Neither of these work either. This isn't making any sense whatsoever. There is a row in my lookup that has a value for DeviceId as "ABC" I can write the splunk query as Properties.DeviceName=ABC, and it returns a row as expected. When I add [| lookup SPCClientMaster DeviceId as Properties.DeviceName] I get nothing. Even though I can write the query |inputlookup SPCClientMaster .csv |search DeviceId=ABC, and it returns a row. ... View more

This doesn't work as you get the following error Error in 'search' command: Unable to parse the search: Comparator 'IN' is missing a term on the right hand side. ... View more

I figured this out, added the earliest variable and used return at the beginning of the base search. [| gentimes start=-1 | addinfo | eval earliest=info_min_time | eval latest=info_max_time-300 | return earliest latest] ... View more

For some reason I can not get this to work. I simply want the entire dashboard to offset the latest time by 5 minutes. If I try the suggestion above in a query window with my base search for some reason it alters the earliest time to months ago. Not sure whats going on can't I just do this? basesearch [| gentimes start=-1 | addinfo | eval latest=info_max_time-300 | table latest] |join....... ... View more

Can you please provide screen shots of your identity and connection set up? obviously mung the values. ... View more

Thanks, I was making it more complicated in my head. ... View more

Ill add the info I came across that describes this behavior Since splunk 6, some sources can be parsed for structured data (like headers, or json) and be populated at the forwarder level. see http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Extractfieldsfromfileheadersatindextime#Forwa... Those setting have to be on the forwarders (and indexers if they monitor files) Caveats Splunk Enterprise does not parse structured data that has been forwarded to an indexer When you forward structured data to an indexer, Splunk Enterprise does not parse this data once it arrives at the indexer, even if you have configured props.conf on that indexer with INDEXED_EXTRACTIONS. Forwarded data skips the following queues on the indexer, which precludes any parsing of that data on the indexer: parsing aggregation typing The forwarded data must arrive at the indexer already parsed. To achieve this, you must also set up props.conf on the forwarder that sends the data. This includes configuration of INDEXED_EXTRACTIONS and any other parsing, filtering, anonymizing, and routing rules. Universal forwarders are capable of performing these tasks solely for structured data. See "Forward data extracted from header files" earlier in this topic. http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Extractfieldsfromfileheadersatindextime http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F ... View more

I am doing this, however I ended up using a Python script to get the data on a 5 minute cadence via their API. The pain in the ass part is the props and transforms needed to make sense of the XML fields within the payload being sent back. With the custom fields user-10, etc. I aliased those in the props to their real labels. It has been working well so far, but I am also investigating other options. ... View more

Yes, I changed the py scripts to stub out that requirement, however the log file is completely blank as well after trying to configure any settings. ... View more

I am still unable to get this to connect, and I am not seeing where there are any logs to show what failed? It simply goes to the next screen with no configured instances listed. I have no issues connecting to this instance outside of Splunk. ... View more

I am unable to get the values for my fields using this example. While I am able to successfully return only the fields I want, when editing to return the values, I just get Failed to parse templatized search for field *** ... View more

Upvoted, thanks again. Yes they are fixed, Ill post new question and see what the community can come up with for me other question. ... View more

Yes, thank you, it finally started working, however it was odd. Even after restart and cache flush repeatedly, it eventually started displaying correctly. The scripts all made sense, it was just getting the updates. Thanks a ton, good work, I wish this would come pre-packaged. I did have a question though, I didn't have the time to dig into it, I know its possible, but how much work would it be to utilize the "built in" "auto range" cell coloring to apply to rows. Basically doing the same thing, but not redefining the values to evaluate. Just have rows auto color based on like values of a specified field. ... View more

This no longer seems to work in Splunk 7.1, even duplicating this solution verbatim, all rows are colored the background color, meaning the evaluations are seemingly not evaluating to true anymore. ... View more