The toolkit can do more based on application manifest file. See this for more information. https://dev.splunk.com/enterprise/docs/releaseapps/packageapps/packagingtoolkit/#About-partitioning-apps ... View more

@ezmo1982 , Above search should give you first half or your requirement (filtering fields values whose count>5). For 2nd requirement (saving to a new field), please provide more information on what you intend to do with these values.  ... View more

What's the seach you tried? ... View more

Give this a try   | makeresults | eval url="http://abc.com/test/emp?name=jim&no=101 http://abc.com/test/car/ford http://abc.com/test/car/tesla" | table url | makemv url | mvexpand url | eval url=replace(url,"\?","/") | rename "COMMENT" as "Above code generates sample data. Replace it with your query" |rex field=url "(?P<requestedUrl>(?P<path>https*:\/\/((?P<contextRoot>[^\/\s]+)\/)?([^\/\s\?;=]+\/)*)((?P<filename>[^\/\s\?;=]+))?|\-)" | stats count by path ... View more

When Splunk monitors a file, it creates a CrC checkpoint value with first few characters of the file. THis checkpoint is used to uniquely identify the file to avoid duplicate ingestion. If you want to ingest the whole file everything something changes, either the first few characters of the file should changes (so that CRC checkpoint is changed) OR you add file name to the CRC (which you're doing here using `CrcSalt =<SOURCE>`), and make sure that file name changes everything an update is made.   So you got two options, 1. Change the file name every time an update is made (and keep the current setting in inputs.conf). 2. Instead of file monitoring, you can setup scripted inputs and create a simple script which simply reads your CSV and outputs its content on console. Scripted input will send that to Splunk. Only drawback is that, the scripted input would run on a schedule and with every run it'll re-ingest the file content. So, this option is helpful if you update the file at a particular interval. ... View more

Try to run btool on your forwarder to see what type of monitoring config is active.   $Splunk_home/bin/splunk btool inputs list --debug ... View more

How is the file generated? Do you have control over name of file being written? ... View more

See if this format is useful for you   | eval vulnGrouping=case(plugin_name like "Adobe%", "Adobe", plugin_name like "Google%", "Google Chrome", plugin_name like "Oracle%", "Oracle Software", plugin_name like "Cisco%", "Cisco Software") | chart dc(ipv4) by vulnGrouping priority ... View more

Try something like this (changed how token was formatted in your multiselect, replaced join with lookup command and used token in correct place).   <?xml version="1.0" encoding="UTF-8"?> <form> <fieldset> <input type="multiselect" token="Teams" searchWhenChanged="true"> <label>Teams</label> <choice value="*">All</choice> <choice value="Force">Force</choice> <choice value="Blaz">BLAZ</choice> <choice value="OneForce">Oneforce</choice> <choice value="Auto">Auto</choice> <fieldForLabel>Teams</fieldForLabel> <prefix>(</prefix> <valuePrefix> parent_chain="*</valuePrefix> <valueSuffix>*"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>*</initialValue> <default>*</default> </input> </fieldset> <row> <table> <search> <query>index=abc sourcetype=xyz source="/user.log" process-groups|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup chains.csv id OUTPUT parent_chain | where $Teams$</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </row> </form>   ... View more