Are you trying to send container logs to Splunk? If so, use Splunk's HTTP Event Collector (HEC) to receive the data stream instead of monitoring a file: https://docs.docker.com/engine/admin/logging/splunk/ ... View more

The Splunk dashboard with input/filter is called form and here is the procedure, Splunk documentation, to create the same. http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Buildandeditforms http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/FormEditor ... View more

For your bar chart, you can use commands like these your base search | stats sum("SUM_VALUE_") as SUM_VALUE by CDC_DVN_VERSION_ OR your base search | chart sum("SUM_VALUE_") as SUM_VALUE by CDC_DVN_VERSION_ To add PRODUCT_ID_, as filter, create a form input with token productid and use the token as filter in your base search your base search PRODUCT_ID_="$productid$" | chart sum("SUM_VALUE_") as SUM_VALUE by CDC_DVN_VERSION_ See this for examples for how to create form/form input. http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Buildandeditforms ... View more