I was just dropping the .csv in the auto index folder- a simple copy and paste into the directory- do you know why a file could be locked? I appreciate your help! ... View more

The errors I got when I first tried to upload were: -0400 WARN FileClassifierManager - Unable to open 0400 WARN FileClassifierManager - The file is invalid. Reason: cannot_open -0400 ERROR TailReader - error from read call The inputs.conf looks like below: whitelist = .csv$ disabled = false index = it_snow_call_kiosk_logs_weekly sourcetype = itcc:snow initCrcLength = 640 And I was trying to upload a .csv. ... View more

thank you! ... View more

so really the only migrations I need to worry about is the public objects? ... View more

thank you- I will adjust my monitor stanza- do you know an easy way to run a search against two sources and compare all of the field values per field to see if they are the same and the file is the same? ... View more

Hi @MuS I don't want to change it for everybody- I just want to change it for a specific app (everyone in that app has the same role)- can I do that? And I didn't change anything in etc/system/local- there is nothing that talks about this view job_management.xml in my local.meta file in etc/system/metadata Anything else I should try? ... View more

I'm sorry no one helped you on this- you need to add more tags to your questions I think I always use all 5 of my available tags ... View more

@MuS I cloned the view from $SPLUNK_HOME/etc/system/default/data/ui/views/ into this location in my app "etc/apps/myapp/local/data/ui/views and then I set the permissions in etc/apps/myapp/metadata in the local.meta file And then I restarted my Splunk But my users can still access the Jobs page- am I doing something wrong in my config files? ... View more

thank you this works! ... View more

okay that makes sense- if I am pulling from two different sources who have fields with the same name- how do I distinguish them? Cause the Email used in the above function should all be from one source, but the other source used also has the field Email in it. ... View more

yes this worked thank you! But can you explain to me what the difference between " and ' is and when to use them? Because the goal of my search is to match two data sources on a field (Email for example). The one data source is where I was using this functionality above with Email and Notify address, but the other data source- the field to match on may also be named Email so whoever wrote the search referred to that field as "Email". Essentially I need to understand why you use " vs. ' vs. just the field name to make sure this doesn't mess up the rest of my search. Thanks for the help! ... View more

yes it is a token that could either be the field Email, ID,Name. So if the field to match on is Email- I need to check for any additional emails to match on that could be in the field NotifyAddress. ... View more

No I want to use the functionality of coalesce- so if Email is null- then pull in the value from Notify Address. I don't care about Notify Address if Email has a value. Do you know why this isn't working with if/case? ... View more

essentially all of these new field names are the field names of my historical data so I couldn't use tstats for any of those because they are just normal indexed data correct? So would applying my own field names at index time help my perfomance if I don't use tstats? Also- where would i specify the field names at index time/how do I do that? Thanks for the help! ... View more

@Lamar yes below is the sourcetype I applied my Field Alias to. The problem is that my panels in my dashboard are taking much longer to load. [itcc:snow] INDEXED_EXTRACTIONS = csv TRUNCATE = 50000 SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = Opened TIME_FORMAT = %Y-%m-%d %H:%M:%S FIELDALIAS-Incident Metric Table = "Assigned To" AS assigned_to "Business service" AS business_service Category AS category Closed AS closed_at "Closed By" AS closed_by "Closure code" AS close_code Company AS caller_id_company "Configuration item" AS cmdb_ci "Contact type" AS contact_type Country AS caller_id_country Email AS caller_id_email "Employee Type" AS caller_id_u_employee_type "Employee number" AS caller_id_employee_number "Incident Type" AS u_prob_type "Job Band" AS caller_id_u_job_band Knowledge AS knowledge Language AS caller_id_preferred_language Location AS location "Made SLA" AS made_sla Name AS caller_id_name Number AS number Opened AS opened_at "Opened by" AS opened_by Organization AS caller_id_u_organization "Password Last Reset" AS caller_id_u_password_last_reset Region AS caller_id_location_u_pg_region Resolved AS resolved_at "Resolved by" AS resolved_by "Service offering" AS service_offering "Service type" AS u_service_type "Short Description" AS short_description Sponsor AS caller_id_u_pg_sponsor Status AS state Subcategory AS subcategory Value AS assignment_group ... View more