@RaviSingh Please follow the below links as per your requirements: 1. Installing splunk on linux including creating splunk user and opening splunk port follow this link: https://blog.avotrix.com/installing-splunk-on-vm/ 2. Just looking for installing splunk in linux and not linux steps as above, please follow this link: https://splunkonbigdata.com/how-to-install-splunk-on-linux-server/ Also Splunk provided detailed video on splunk portal for installing splunk on linux which can be followed using this link: https://www.splunk.com/en_us/resources/videos/installing-splunk-enterprise-on-linux.html Also if this reply helped you in solving your problem, an up-vote would be appreciated. ... View more

@Kronecker I am not actually very sure about the possibility of your requirement, but yes it is surely possible using classic dashboard via HTML & CSS. ... View more

@srinivas_gowda Try using the below rex: (?:[^,]+,){14}(?<alert_description>.*)\,\"Error In case you want to use in splunk query: | rex field = _raw "(?:[^,]+,){14}(?<alert_description>.*)\,\"Error" Also if this reply helped you in solving your problem, an up-vote would be appreciated. ... View more

@splunk_luis12 looks like duplicate questions are posted. This one is the same which I answered here: https://community.splunk.com/t5/Splunk-Search/Specific-query-from-Splunk-SH-to-create-a-Dashboard/m-p/579720#M201998  ... View more

@splunk_luis12 Try the below queries:   index=stats sourcetype=top | rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user | stats avg(Memory) as Memory avg(CPU) as CPU by user   Show as timechart:   index=stats sourcetype=top | rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user | timechart avg(Memory) as Memory avg(CPU) as CPU by user   Showing single value:   index=stats sourcetype=top | rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user | stats avg(Memory) as Memory         index=stats sourcetype=top | rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user | stats avg(CPU) as CPU   There are many more options to be explored. Also if this reply helped you in solving your problem an up-vote would be appreciated 👍 ... View more

@splunk_luis12 Try this: [script://<cmd>] interval = [<decimal>|<cron schedule>] Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Inputsconf Also if this reply helped you in solving your problem an up-vote would be appreciated 👍   ... View more

@sumitp10797 Also if you received you answer please mark it as a solution so that I can be used by others for a reference. ... View more

@sagar_shubham Try using the below rex: | rex field=_raw "login_id\"\:\"(?P<login_id>.*?)\"" Also if this reply helped you in solving your problem an up-vote would be appreciated 👍 ... View more

@SplnkUse Please add the below earliest and lastest in your query after your index and sourcetype, example: index=<<your_indexname>> sourcetype=<<your_sourcetypename>> earliest=-1d@d latest=now Also if this reply helped you in solving your problem an up-vote would be appreciated.     ... View more

@sumitp10797 Try using below queries: 1. Total purchase split by product ID index=<<your_index> sourcetype=<<your_sourcetype>> | stats sum(purchase_field) as purchase by product_id 2. Total Products split by product ID  index=<<your_index> sourcetype=<<your_sourcetype>> | stats sum(products_field) as products by product_id 3. Both Combined Query: index=<<your_index> sourcetype=<<your_sourcetype>> | stats sum(purchase_field) as purchase sum(products_field) as products by product_id Also, if this reply helped you in solving your problem an up-vote would be appreciated. ... View more

I am looking to index the content of all the files with latest data but not the already indexed data. Also some new files would also be created on daily basis that must also get indexed. ... View more

@richgalloway What should be my monitoring stanza ? currently i am using the below one yet i am not able to see logs in my index(I am using linux UF to forward the logs all the ports are open and i am able to receive logs from other file destinations). [monitor:///opt/splunkforwarder/etc/apps/error_log/audit/*.log] index = test sourcetype = test disabled = 0   ... View more

@genesiusj working perfectly fine for me. ... View more

@jerinvarghese Change your drilldown tag in the first panel as shown below:   <drilldown> <set token="message_token">$row.cisco_mnemonic$</set> <set token="hostname_token">$row.hostname$</set> </drilldown>   If this didn't work you must also try the solution given by @richgalloway  Also if this reply helped you in solving your problem, an up-vote would be appreciated. ... View more

@brcox9090 In case of localhost your ip would be 127.0.0.1, that is you can also open your splunk using below URL: http://127.0.0.1:8000/  Also if this reply helped you in solving your problem, an up-vote would be appreciated. ... View more

@johnhuang Can you check your source code of the dashboard ? Search for something like splunk product else share the source code here if possible. ... View more

@vishwasgopala Try adding the below query after you index=<<anything>> | rex field=_raw "result\=\'(?P<result>\w+).*dacNumber\=\'\[(?P<dacNumber>.*?)\]" | search result="failed" | dedup dacNumber | table dacNumber result Also if this reply helped you in solving your problem an up-vote would be appreciated. ... View more