I just tested this with a couple different changes. If you make changes to the inputs locally on the forwarder and then it will retain the changes on the UF after a reload deploy-server whether or not the changes are made in the local or default directory of that app. The issue will come if you update the app on the deployment server. If you update the app at anytime on the deployment server then the changes on the UF will be wiped out regardless of if they are in the local or default directory. I'd recommend updating the app on the deployment server or creating a new app and server class to include the new stanza for the client you would like to update. ... View more

Here is one way you might be able to do it: | makeresults | eval Issues="Windows account is locked, AD/Windows locked issues, SAP Account is locked. User Australia, My Windows account is locked., Unable to login to SAP, My Oracle account is locked, Reset my windows account password" | fields - _time | makemv delim="," Issues | mvexpand Issues | eval Issues_h=case(like(upper(Issues),upper("%Windows%")), "Windows Account Issue", like(upper(Issues),upper("%SAP%")), "SAP Related Issues", like(upper(Issues),upper("%Oracle%")), "Oracle Related Issues") | stats list(Issues) as "Issues Reported" by Issues_h | rename Issues_h as "Issue Headlines" What you would need is everything from "| mvexpand Issues" on, adjusting for fieldnames, The key component here is the "eval Issues_h" part. What that does is assign an Issue Headline to each issue reported. What it does is case insensitive match on keywords like Windows, SAP, and Oracle. You can add additional headline labels and keyword matching as needed. Another way to do this is using match in the eval instead of like and using regex to find specific patterns in the text. Does this help? Let me know if you have any questions! ... View more

What you will want is a combination of outputs.conf and inputs.conf. The outputs.conf tells the forwarder what server to send the data to and the inputs.conf tells it what data to send and what properties to go with that data. You should have something that looks like this on your universal forwarder: outputs.conf [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = splunk1.patientfirst.com:9997 inputs.conf [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 renderXML = false index = <your index> Unless changed in the configs the port for sending Splunk data from forwarder to indexer should be 9997. For forwarding Windows events this is a good resource to check and you may adjust the settings as desired (maybe you only want specific event codes from WinEventLog:Security?): https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Inputsconf#Windows_Event_Log_Monitor. ... View more

There is a way to have conditional components on dashboards using the "depends" input attribute. A good start would be to look at the "depends" options on this page: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML. When you define the tokens you can set/unset additional tokens based on your input values. it might look something like this: <input (your input settings)> <change> <condition match=($token1$==4 AND $token2$==S)> <set token="query1"></set> <unset token="query2"></unset> </condition> <condition match=($token1$!=4 AND $token2$!=S)> <set token="query2"></set> <unset token="query1"></unset> </condition> </change> </input> You would then use depends for the two searches to either hide or display them. This would be something like: <panel depends="$query1$"> <title>Query 1</title> <search><query>Your Query1</query></search> </panel> <panel depends="$query2$"> <title>Query 2</title> <search><query>Your Query2</query></search> </panel> There may be some slight adjustments in the syntax needed and your panels will need viz options. Hopefully this gets you set on the right direction. Depending on how you set your tokens (might not be an input) there will be some adjustments needed. ... View more