Using splunk enterprise 9.4.3 and dashboard studion. I'm trying to populate a drop down on a dashboard with a search query as follows: `bsod` | stats values(fct_version) as ForticlientVersion This returns the values as desired as will do so for any time period as the events will always have this field. When I confgure the drop down dynamic fields as follows:   The dashboard does not display these values in the drop down ever (afer refresh etc.) Code for dropdown:   { "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "label": ">primary | seriesByName(\"ForticlientVersion\") | renameSeries(\"label\") | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "value": ">primary | seriesByName(\"ForticlientVersion\") | renameSeries(\"value\") | formatByType(formattedConfig)" }, "dataSources": { "primary": "ds_GS8EDN3O" }, "options": { "defaultValue": "*", "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "token": "_ftcversion" }, "title": "Forticlient Version", "type": "input.dropdown" }   ... View more

I’m using Splunk Enterprise 9 with Universal Forwarder 9 on Windows. I'd like to monitor several structured log files but only ingest specific lines from these files (basically each line begins with a well-defined string so easy to create matching regular expression or simple match against it). I’m wondering where this can be achieved? Q: Can the UF do this natively or do I need to monitor the file as a whole then drop certain lines at the indexer? ... View more

I'm using Splunk Enterprise 9.x  with Universal Forwarders 9.x on Windows 2019. All my forwarders are connected to a deployment server. I notice the following for example: I update a deployment server app (say update inputs.conf with a new input stanza) I restart the deployment server I view the inputs at the forwarder using btool and see that my changes have propagated However, even though the updated inputs.conf file seems to have landed at the forwarder I do not see the events defined by my new inputs.conf hitting the indexer until I restart the forwarder. Perhaps this is expected based on this When to restart Splunk Enterprise after a configuration file change - Splunk Documentation ? Is this expected and if so is there any way to restart the forwarder remotely using Splunk itself?  ... View more

Using Splunk Enterprise 9. I'm trying to populate a dashboard studio dropdown input from query results. I was testing via a simple query (copied from the dashboard studio examples) as follows:   | inputlookup firewall_example.csv | stats count by host   This works fine and the dropdown gets populated with the hosts. However, I'd also expected the following to to work    | inputlookup firewall_example.csv | stats values(host)   but it doesn't and no dynamic entries are in the dropdown.  So my understanding of the query types that can be used with dropdown inputs is incomplete! Can someone point me in the right direction?      ... View more