Hello, Below Column Chart Results and visualization, I wanted to show different colors for field Values. like AU Pre & AU Post as one color  DE Pre & DE Post as one color.  I'm using this but doesn't work  <option name="charting.fieldColors">{"AU Pre":0x333333,"AU Post":0xd93f3c,"JP Pre":0xeeeeee,"JP Post":0x65a637,"DE Pre":0xeeeeee,"DE Post":0x65a637}</option> market           limit             spend AU Pre 1462912 884854 AU Post 2160567 1166031 DE Pre 91217 76973 DE Post 160221 97906 JP Pre 1621712 1015115 JP Post 2787394 1282541               ... View more

Hello, I have a below values in lookup and trying to achieve below bar chart view.  Country     old_limit        old_spend_limit      new_limit          new_spend_limit    USA            84000             37000                       121000                   43000   Canada     149000           103000                     214000                 128000 old_limit = PRE new_limit = POST     ... View more

Hello, So I have a below dashboard panel which is populated with lookup.  Name     Organization    Count Bob            splunk                 2 Matt           google                15 smith          facebook            9  What I'm looking for is.  1. If I click the Bob, it has to open a new search tab with the query "| inputlookup mydetails.csv | search Name=Bob " 2. If I click the Splunk, it has to open a new url with "www.splunk.com" For all the values respectively.  How do I achieve this within one ? ... View more

I have a inputs.conf where it will monitor all the files from a folder  [monitor:///mydata/my_folder/ToSplunk/*.(mylogfile|edi.mylogfile|edi)] index = xyz _TCP_ROUTING = dev_indexers,qa_indexers sourcetype = XYZ_SRCTYPE crcSalt = <SOURCE> Also, I wanted to monitor same directory with different files as a different sourcetype. Also these two stanza will have respective props.  [monitor:///mydata/my_folder/ToSplunk/*.ABC.xml.ToSplunk.edi] index = xyz sourcetype = XYZ_SRCTYPE:ABC _TCP_ROUTING = dev_indexers,qa_indexers crcSalt = <SOURCE> ... View more

Hello, I have a folder where I have different types of files in it and want to monitor the whole folder as one sourcetype with different props.conf  inputs.conf [monitor:///mydata/my_folder/ToSplunk/*.(mylogfile|edi.mylogfile|edi)] index = xyz _TCP_ROUTING = dev_indexers,qa_indexers sourcetype = XYZ_SRCTYPE crcSalt = <SOURCE> Props.conf [XYZ_SRCTYPE] SHOULD_LINEMERGE=false LINE_BREAKER=(\~|\r\n)ST\*834\* NO_BINARY_CHECK=true TRUNCATE=999999 CHARSET=UTF-8 priority = 1 As I said I have different files, I wrote different props.conf for specific log structure to break the events.  [source::/mysource/ToSplunk/*.xml.*.edi] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\s]+)\<Policy\>[\r\n\s]+ NO_BINARY_CHECK=true TRUNCATE=999999 CHARSET=UTF-8 priority = 5 [source::/mysource/ToSplunk/*.COMPARE.xml.*.edi] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\s]+)\<CompareMissing\>[\r\n\s]+ NO_BINARY_CHECK=true TRUNCATE=999999 CHARSET=UTF-8 priority = 6 [source::/mysource/ToSplunk/*.SBS*.xml.edi] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\s])+\<Policy\s+ NO_BINARY_CHECK=true TRUNCATE=999999 CHARSET=UTF-8 priority = 7 [source::/mysource/ToSplunk/*.RCNO*.P.OUT.*] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true TRUNCATE=999999 CHARSET=UTF-8 priority = 8 The linebreaking in first stanza declared for the sourcetype is working fine, but none of the stanzas for [souce://] are breaking the events correctly ... View more