??? x=y and x= y are not the same? ... View more

it doesn't work. So the working solution is: fileWriter.append( Arrays.asList(entry.getProperties().getCellId(), c1.get(0),c1.get(1), c2.get(0),c2.get(1), c3.get(0),c3.get(1), c4.get(0),c4.get(1) ) .stream().map(Object::toString).collect(Collectors.joining(","))+"\r\n" And extra movement: add header to the file. Then splunk does what expected: 1. reads file line by line 2. doesn't try to put first line as a header 3. correctly splits fields not ignoring \t. When splunk did put all line into the first field it even displays in UI that '\t' are between values. weird! ... View more

Have you looked at doing this entirely using the out-of-the-box map visualization, and dashboard controls? See the dashboard examples app for a reference search/vis example. Splunk 6.x Dashboard Examples App https://splunkbase.splunk.com/app/1603/ In other words: Use Splunk search to query hunk rather than custom javascript Use the built-in Splunk maps to render results Use the form inputs supported by the Splunk dashboard editor to control date/time ... View more

|tstats might not work... but a virtual index is an index... meaning you refer to it as index=virtual_index_name. so the last one in my answer should work. index=coll* |stats count by index|sort -count unless you are a) not talking about virtual indexes or b) have not kept to the naming convention... ... View more