Hello, I have a rather confusing issue I've been attempting to solve (with no luck) for quite some time. I'm attempting to create a dashboard which has several indexes. An example panel that has been added is the CPU Load in % by host. This works fine on its own, however, some indexes may have well over 20-30 hosts which unfortunately does not look acceptable if the image were to be extracted for use. Is it possible to dynamically add charts/panels, i.e. if an index has 50 hosts then create 10 charts, each containing 5 hosts for the same CPU Load search? Is it also possible to hide a panel/chart entirely if there's no data? (I read about a 'depends' option for chart however I'm not sure how I could integrate that for no data found). Thanks in advance! ... View more

Hello experts, I am using DB Connect to pull in data from a MySQL database table. The tail works and the field i set to be the timestamp works as expected. the issue comes from other fields that are set to MySQL DATETIME field type. When these are imported Splunk they are turning up in this format "updated_at=1375083603.000" apposed to "2013-03-07 00:06:00" in the database (DATETIME) field type. I am at a loss of what is going on here, I added in the datetime formatting for the output section of the DB connect but think that only works for the timestamp which works ok. below is a copy on an event with private data removed, as you can see the scheduled and updated_at fields are DATETIME within MySQL... 2013-07-29T08:35:02.000 id=5260 item=xxxxxxx status=finished metadata=xxxxxxxxx schedule_type=scheduled scheduled=1375086900.000 no_reboot=true deleted_on= deleted_status= updated_at=1375083603.000 number=xxxx name=xxxxxx label=xxxxxx Where would I be going wrong, any tips or guidance would be muchly received. Cheers ... View more

Hello, I have a file being monitored like this: where xxxxxxxxxx is the filename and index name [monitor:///splunk_formatted/xxxxxxxxxx] followTail = 1 sourcetype=billing_data index=xxxxxxxxxx Initially the file does not exist, however, when it is created the first event is skipped, all following events are caught as normal. Is this normal behaviour? and if so is there away to capture that first event? Thanks ... View more