Looking to add tooltip sting of site names included in the same lookup file as the long lat on a cluster map.   IS this even possible? ... View more

I am not seeing results for count on each of the fields for the 2 different searches below:   The first one shows the (lets say 3 storefront names  ) with no counts.  If I just run a | stats count by Storefront it returns with the correct number of counts.  The  fields are created in statistics with no counts or names of the the netscalers, site, or user.   The second search does not return any statistical results.  Hoping to see the count of connections to the Storefront and its correlating NetScaler in a Sankey diagram.     | stats count by Storefront | rename Storefront as source | appendpipe [ stats count by Netscaler | rename Netscaler as source, count as count_Netscaler ] | appendpipe [ stats count by site | rename site as source, count as count_site ] | appendpipe [ stats count by UserName | rename UserName as source, count as count_UserName ] | fields source, count_Netscaler, count_site, count_UserName | search source=*     | stats count by Storefront | rename Storefront as source | appendpipe [ stats count by Netscaler | rename Netscaler as source, Storefront as target ] | appendpipe [ stats count by site | rename site as source, Netscaler as target ] | appendpipe [ stats count by UserName | rename UserName as source, site as target ] | search source=* AND target=* | stats sum(count) as count by source, target | fields source, target, count ... View more

get-brokersession is run via powershell and sent to a txt file.   The information is getting into splunk however, every line that has a date and time in it the event is killed and a new event begins  with the next line in splunk.   Is there a way just to have the txt file to be ingested into splunk without it chopping up the file every time it come to a timestamp in the log? ... View more

I have a powershell script running get-brokersession which then exports the results to a txt file.   The file is then forwarded via the Universal Forwarder.     Trying to create a search that bases the output data via the session key.   The Citrix add-on app is not allowed at our location. ... View more

Heavy Forwarder issues   on a 9.02 version0 and cant connect to indexer after an upgrade from 8.2.0 Anyone know of more current discussion other than this 2015 post: https://community.splunk.com/t5/Getting-Data-In/Why-am-I-getting-error-quot-Unexpected-character-while-looking/m-p/250699 Error httpclient request [6244 indexerpipe] - caught exception while parsing http reply: enexpected character while looking for value : '<' Error S25OverHttpOutputProcessor [6244 indexerpipe] - http 502 bad gateway ... View more

Splunk Studio show a message or icon for a Pie chart which returns no data:   I am looking to display an icon or message if no results are found on a pie chart in place of the grey pie image on a dashboard if no results are found. Index=test (Eventcode=4010 OR Evnetcode=4011) | stats latest (eventcode) as latest_event_code by Site | eval Site= upper(site) | where latest_event_code=4010     I have been trying appends like the following: | stats count |eval NoResult="0" | Where count=0 | appendpipe [stats count | eval Noresult="0" | eval test="test Message"] ... View more