Hello, I have a file exampleFile that has two different timestamp/event formats: ~02 07 10:19:24 OIT-FO-OFR2 NSSTRAP and Feb 05 18:58:43 ANSU-OPS-2 checkpn: OK:ABM3CANDAF34018 As both timestamps do not contain the year, splunk does not manage to correctly index the events. I therefore override both sourcetypes on a per-event basis. In props.conf: [source::.../exampleFile] TRANSFORMS-event_1 = event_1 TRANSFORMS-event_2 = event_2 [FORMAT_1] NO_BINARY_CHECK = 1 TIME_FORMAT =%b %d %H:%M:%S [FORMAT_2] NO_BINARY_CHECK = 1 TIME_PREFIX =^\~ TIME_FORMAT =%m %d %H:%M:%S In transforms.conf: [event_1] REGEX = \w{3}\s\d{2}\s\d{2}\:\d{2}\:\d{2}\s.+ FORMAT = sourcetype::FORMAT_1 DEST_KEY = MetaData:Sourcetype [event_2] REGEX = \~\d{2}\s\d{2}\s\d{2}\:\d{2}\:\d{2}\s.+ FORMAT = sourcetype::FORMAT_2 DEST_KEY = MetaData:Sourcetype This works, the sourcetype is correctly assigned to each type, but the indexed timestamps stay wrong. Any ideas on how I can correctly assign the TIME_FORMAT to the per-event overrided sourcetype? PS: When I upload a file only containing one event format, and when I assign this file directly to a sourcetype FORMAT_1 or FORMAT_2, the TIME_FORMAT definition works correctly ... View more

Hi All, I would like to merge the selected values from 2 checkboxes both working on the same research field (myField) . Checkboxes test1 returns: ( myField="staticValue1" OR myField="staticValue2" OR myField="staticValue3" ) when all boxes are selected and Checkboxes test2 returns ( myField="staticValue4" OR myField="staticValue5" OR myField="staticValue6" ) when all boxes are selected. I finally merge the two strings in my search by doing: <param name="search">index="index_test" ($test1$ OR $test2$) </param> This works fine as long as at least one box is checked in each checkboxes. Is there a way to handle this situation by avoiding an incomplete statement like ( OR $test2$) ? I would like to avoid the use of only one checkboxes for all my choices as I have to group them by theme. Thank you for your help <!-- Checkboxes 1 --> <module name="Checkboxes" group="static config 1"> <param name="name">test1</param> <param name="staticCheckboxes"> <list> <param name="label">firstStaticLabel</param> <param name="value">staticValue1</param> </list> <list> <param name="label">secondStaticLabel</param> <param name="value">staticValue2</param> </list> <list> <param name="label">thirdStaticLabel</param> <param name="value">staticValue3</param> </list> </param> <param name="separator">+OR+</param> <param name="template">myField="$value$"</param> <param name="outerTemplate">( $value$ )</param> <!-- Checkboxes 2 --> <module name="Checkboxes" group="static config 2"> <param name="name">test2</param> <param name="staticCheckboxes"> <list> <param name="label">StaticLabel4</param> <param name="value">staticValue4/param> </list> <list> <param name="label">StaticLabel5</param> <param name="value">staticValue5</param> </list> <list> <param name="label">StaticLabel6</param> <param name="value">staticValue6</param> </list> </param> <param name="separator">+OR+</param> <param name="template">myField="$value$"</param> <param name="outerTemplate">( $value$ )</param> <module name="Search"> <param name="search">index="index_test" ($test1$ OR $test2$) </param> </module> </module> </module> ... View more

Hi All, I have one sideview checkboxes module containing about 50 entries. Is there a way to display them in several columns instead of having one big list? A different solution would be the creation of several checkboxes modules but in that case I don't know how to merge the result strings of all the modules separated by an OR. Any ideas? Thank you, Hanno <module name="Checkboxes" group="Events" layoutPanel="panel_row2_col1"> <param name="name">event</param> <param name="separator">+OR+</param> <param name="template">eventtype="$value$"</param> <param name="outerTemplate">( $value$ )</param> <param name="staticCheckboxes"> <list> <param name="label">Boot Seq Light</param> <param name="value">NCU STOP</param> </list> <list> <param name="label">Boot Seq Full</param> <param name="value">P</param> </list> <list> <param name="label">Boot Seq Medium</param> <param name="value">e</param> </list> <list> .... </param> ... View more