You need to modify CHECK_METHOD in props.conf to modtime (checks only modification time of file): https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-answer&utm_term=props.conf&utm_campaign=refdoc#File_checksum_configuration ... View more

this file is 90 lines only hardly 4kb in size.... ... View more

Hi 722624, I don't know other tests, the only one is to check again hostname on forwarder, are you sure that it's correct? could it be the same of another forwarder. to debug your configuration, try to run on forwarder command /opt/splunk/bin/splunk cmd btool output list --debug eventually forwarding output in a text file to see if there is a misconfiguration or other configurations that you don't know. Watching you inputs.conf I saw an error: on *nix forwarders, in the first row you have to insert three slashes (/) and not two. in addition, why in your inputs.conf you use _TCP_ROUTING = rh_det if you have only one indexer in your outputs.conf? Bye. Giuseppe ... View more

I tried using TERM but not getting any result I used like this TERM(The ! (exclamation point) before SSLv2 is what disables this protocol. Windows Disable SSLv2 protocol support in Microsoft Windows Configure the server to require clients to use at least SSLv3 or TLS. For Microsoft Windows before Windows 2003, see KB187498 (http://support.microsoft.com/kb/187498) . For newer versions of Microsoft Windows, see KB245030 (http://support.microsoft.com/kb/245030) .) ... View more

We can start with I can't find my data! ... View more

If you need two tables, please try to use two panels. One panel should give you all the sales orders with a query like: index=yourIndex sourcetype=yourSourcetype | stats dc(salesOrderNameField) as "Total Sales Orders" Then for the details of sales order, please check what all fields are available and then table them in a new panel with a query index=yourIndex sourcetype=yourSourcetype |dedup salesOrderNameField| table salesOrderNameField, salesOrderDateField, and so on ... View more

What you are probably looking for is an appendcol command. You can try something like this - your_search_query_1|appendcols [search your_search_query_2] Reference # http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Appendcols ... View more