Hello @VatsalJagani  Thanks for the info, Yes we have those DMC enabled but the problem is as we are new to Splunk we had given only limited access for now to SH. So we wanted to create some dashboards to look with in the internal logs to detect the issues. I would like to start with the Universal Forwarder first. ... View more

Hello @gcusello  Thanks for the reply, is that possible to share the app info or share the source code of the dashboards ? ... View more

Hello. I tried this but i didn't worked.  ... View more

Sure ! Thanks. Let me know how we can do this ... View more

So I have a schedule search running on DS to summery index which pulls all the info from two DS. Index=summery source=sc. which has the serveclass, forwarder, deplyment server, deployementappname info.    ... View more

This is what i have so far..     <form version="1.1" theme="light"> <label>AutoSelectMulti</label> <init> <set token="pre_indexes"></set> </init> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="server" searchWhenChanged="true"> <label>Server</label> <fieldForLabel>dns</fieldForLabel> <fieldForValue>dns</fieldForValue> <search> <query>index=summary source=sc dns=eaz* | dedup dns | table dns</query> </search> <delimiter> ,</delimiter> </input> <input type="multiselect" token="ds1"> <label>DS1</label> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>index=summary source=sc dns=eaz* | search dns IN ($server$) | dedup host | table host</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <delimiter> ,</delimiter> </input> </fieldset> <row> <panel> <table> <title>EAST DS</title> <search> <query>| makeresults | eval ServerclassInfo="[serverClass:serverclass] whitelist.0 = server1 whitelist.1 = server2 Server List which needs to add under whitelist = $server$ EAST Deployment Server : $ds$" | fields ServerclassInfo | fields - _time</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <title>West DS</title> <search> <query>| makeresults | eval ServerclassInfo="[serverClass:serverclass] whitelist.0 = server1 whitelist.1 = server2 Server List which needs to add under whitelist = $server$ WEST Deployment Server : $ds$" | fields ServerclassInfo | fields - _time</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>       What Ultimately I'm looking is if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the 3 servers with what DS. Whereas other panel shows the identical thing, but only the 2 servers . That's okay if we don't have that Deployment Server input too.     ... View more

Basically what I'm looking for is, I have a Multi Select Server input, if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the clients (3 total). Whereas UK panel shows the identical thing, but only the 2 clients  ... View more

Basically what I'm looking for is, I have a Multi Select Server input, if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the clients (3 total). Whereas UK panel shows the identical thing, but only the 2 clients  How do I achieve this ? ... View more

I tried those but if i select multiple index the sourcetype multi select is not working.  ... View more

<form version="1.1" theme="light"> <label>two DS panels</label> <fieldset submitButton="false"> <input type="multiselect" token="server"> <label>Server</label> <choice value="a">A</choice> <choice value="b">B</choice> <choice value="c">C</choice> <choice value="d">D</choice> </input> </fieldset> <row> <panel> <table> <title>US DS</title> <search> <query>| makeresults format=csv data="Host, DS A, US-DS B, US-DS" | table Host DS</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <title>UK DS</title> <search> <query>| makeresults format=csv data="Host, DS C, UK-DS D, UK-DS" | table Host DS</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

Hello @gcusello  Can you please share the same ? I have a similar use case. ... View more

@gcusello   @PickleRick Thank you for the reply. We are sending data from application console to splunk through syslog and they define to send only error logs from their console. So If I schedule to run at 15 mins frequency and 15 time range. Will there be any chance of missing events to be triggered. Our intention to get alert when ever there is new event and shouldn't repeat the same event in the alert.      ... View more

Hello @Sukisen1981 , Your Query helped me !! Thank you.  But I had a small question. I have a similar Query which I wanted to show By Month  CLIENT Fails Passes Total MonthClientA 10 1 11 jan ClientB 0 1 1  mar CliectC     11    9 20 feb So I had tried your query and i got the below results...  I used this for month | eval Month=strftime(_time, "%B") But I wanted to get the latest month first so on like mar feb jan  CLIENT Fails Passes Total MAR    JAN   FEBClientA 10 1 11 0 5 0 ClientB 0 1 1  2 11 0 CliectC     11    9 20 0       0    19   ... View more

Apologies, didn't realized it got posted in "Getting Data in". Well, I have a data already in Splunk and trying to create a custom alert to trigger an email to DL, when the condition met. But I don't have an env field in either DEV & PROD data. When I create alert with subject DEV $name$. the admin team deploying the same code to PROD saying that they wanted to keep the same code across all env.  I'm getting the alert as "DEV myAlert" in PROD. So checking if there is a way to implement this just by including the token ??  ... View more

I had tried the way you told but I got the same error as above. These are the last two values of my csv file in notepad + +    Does every line should have CRLF ?     ... View more

Basically we export from Airtable as a csv.  I changed in notepad++,  view->show symbols-> show all characters, and  edit->EOL Conversion->Windows Format. but that doesn't work. ... View more