In the first panel of a dashboard, a user can click on a host to get more panels to display. One such panel depends on if row.host contains a string. The panel I want depends on $disk$. <condition> <set token="host">$row.host$</set> </condition> <condition match="'row.host == &quot;exch-mail*&quot;"> <set token="disk">true</set> </condition> but the panel depending on $disk$ is not working. All the other panels are fine but they are using $host$. ... View more

I need to whitelist files that contain a string in any case and in any place in the filename. And, they can either be .txt or .csv. For example.....any file that contains the string "termite" termite.txt or termite.csv or TERMite.txt or october_termite_file01.csv I got "/termite/gmi" from regex 101 but does not seem to work in inputs.conf whitelist. ... View more

I created a barebones app on the deployer, copied it to shcluster/apps directory and pushed it to the 6 nodes of our SHC. Then, I configured the app from within the SHC with saved searches, dashboards, setup the NAV bar the way I wanted, etc. Same thing I have done many many times. A second push from the deployer seems to reset this app back to barbones. All the previous configuration is gone. This happened twice. Configured the app and it gets reset back to barebones after another push from the deployer. splunk enterprise version 7.0.2 ... View more

the Netflow Analytics for splunk app does not seem to be replicating config accross the SHC. I have to go to each SH in the cluster to "enable" the app from the settings page. Also, some configuration changes I made to the visualizations dont seem to be replicating to the other SH's. I dont see any reference to search head clustering in the Netflow docs either. Is this expected behavior? app version 3.7.81 splunk version 7.0.2 ... View more