This might answer your question: http://answers.splunk.com/answers/117947/splunk-adds-filepart-to-file-name.html ... View more

it worked as needed, thanks 🙂 ... View more

yes they go to a central indexer. ... View more

HI Nivedita, I was working on the similar thing and was facing the same problem, I found out an alternative solution for it and it solved my purpose (might be of use for you as well). So here it goes: In my case I had few browser and then I had to create a drill down so that when I click on browser I get into the dashboard that shows the stats for its version, so every bar in the dashboard was suppose to link to the other dashboard containing version specific to the browser. Just like this: https://www.dropbox.com/s/e7cfanss17l77pv/MainDashboard.PNG?dl=0 Here is the thing that I did: I created a dashboard (I will call it as main dashboard) that showed me all the browser info one that is in the attached link (like IE, Chrome etc), then I created another dashboard with the name starting with Browser name that was in the main dashboard (for eg. IE_versions, that contains all the version stats for the IE, So when I click on IE bar in main dashboard it should come here). Point to note here is that when you create the dashboard in the Dashboard ID please start the id name with same letters as bar value and in same case (like in my case I set the Id to be IE_version_count). Here is what the version dashboard looks like: https://www.dropbox.com/s/an93dbl9oykxt17/IE_version_count.PNG?dl=0 Here is the main part: In the XML add the following line: <drilldown> <link><![CDATA[/app/search/**$click.value$**_version_count?earliest=0&latest=]]></link> </drilldown> The click.value will take the value of the bar and place in the URL which takes it to the desired dashboard (like for chrome it will take me to Chrome_version_count and so on) The disadvantage is that you have to follow the name every time you create a new dashboard (but I guess that is not that a big problem). (I have tried my best to explain but if there is anything unclear please ask in the comments and I will try my best to solve it) Vinod. ... View more

Hi Stephan, Can you please explain how is that possible and how can you get this working? ... View more

Thanks for the answer Noumssi 🙂 ... View more

Gotcha! Sorry I got confused. Thank you so much for you answer 🙂 ... View more

Hi Stephanefotso, Thanks for the reply, But this not what I am asking for sorry. I know we can include all this, but what I want it to get the events like they come up when we do a search by typing the query (I hope it is making sense what I am asking) with all the stuff like source type host etc etc. ... View more

HI Strive, Thanks for your response, I am facing the same problem but with a weird twist that is this problem is not for all the records, I am having few records (about 100) that are having the this time stamp issue and rest are absolutely fine. Any idea what could possibly be the reason for that? Thanks, Vinod. ... View more

The Post I shared was the exact thing I was asking. I wanted to find a way through which I could spot the difference in my pivot depending on the values. for example like I said above if the values is less then the threshold change the color. The post I shared did the same thing for me by using two variables and using condition to initialize there values and once it was done I could go into the code of my Dashboard and set there color according to my requirement. ... View more

Hi Umam, I guess you need to know how you can configure the Alerts through the config file, The following link shows the scripts and rules that we follow to do the same: http://docs.splunk.com/Documentation/Splunk/6.2.1/Alert/Configuringalertsinsavedsearches.conf I hope this answer's your question. Vinod. ... View more

Hi Stianhk, following link shows you how to add splunk to your own web app, I guess this might help you as there is an example created in it as well, and yes you were right you would need to use Splunk JS. Link: http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAEW5 ... View more

Hi Ed, From what I know the sourcetype is the path from which the data is taken, I mean if splunk is taking the data from xyz.logs then source type is the path of this log file. So to answer the question of who puts the data in source type: it is the server or the application creating the logs puts the data in the source type. I guess I am answering what you are asking, please let me know if I am going out of the track. ... View more