Hi I'm trying to create a custom dashboard which list the companies and products we have running on our servers. To define the term company i setup a field extraction -> transform to look at a specific folder on each server. i have the logs for each company/product writing to their specific folder (c:\logs\ABC Company\Product). I've tried using source, field, sourcetype=company and i can't get it to list out the companies. Anybody have any suggestions? Also i'm using a basic xml dashboard design since programming is not my forte. Thank you ... View more

I have a forwarder that was running fine for a couple days but I had to turn it off due to a system resources issue. I have since added more memory and when I try to start the service from the MS services GUI i get an error 1067. The event viewer is only showing me an event id of 7034, splunkforwarder service terminated unexpectedly...that's it. I have the service set to start as a local system account. Doing a Google search on those results return some MySQL results, and windows SCM service, which doesn't help me resolve the issue. If I try to start it from the command line it says the port is available, but times out when it tries to start the splunkd. Anybody have a clue what's causing this? I'm guessing I need to un-install/reinstall the forwarder. I just want to understand why all of a sudden it won't start anymore. ... View more

is it possible to define the source and sourcetype fields to match a folder name? On each server our log structure for our products are as follows F:\Logs\Company_Name\Product\file.txt . I'd like for the Company_Name folders to be defined as the source, and product folder to be defined as source type. how do I go about doing this? I've read that this can be done in props for actual files, but I don't see an example for an actual folder location. ... View more