I have a scenario where I have a table panel I would like to hide the last column of that table but still be able to pass value in that column to a drilldown. I am trying this in splunk 6 HTML dashboards. I tried using jquery and hide..but nothing seems to work greatly appreciated if someone could help ... View more

In my dashboard, it loads data into a table with 4 columns Now what i require is to drill down to Dashboard1 if any cell is clicked in column1. If any cell is clicked in column2 i want to drill down to Dashboard2. No Drill down should happen if any cell clicked in Column 3 and 4. Is there way i can achieve this?? ... View more

I have data in los as specified in below sample. FILEHEADER|^2013-12-18 15:22:07|^v4|^RECORDS @FIELDS|^FIELD1|^FIELD2|^FIELD3|^FIELD4|^FIELD5 VALUE1.1|^VALUE1.2|^VALUE1.3|^VALUE1.4|^VALUE1.5 VALUE2.1|^VALUE2.2|^VALUE2.3|^VALUE2.4|^VALUE2.5 VALUE3.1|^VALUE3.2|^VALUE3.3|^VALUE3.4|^VALUE3.5 VALUE4.1|^VALUE4.2|^VALUE4.3|^VALUE4.4|^VALUE4.5 As mentioned in http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime I tried to extarat field values directly from header. I used the below configuration in props.conf: CHECK_FOR_HEADER = true FIELD_DELIMITER = \|\^ INDEXED_EXTRACTIONS = PSV PREAMBLE_REGEX = FILEHEADER.* FIELD_HEADER_REGEX = @FIELDS\|\^ SHOULD_LINEMERGE = false But doesn't seem to work, can anyone help please?? ... View more

Hi, I have a scenario where i was getting a lot of INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying... errors in splunkd.logs of Universal Forwarders. After reading documentation http://docs.splunk.com/Documentation/Splunk/6.0.2/Troubleshooting/Troubleshootingeventsindexingdelay I increased the thruput in Universal Forwarders and the those "Could not send data to output queue" increased instead of decreasing. Intially i had 2MBps as thruput and i increased that to 5MBps. So someone can help if increased thruput increased load on Indexer and queues got blocked and hence i have increased "Could not send data to output queue" messages. If i increase thruput in Universal Forwarders, do i need to increase queue sizes(splunktcpin,typing,parsing,etc) in Indexers??? Hi Ayn, Image In above image is plot of count events by time for 3files, In that you can see a sudden dip to 0 events. The events were actaully present in files, but for some reason the not indexed in splunk. AT same duration i had lot of "Could not send data to output queue" messages and also the instataneous KBps during that timeperiod was like 3MBps and the differnce of indextime to timestamp duration also was elevated. So thought increasing thruput would solve that issue, but no luck. ... View more