Hello, we have a large multi monitor screen at the front of the floor plate, We have our splunk dashboards showing however we have different dashboards that periodically need to be shown. Is there a way to automatically go through each of these URLs or dashboards to view each individual dhasboard instead of doing it manually. Many thanks ... View more

Hello,  I have a search that returns the status "UP" / "DOWN" for various groups.  At the moment both UP and down are the same colour.  how do i return the; status=up green status=down red Edit ** Code index=test host=ABC source=table.csv sourcetype=csv Group=Snow* | eval Group=if(Group="Snow Day Here we come 12345","Snow",Group) | eval Status=if(Status="Down (Acknowledged)", "Down", Status) | dedup _raw | stats count by Status This gives me Status                     Count Down                      12 Up                            45 I would like those in a bar chart one column as red one as green ... View more

Hello going through documentation on how to deploy a multi site index cluster.  The documentation on the course though suggests completing the installation in this order License Master Cluster Master Indexer Indexer Indexer Search Head Link them all together to a single site cluster.  It then suggests to complete a multi site cluster with the following commands ./splunk edit cluster-config -mode manager -multisite true -site site1 -available_sites site1,site2 -site_replication_factor origin:1,total:2 -site_search_factor origin:1,total:2 -replication_factor 1 -search_factor 1 -secret idxcluster ./splunk edit cluster-config -site site1 ./splunk restart ./splunk edit cluster-config -site site1 ./splunk restart etc Anyway, my question is, is there a short cut to configuring a multi site cluster without having to configure a single site cluster first and then moving to a multi site cluster? And if there is, what is the commands?  Many thanks  ... View more

hello,  i am monitoring windows event logs and ingesting them to my indexers, the issue is that even with a unique EventRecordID i am seeing multiple events in Splunk, sometimes up to 28.  second to that, when i complete the two searches in the picture i can see that the same event is being indexed multiple times (14) between 13:33:31 and 13:36:00 any help on how to rectify this issue is greatly appreciated.  please see attached the two searches showing multiple indexed results and also multiple indexed times.  ... View more

Hello,  Are there searches or any log files that will tell me what is being forwarded from my heavy forwarder?  I have a multi site, clustered splunk environment that ingests all its own personal logs first but then sends all of the data to a third party via a heavy forwarder and data diode. I do not have access to the data once they have been sent from the HF so i cannot assess what has been sent.  Are there any splunk techniques, searches, log files i can view from my heavy forwarder to determine what data have been sent to the data diode?  I can provide config files if required.  ... View more