Thanks for your post. Found it after an hour of googling. Splunk Community should really deprecate answers older than a certain version or keep them separate in a historical archive to prevent the majority of their user base on newer versions from endlessly searching for relevant answers. In our case, the issue was the same as what you described (silent install of the Windows Universal Forwarder using the /quiet flag). Here's what we did: 1. Create the following text file (replace the correct path for your Splunk UF install): C:\Program Files\SplunkUniversalForwarder\etc\system\local\user-seed.conf 2. Add the following text into the file: [user_info] USERNAME = admin PASSWORD = changeme 3. Restart Splunk Fowarder service (e.g. manually within services.msc console). 4. Once the service restarts, it will remove your user-seed.conf file and put a hashed version of your password (changeme in our case) into a passwd file in the path below. We don't really need to know this anymore, but if you were ever wondering why it was missing in the first place, now you have it. C:\Program Files\SplunkUniversalForwarder\etc\passwd   5. Now you can also change your password using the previously configured password using the command line below:                 cd 'C:\Program Files\SplunkUniversalForwarder\bin'                 .\splunk edit user admin -auth admin:changeme -password <new_strong_password>     ... View more

I think the way you request is not impossible, just too much burden. In a similar cases, I had ingested all 3 ( assuming size is low) , and get rid of 2 of them in search. I can provide you a search to clear other 2. in a way requesting, I don't see it is happening with built in mechanisms of Splunk. However, if you are on windows, you can enable file monitoring in the folder, http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/MonitorfilesystemchangesonWindows From same documentation: You must enable security auditing for the file(s) or director(ies) you want Splunk Enterprise to monitor changes to When this is set, you will be able to capture file from file monitoring via Splunk search, you can pass path of the file to your script that does one of the following: if it is deployment server, it can update the inputs file resides in \deployment-apps\your_application_for_forwarder if it is a heavy forwarder that access to share, you can also set the same using Splunk REST Api. I hope it helps ... View more

Thanks for the info! ... View more

I see. Thanks for the insight. I made the changes and restarted the forwarder, and then waited for 6-8 minutes. Maybe I needed to wait longer. ... View more

Hi @mawomommoh, Check your index configuration (host and ip) in output conf of forwarder and make sure that they are reachable and not blocked by firewall or acl ... View more

I tried using the cron of 2-59/5 * * * * and -7m@m (earliest) -2m@m (latest) for the time range as you said but I still get 2 emails sent (1 email when I forward the file and then another email 5 minutes later). ... View more

Noted. Thanks! ... View more

Thanks, I've updated the answer to be more relevant. ... View more

Oh, I see. I was thinking that it would be faster because the files would not need to go a long distance as compared to a case in which they are being sent from a different location. Thanks for the explanation. Much appreciated! 🙂 ... View more

Great! Thanks for the insightful explanation. Much appreciated. 🙂 ... View more

I tried this query again this morning and it now works in the dropdown: host=XXXX sourcetype=XXXX | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source,BuildAndDate I can't really pinpoint what exactly the solution was, but before now I deleted the BuildID field in Field Extractions, and re-extracted it from the xml file. I still tested out the query above after doing this but it did not work, but it surprisingly works this morning. The dropdown now produces the BuildAndDate field values as expected, and the new dashboard is being generated when a value is selected from the dropdown. Side note: At some point I opened two tabs of the Search & Reporting app and ran the following query: host=WP3L2M6VNX1 sourcetype=SAMBAXMLTEST | eval mostRecent=strftime(_time, "%B %d, %Y %I:%M%p") | eval BuildAndDate = BuildID+" "+mostRecent | stats count by source,BuildAndDate In one of the tabs, the BuildID field did not show up in the fields area (it was also absent is the More fields area), while in the other tab, the BuildID field showed up. Both queries were ran using the same criteria (All time) & Verbose Mode. It was strange to see that the same query ran in the same app worked in one tab and not the other. It seems part of the app was not detecting the extracted field (don't know if that's possible), but I think this may be related to the dropdown issue. Thanks so much @maciep for your assistance. 🙂 I believe you helped me drilldown to the potential cause of the issue. Thanks @Sukisen1981 for the suggestion. ... View more

This works well. Thanks! The next thing is to carry out the drill down (you can see my reply to richgalloway's answer below). If you have any ideas pertaining to that, it would be much appreciated. Thanks once again. ... View more

@mawomommoh - I am also facing the same problem, were you able to resolve this issue ? ... View more

@mawomommoh - We converted @somesoni2's comment to an answer so you can accept it. ... View more

I just need to get a key:value pair of the Description and the StepResult of this portion of the file in the order they appear: <Steps> <Step xsi:type="xxx" Description="Survey" StepResult="Passed" /> <Step xsi:type="xxx" Description="Analyze survey" StepResult="Passed" /> <Step xsi:type="xxx" Description="Extract data" StepResult="Skipped" /> <Step xsi:type="xxx" Description="Analyze data" StepResult="Passed" /> <Step xsi:type="xxx" Description="Combine data from various sources" StepResult="Passed" /> <Step xsi:type="xxx" Description="Deliver results" StepResult="Failed" /> <Step xsi:type="xxx" Description="Get feedback" StepResult="Passed" /> <Step xsi:type="xxx" Description="Process feedback" StepResult="Passed" /> <Step xsi:type="xxx" Description="Make improvements" StepResult="Passed" /> </Steps> So in essence, the Description and StepResult will be field names (in a tabular form) made up of the field values appearing in the same order shown in the file. The order is determined by the Description (not alphabetically, but as in the file). ... View more

@mawomommoh, glad it worked... the initial code you posted seemed familiar... wink ... wink!!! 😉 ... View more

Thanks for the info @nickhillscpl. The data I am working with is dynamic to some extent so this may not work quite well with that. I appreciate the help. ... View more