Is there a way to dynamically assign chart labels using a search? My search ends with a timechart values(foo) as bar, values(baz) as qux . I have created searches to pull out the values from Splunk for the labels, but if I replace "bar" and "qux" as subsearches, the labels get a bit missed up and the chart data skews. My current environment is Splunk Enterprise 6.4 and 6.3. What am I missing? Thanks! ... View more

I’m setting up Splunk for our jenkins logs which are in a directory tree as that looks like this Splunk Branch/ <Job>/ <date>/ junitResult.xml job.log <Job>/ <date>/ etc… I’ve set up a file monitor at the top but it wants to parse the XML files in the tree as raw text which doesn’t work out so well. Is there a way to have the filemon determine the source type of each file on the fly to parse it correctly? Thanks. ... View more