About BansodeSantosh

BansodeSantosh · ‎06-27-2017

Yes, it's too late. But this might help someone looking for same now. For using wildcard, you can do something like this: | join type="join_type" wildcard("field_name_to_join" ) [inner search here] Hope this will help you all.

BansodeSantosh · ‎05-29-2017

Thanks @hopnscotch for the detailed explanation. But I have a doubt that in cluster environment all peer should have the same configuration file. If you are pushing the application from Master node then it will apply on all nodes. So how this is feasible to install eStreamer supplication only on one indexer. I am totally confused about the architecture....can you please help me to clear it. Thanks @hopnscotch.

BansodeSantosh · ‎05-24-2017

Thanks @niketnilay and @cusello. I think Universal forwarder on application server will be an easy option.

BansodeSantosh · ‎05-23-2017

Thank you Cusello, I am thinking about to store data in a CSV file and then index it through File Input option. But I don't know how to submit this data to server where we configured this file input. Do you have any idea?

BansodeSantosh · ‎05-23-2017

I have a requirement to collect data from user and insert into Splunk index for further use. This is like the web page where many questions are asked with answer in the dropdown list. User have to select one of those answers from the list. Once the user complete the form and click on SUBMIT button data goes to Splunk index. I am thinking to create an application with dashboard of my requirement but don't know how to insert data in Index. Do you people have any idea about how to do this. Your help is highly appreciated. Thanks.

BansodeSantosh · ‎05-15-2017

I have created an application which contains all configuration of Index, Data Input, Sourcetype, Lookup, Fields and view and Dashboards. I want to put all visualization (Dashboards) on Search Head and all other configuration of Data Input, Index, Lookup and Fields on Indexer. Please suggest if you have any idea bout how to do this in cluster environment. Highly appreciate your help. Thanks.

BansodeSantosh · ‎05-08-2017

This solution worked...thanks #the_wolverine

BansodeSantosh · ‎05-08-2017

crcSalt = This worked for me....Great!!

Posts	8
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎06-16-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to index data from a Form?

How to deploy application in cluster environment?

Re: How to join value using wildcard? (Urgent)

Re: Where does Cisco eStreamer for Splunk app need...

Re: How to index data from a Form?

Re: How to index data from a Form?

How to index data from a Form?

How to deploy application in cluster environment?

Re: Duplicate data because of file parts

Re: How to troubleshoot why a file in monitored fo...