request.log*$ to match the naming convention. Still no luck ... View more

Thank you for the suggestion. This is works and I don't need a restart but I am still having the other issues to troubleshoot... Almost there! 🙂 ... View more

The table is visible in both the APP view and GLOBAL view but only after I manually add the 'filename=' entry into the transforms.conf and do a .. http://<splunk_url>:8000/debug/refresh . Is this a bug or do I need to change a setting in another .conf to enable or make active? ... View more

I'm currently having this issue. I am seeing metrics logs coming in when searching "index=_internal" on my cluster. But I do not see the data coming in.... At one time it did work and it seems things sometimes work? I am currently trying to troubleshoot .... Windows Universal Forwarder 6.4.3 (port 9997-> intermediate forwarder 6.4.3 -> Index Cluster Any other information to help isolate this issue? Thank You ... View more