If it's manageable, have one directory for each host, and use host_segment in inputs.conf to assign hostnames. If the hostname is anywhere in the file path, you can use host_regex in inputs.conf. If the hostname appears in each event, you can use a transform to assign the host. This is per-event. Take a look at these doc entries also: http://www.splunk.com/base/Documentation/4.1.5/Admin/Setadefaulthostforaninput http://www.splunk.com/base/Documentation/4.1.5/admin/Overridedefaulthostassignments ... View more

This is very similar to: http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention/6634#6634 You just need to define a regex that will capture that value, and apply a transform to incoming events for that source or host. Something like: # transforms.conf [override-sourcetype] SOURCE_KEY = source DEST_KEY = MetaData:Sourcetype REGEX = transactionType=\"([^\"]+)\" FORMAT = sourcetype::$1 # props.conf [source::/var/log/inputdir/*] TRANSFORMS-sourcetype = override-sourcetype For more information, take a look at: http://www.splunk.com/base/Documentation/latest/Data/Advancedsourcetypeoverrides ... View more

This really should be two separate transforms. Take a look at this thread: http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention/6634#6634 ... View more

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation. If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard: <module name="HiddenSearch"> <param name="earliest">-24h</param> <param name="search">host=XXX termXXX</param> <!-- Child modules go here --> </module> If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu. If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this: <module name="StaticSelect" layoutPanel="splSearchControls-inline"> <param name="settingToCreate">timerange_setting</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Last 60 Minutes</param> <param name="value">earliest=-1h</param> </list> <list> <param name="label">Last 24 Hours</param> <param name="value">earliest=-24h</param> </list> <list> <param name="label">Last 7 Days</param> <param name="value">earliest=-7d</param> </list> </param> <param name="label">Time Range:</param> <module name="ConvertToIntention"> <param name="settingToConvert">timerange_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="timeFilter"> <param name="value">$target$</param> </param> </param> </param> <param name="preserveParentIntentions">true</param> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search">$timeRange$ host=XXX termXXX</param> <!-- Child modules go here --> </module> ... View more

Please see gkanapathy's comment and answer regarding updates since Splunk version 4.3 JSON (JavaScript Object Notation) is a structured data format - there's an example here: http://www.json.org/example.html Splunk will be able to index the full JSON message without any difficulty, since it's just ascii text. Getting full meaning out of it may take some work. If you just need text or the occasional specific field, then you can do this with simple expressions and the rex command. For more complete support there are a few options, including: Have Splunk read the JSON input via a scripted input, and have the script flatten the JSON data to a better supported form (tabular, CSV, XML, ...) Create a search command to flatten JSON to XML, and then pipe the result to xmlkv Create your own JSONkv command to function similarly to xmlkv . Python already supports JSON, so it should not be outrageously difficulty. You may also be able to get ideas from how the XML is handled in $SPLUNK_HOME/etc/apps/search/bin/xmlkv.py ... View more