Hi praneethkodali, this must be set in the XML of the dashboard, take this run everywhere example: <dashboard> <label>pie percent</label> <row> <panel> <chart> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>-1d@d</earliest> <latest>now</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="charting.chart.showPercent">true</option> </chart> </panel> </row> </dashboard> As you can see I did use it as last option name= for the graph. Hope this helps ... cheers, MuS ... View more

Hi agoktas, there are multiple ways of achieve this: Blacklist the file in your inputs.conf http://docs.splunk.com/Documentation/Splunk/6.3.1511/admin/Inputsconf#inputs.conf.example see option blacklist = Filter out the un-wanted events on a heavy weight forwarder or indexer http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues Monitor not the directory, but each log file separate in inputs.conf Update: Following up all comments, this was the final working config: Here is the final config that looks to be working great (we forgot '00' for the midnight hour): Indexer configuration: props.conf [AppInternal] TRANSFORMS-null= Appsetnull transforms.conf #Discard all events between 6pm - 6am [Appsetnull] REGEX = (?:d+/d+/d+|d+-d+-d+)s(18|19|20|21|22|23|00|01|02|03|04|05): DEST_KEY = queue FORMAT = nullQueue Hope this helps ... cheers, MuS ... View more

Your inputs.conf sets the sourcetype to syslog but in your props.conf you're using [syslog_audit_log_change_index_transform] . This should be [syslog] instead and remember to restart Splunk after the change. ... View more

Hi ralph_SAIC, this is not a Splunk problem, this is based on the so called privileged ports . The TCP/IP port numbers below 1024 are special in that normal users are not allowed to run servers on them. This is a security feature of your OS, in that if you connect to a service on one of these ports you can be fairly sure that you have the real thing, and not a fake which some hacker has put up for you. If you want to use the port 550 with Splunk, create a new Splunk tcp input on port 1550 and use a iptables rule to route input for port 550 to the Splunk port 1550: /usr/sbin/iptables -t nat -A PREROUTING -m tcp -p tcp --dport 550 -j REDIRECT --to-ports 1550 Your Sysadmin can do this for you. Hope this helps ... cheers, MuS ... View more