I added some dummy data yesterday after creating an index and respective source type But today morning i found there were no data in the surcetype and index is also saying "No data found" I have splunk admin role Please help Thanks in advance ... View more

We have a report that keeps the time data(hours booked by them in a month) of around 300 employees. Now we want that if for an employee the number of hours booked by him is less than the aloocated hours, then a mail should be triggered to his/her supervisor But the problem is the mail is triggering only for 5 people not for all of those whose hours booked is less than the allocated hours. Please suggest any method ... View more

I have a table that contains some columns. My requirement was to open a URL on clicking the column value which i did but now i want to make those values clickable. Please suggest I have provided the drill down part below <link> <![CDATA[Respective link ]]> </link> </drilldown> Thanks in advance ... View more

We have our Splunk instance on cloud and to monitor each source type we have created a folder on a shared drive. Each CSV file of a particular source type is extracted from a database and then from that folder, we are getting the data into Splunk. Earlier I created that folder on my system and it was working fine and even with one drive it is working fine but with share drive, it is unable to recognize the path. We have provided that necessary path and index in input and output.conf. Please help. ... View more

I have an alert that runs every Tuesday at 2:30 pm. The alert Body is as follows Subject “BLAH BLAH "-------the date when this alert runs Body Hello Please find attached talert as on . Regards Asish Now filed should dynamically appear while the alert is running, but since it is a PDF alert i am unable to bring the from PDF using token $result.Date$(I have already created the field in my alert query). Please help ... View more

I have the following table: Month Value September 12 October 78 November 88 December 132 I want to display the value of October in September, November in October and so on. The final output should look like this: Month Value September 78 October 88 November 132 December Value of January How can this be achieved? Please help. Thanks in advance. ... View more

Hi, We have a setup in a remote machine that receives data from database in form of excel sheets and forwards it to Splunk environment with the help of a universal forwarder. But when i am searching that particular data it is not coming in splunk. Any idea why this is happening even if the .conf files are fine? ... View more

Hello, I have three panels , first one is account level second one the whole month's data and third one till date's data starting from first day of the give month (Month filter is a drop down).There is a checkbox which when checked will hide the second panel (which contain whole month's data ) and display the third panel (till date's data).When unchecked the third one gets hidden and the second one is displayed. By default first one will be displayed whether the box is checked or unchecked. Please suggest a XML code for this. ... View more

Hello, I have a set of data in the following manner. Domain Application TicketId Hours Recipient HR abb 123rrr 121 h1@gmail.com HR hhg 145rew 100 h1@gmail.com Hi aby 123rrt 120 h2@gmail.com Hi hhu 145rty 109 h2@gmail.com Hl abo 123rhg 127 h3@gmail.com Hl hhi 145rll 105 h3@gmail.com Hl abp 123rkh 123 h3@gmail.com Tm hhp 145rfdf 100 h4@gmail.com The query which i have written generates this: "search query|eval recipient=case(Domain=HR,recipient=h1@gmail.com,Domain=Hi,recipient=h2@gmail.com,Domain=Hl,recipient=h3@gmail.com)|" so that it sends specific data to specific recipients as mail alerts. Like If domain is HR then all data related to hr should go to h1@gmail.com not the data of remaining domains. In my mail alerts settings also alert mode="once per search" mode and in the TO filed it is $recipient.result$ , but still mail is not sending specific results to specific recipients.It is sending the whole data Please suggest what should be done ... View more