it worked perfectly. Thanks a lot sir! ... View more

I'm glad it helped you! Happy Splunking! ... View more

I found the root cause of this already. The file that was being monitored was just too big for the default bandwidth limit of the forwarder. I modified the maxKbps in limits.conf to adjust it and accommodate the volume. I hope this helps someone someday. Kindest regards, Jef ... View more

Thank you very much Kristian. It worked like a charm! Also, thank you for fixing the formatting of my post. I'm still not used to the proper formatting style 😄 Thanks again! ... View more

There are various ways to specify a destination with the tag. Here is the syntax for specifying a destination in a variety of scenarios: Use a relative path to connect to a dashboard. Use a relative path to connect to a form, passing in a token to populate the form. Pass in the earliest and latest time range from the original search. (Requires use of CDATA, as indicated in the following sections.) Use a URL and query argument to pass a value to the destination page 1) path/viewname 2) path/viewname?form.token=$dest_value$ 3) path/viewname?form.token=$dest_value$&earliest=$earliest$&latest=$latest$ 4) URL?q=$dest_value$ ... View more

Hi, here what I did for 6.1 version: first copy your my_logo.png in this folder: /opt/splunk/share/splunk/search_mrsparkle/exposed/img/skins/default then create (if it doesn't exist) web.conf under: etc/system/local with this stanza: [settings] updateCheckerBaseURL = 0 login_content = basically you can put any html syntax here. hope it works for all you, Skender K. ... View more