Hello, Thank you for the replies to my post. By "system" I mean a virtual machine running Linux with each server running an application that monitory network switch and router status.  I have a universal forwarder running on System B. I thought I could use the Splunk hec to send device status to Splunk, and check the system B log data on the indexer for a match, primarily the "down" state.  Both virtual machines have the same application running, and monitor the same devices. Here is the base issue, these vms are in different locations and on different networks. If a switch show as "down" on system A, it does not mean the switch is really down, but sometimes the network path to the device is interrupted, so the idea is to check the same device from the other location over a different network path. If both systems indicate a "down" condition, then the device may reall be down. I can put a forwarder on system A, and it might be better to compare that way. Sorry for long-winded reply. eholz1 ... View more

To all that responded to my post, "Thank you So Much" It has been a while since I have looked into using Dashboard Studio (like 3+ years!) and the solutions posted here are excellent and very helpful to me.   Thanks Again, eholz1 - a little smarter now! ... View more

Hello PickleRick,   I now know what you mean, the demo link using "| makeresults" fails. Lucky for me the html I use seems OK, and I do get the display of the table and the data iin the html code/file, thanks for the TIP.  @eholz1 ... View more

Hello There  Ultra Champ,   Thanks for quick response. I will take a look at the process. Thanks again, @eholz1 ... View more

Hello deepakc,   Thank you very much for this information. This forum is great. Kudos to you for helping me understanding the "internals" of Splunk,   eholz1 ... View more

Hello and Thanks,   It looks like this app, desires to store data in some sort of "cloud" based storage. Is this correct? The data I have cannot be anywhere but on a private LAN.  I am not sure how to use this app, is there a posting or source of instructions on how to use this SplukBase app?   Thanks for the reply, ewholz ... View more

OK, thanks so much, I will review the information you provided. Since our Splunk Enterprise instance is running on a virtual machine - the info you provided could be the issue. Splunk internals are tricky, I will check things over. Thanks Again, EWHOLZ ... View more

thanks, will check ... View more

Thanks again for the info and clarification   ewholz ... View more

This has not worked for me, any ideas? here is my SSLconfig line in server.conf [sslConfig] sslPassword = $7$IVRDJa9zz5Rmt3ZehltRkIK2vnYpOPiMSSAZMNAUqdQ7hQAGf2GNXg   No other lines in the file. I am open to suggestions, and get this as well: WARNING: Server Certificate Hostname Validation is disabled., see server.conf, etc Thanks, EWHolzx ... View more

Hello, and Thanks for tip. I will look into getting TLS set and/or a new cert - the cert will need to be self-signed.  Splunk was re-started after each upgrade. I am not familiar with the acronym of "SHC" -Thanks for the info. ewholz ... View more

Hello, Thanks for the reply. It works, sort of... The "dark" theme truns everything dark. It was my hope to have just the Apps panel be dark. I will guess the new version of Splunk over-writes a css file for the web interface.  I have an older version of Splunk running, I will see if I can find the css file.   Thanks again for the reply. Eric W. ... View more

dtbur;rows3 Wow, fast reply. Thanks. The ID gets set when the csv file is written. I have a python program that queries a MySQL database, and writes a "0" as ID if no results are returned from the query. If there is data returned, the ID is taken from query results (i.e ID=34, etc). The csv file is on a remote server. I use the Splunk Universal Forwarder to send the file to splunk. Is there a way to get this file set as an "input lookup" or does the "input lookupo" required the file to be local to the Splunk server? Thanks for quick help. EWHolz ... View more

Hello Members and richgallowy,   Thanks for the tip. It has been a while since I have needed to apply my limited "Splunk" skills, I appreciate this suggestion, and will try it out;.   Regards, EWHolz ... View more