I have created a form with a time selector dropdown box. When I print the results the dropdown box does not display. I need to have the dates and times selected displayed on the report. How can I do that? This is also useful for other dropdown boxes that are not time selectors. <input type="time" searchWhenChanged="true"> <default>Last 7 days</default> </input> Thank you, Don ... View more

I am creating a table and simply reordering the fields from events. When I view the table there are random blank rows. How can I eliminate those rows? index=mainframe sourcetype=dalystat INTVCICS | eval _time = strptime(time,"%m/%d/%y ;%H:%M") | table System TranName APPLID TranCount AvgRespTm AvgCPUtm DB2Requests AvgDB2waitTime MQRequests AvgMQwaitTime AdabasRequests AvgADABASwaitTime ... View more

I have a data source I am trying to ingest into Splunk. It is a txt file that is written to by multiple systems. My problem is that each system writing to the file has it's own date format. I have worked out two of the three data sources which have a two digit year The third data source has a four digit year. Below is what we are currently using in props.conf and a sample of the data. TIME_FORMAT =%m/%d/%y TIME_PREFIX=NODE\w{2}\s+; INTVCICS;08/29/2014 ;23:30 ;1B90;T100 ;1 ;0 ;0 ;0 ;0.608 ;2.659 ;0.000 ;0.000 ;0.000 ;VENDORS ;XXXXX NODEPR ;08/27/14 ;1D81;ECM_storeDocumentToCI_MF ;Extract Message-Code/Decode ;0.002 ;0.001 ;103 ;XXXXXXXX ;ComputeNode ;XXXXXXX NODENP ;08/29/14 ;1B90;5:58 ;CM_retrieveClaimHistoryDtlCMS_MF ;SOAP Reply ;0.001 ;0.001 ;25 ;XXXXXXXX ;SOAPReplyNode ;XXXXXXX Thank you, Don ... View more

I am trying to use fschange to monitor some SharePoint directories. As a user on my remote forwarder box I can access the directories. I am logged onto the server using the same domain account that splunkd uses. When I enable the fschange monitoring I get the following message in the splunkd.log. 08-08-2014 09:17:41.259 -0400 WARN FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time any help you could provide would be greatly appreciated. Thank you Don ... View more

My problem is that in my data source, when a user logs on there can be a single entry or multiple entries. I need to eliminate the duplicates for each time interval but allow for future events by that User ID. I have tried dedup and distinct count. Does anyone have any suggestions? index=* prdwfcs*/88 WFCSUID=UserID | stats count dc(WFCSUID) index=* prdwfcs*/88 WFCSUID=UserID | dedup WFCSUID ... View more