Hello, I have a problem with the file monitor. I guess it's not the right way using it, but I don't know any other method for this kind of import. CSV-files with a size of 1 up to 20 MBytes are periodically copied into a directory from a remote server, where I have a file monitor on. The Problem is, they are indexed during the copy process as binary events. Can I force Splunk to wait until the copy process ends before it starts the index process. Thank you 🙂 ... View more

Hi, Can anyone tell me if it is possible to change and delete tags by Splunk search? Let me tell you why. I import data from a database. Each time a record is updated, I receive a new event in my index at the same time. Therefore, I am forced to sort all events before I can "dedup". My idea is the following: When a new event occurs, I give it the tag "latest". When this event receives an update, I want to remove the tag "latest" of the older event and pass it to the new version. Therefore I don't have to sort the data anymore and can use "tag=latest" instead. I know it isn't the right way to use tags because usually you would tag a field=value expression. ... View more

Hi folks, I have tried to create a table drill down to insert elements into a multiselect input, that are already selected. The workflow is: User searches something by using a keyword. He then selects tokens, which are then added to the multiselect input. The mutliselect input however is used as a filter for a new search. Is there a simple way, to add selected elements to a multiselect input by a drill down. Or do I have to use java script in stead. I've already created a dashboard, which has a drilldown on a multivalue field. <form> <label>My test Dashboard</label> <fieldset submitButton="false"> <input type="multiselect" token="sel_tokens"> <label>Selected Tokens</label> </input> </fieldset> <row> <panel> <table> <title>$Token$</title> <search> <query>| makeresults | eval _raw="2017-10-15 | INFO | NOTES=\"My app has ID APP-01234 and yours APP-56789\". The dedicated host is Test0815.de." | rex field=_raw max_match=5 "(?P<appid>APP-\d{5})" | rex field=_raw max_match=5 "(?P<host>Test0815.de)" | eval Tokens=mvappend(appid, host) | table _time, _raw, Tokens</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="Token">$click.value2$</set> </drilldown> </table> </panel> </row> </form> ... View more

Hello, I want to create a dashboard on which I can create events per inputs (fields like project, action, from, to) and by clicking on a submit button it will be saved in a certain index. So far I found the "collect" command, but since I don´t get any search results and want to create a event from scratch, I can´t really use it. Do you have any idea? Thanks a lot and kind regards Benjamin ... View more

Hello fellow Splunkies, I get data into Splunk by monitoring a directory for changes. If I insert an archive (.zip) of about 10 MB the data, it is not imported correctly --> no time stamps + unreadable text. I think the problem might be that Splunk starts the import immediately by unzipping the archive. Since it is not fully copied it fails and Splunk handles the file like binary code. Does anyone know a solution? ... View more

Dear Splunkers, I would like to know if there is a reference for all the different actions of the field "action" (edit_sourcetype, edit_token_http, ...) in the Splunk _audit index? Regards Benjamin ... View more