Hello everybody, I have finally gotten to the point where Splunk Light is doing nearly everything that I want. My issue now is allowing % labels with my other labels on my pie charts in my dashboard. I know there is a way to edit the "Simple XML" in order to do this in Splunk Enterprise. My issue is that all of the documentation referring to how to do it is in regards to the enterprise version and not Splunk Light. Is there a way to edit the simple XML in Splunk Light? If so, where would the XML file be located in order to do this? ... View more

Hello Splunk Community, I have finally reached a place where I know what I want to do and believe I know the right avenue to do so, yet I am still having trouble getting the pieces to work. I have changed the inputs.conf and the indexes.conf in the local directory ($Splunk\etc\system\local) so that there is a monitor on a few local directories and the frozenTimePeriodInSecs is 1 week. My goal is to bring in files to the directories with a scheduled task once per week and then Freeze the data so the index is completely wiped every week minus an hour (essentially having only the newest data for 1 week periods and then removing it completely so new data takes its place). My issue is that when testing, the freeze works, but the monitoring seems to stop working after the first freeze. Is there a reason the monitored files are not being received? Also, does the Freeze require a splunkd restart each time or will it work as I hope? Any and all feedback on the Freeze information and monitoring information would be a great help. Thanks! ... View more

Hey Splunk Community, I am having some confusion about the [batch] input. I have read the documentation and thought I understood. What I have noticed is that the files dropped into the directory that the [batch://Path] points to are getting removed, but the sources and data are still in the Splunk index. I was thinking that the source of the data would be removed when the file was deleted by batch. Can someone explain what the move_policy sinkhole is actually doing and what it means to add data "destructively"? I am ideally looking to upload data to the directory, have it index that file, and then remove the data and source from the index (at a certain point after a report is generated or a new file is added to the directory.) I see that the file is removed locally, but the data and source still show up in Splunk, even though the file itself is gone. How can I get rid of the old data? Thanks! ... View more

Hey Splunk Community, One of my biggest challenges now is trying to figure out how to get old stuff out and focus on the new data coming in. I am wondering if there is a way to use the ( | delete) command or something on a schedule to delete/purge a file from a monitored directory once a new file is added. I have begun playing around with the dedup command to focus on the relevant data, but I think I will run into problems in the future if I can't remove old data from my index (because of changing unique identifiers and using too much storage space in the splunk cluster). Example: Day 1 I upload a file with 10,000 events into a monitored directory. Day 2, I pull from the data source and the relevant data is now 9,500 events because 1,000 machines were removed and 500 new ones were added (9,000 is the same, 500 are completely new, 1,000 are no longer relevant). How can I delete the file from day 1 from my host and only look at the events captured on day 2, etc? Is it possible to run a scheduled task to remove old data sources and only focus on the most recent? ( I also don't want to host/index to show 19,500 events, just the 9,500 from day 2). Is it possible to do this in Splunk Light? Any thoughts on this issue would be greatly appreciated! Thanks ... View more

Hello Splunk Community, I am having difficulty monitoring a local directory on my machine. The files are not getting updated. Instead, new files are being added to the directory. Is it possible set up a schedule that indexes all files in a directory? All files are .csv's and are formatted the same way (I.e. same columns in each file). I'd like for Splunk to "monitor" the directory for new files and immediately index them as a certain type under a certain host. Can this be done? Thanks ... View more

Hello, I am a new user to Splunk Light and I am having trouble with the visualization of event data. I have a .CSV sourcetype that does not have relevant time data, but has fields relating to total number of machines within certain security policies. I would like to find out the total sum of all machines found with my search and output the results in a pie chart. Is there a way to accumulate that information into a report for my dashboard? ... View more