I had defined the complete path in inputs.conf and restarted the Splunkforwarder but got error in Splunkd logs. Kindly refer the attachment.   ... View more

Hi  Could someone help to let me know how to display fields stating "file is missing" in Splunk DB query output when no output is expected Currently the below query returns- | dbxquery query=" select * from ............................ ;" connection="to_connect" > No results found Expected output- file missing   file missing    file missing (if possible ...different texts in different columns, not sure if eval/fillnull command can be used here) ... View more

I am having below search string and suppose the file "magic_new.log" has no events and the requirement is to show that as output index=magic  source IN ("D:\\show\\magic.log", "D:\\show\\magic_new.log", "D:\\show\\magic_old.log") | stats count by source | where count=0 current output- no results found expected output- source                                                    count D:\show\magic_new.log                0  (Note: Tried multiple solutions suggested in the community but none worked) ... View more

Hi guys, For a dashboard panel, I am running base search and hoping to have a checkbox that returns the timechart data while selecting the check box. Not sure what changes needs to be done to the following query- (also I guess the tag placement for row, panel & chart needs to be aligned) <search id="base_search"> <query>index=magic host="abc*" $check1$</query> <earliest>-120m@m</earliest> <latest>now</latest> </search> <fieldset submitButton="false"> <input type="checkbox" token="check1" searchWhenChanged="true"> <label>box</label> <choice value="*">All</choice> <search base="base_search"> <query>| search "abracadabra" | timechart span=5m count </query> </search> <fieldForLabel>check1</fieldForLabel> <fieldForValue>check1</fieldForValue> </input> </fieldset> ... View more