Hi, I am having trouble with the use of ***SPLUNK*** sourcetype=xxx for batch input with sinkhole option. My inputs.conf looks like this: [batch:///opt/sinkhole] move_policy = sinkhole and, the input file is this: ***SPLUNK*** host="myhost" sourcetype="mytype" source="mydata:myname" 2013/05/03 09:54:47.144780 1234567890123456789 key1=1 2013/05/03 09:54:47.144783 1234567890123456789 key1=0 2013/05/03 09:54:47.345111 1234567890123456789 key1=0 What I am doing is simply move the file above into the sinkhole directory for batch indexing with metadata infomation specified after ***SPLUNK*** . I am refering to the following doc, but still specified meatada infomation is not reflected when indexing. http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Assignmetadatatoeventsdynamically Is there any missing configuration or am I doing something wrong? Any comment would be appreciated. Thank you! ... View more

Hi, I am looking for a add-on or apps that gathers HTML information of a website. e.g. I want to collect HTMLS found under www.somesite.com, and do further text analysis based on the information gathered from the site. Main use case is to find specific description of an product in a partner company site of a company, and see if the description is really up to date or collect. The characters used in sites may contain non-English ones. I know the crawl command that comes with Splunk installation is not for this use case... I would appreciate any comment from anyone who has tried this kind of thing... Thank you, ... View more

Hi, I am having difficulty in escaping string passed by $click.value2$ in advanced XML using drilldown. I am trying to drilldown in a same view using drilldown and ContertToIntention (stringreplare). Using following XML. The clicked value contains space and the likes ":", which need to be escaped. * The value is mainly windows filename and filepath. ... some code ... <module name="SimpleResultsTable"> <param name="drilldown">all</param> <param name="entityName">results</param> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Clicked "$click.value2$"</param> </module> <module name="HiddenSearch"> <param name="search">sourcetype=mytype $file$</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="file"> <param name="value">file="$click.value2$"</param> </param> </param> </param> ... code continues ... I tried to use CDATA around search string and stringreplaced string, but still no luck. Is there any way that can do automatic escaping to $click.values2$"? Any example would be appreciated. Thanks, ... View more

Hi I need a sample view that has a D3 chart (such as Dendrogram and Force-Directed Graph) within a view, probably with JavaScript SDK used in a view. I am not a JapaScript expert, so I would like to start working on this by learning from an basic example. I would really appreciate if anyone can share sample code.. Thanks! ... View more