I have sourcetype based definition in which I mentioned INDEXED_EXTRACTION=JSON. Under this sourcetype there are 10 sources configured. Out of 10, let us say one is not in JSON format. So how to use same sourcetype but no need to mentioned INDEXED_EXTRACTION=JSON for that particular source alone? I thought of using source:: based extraction in props with other attributes and not mentioning this INDEXED_EXTRACTION attribute. In that case will it be considered from the sourcetype declaration? ... View more

We have customer report triggered every month with multiple panels. So the requirement is during every run Panels should have a token for month and it should change automatically based on that month run and reflect the same. Also I want to pass the month name in Subject or Message as well. How to achieve this Sample Panel Name : Top 10 Customer Applications - June 2023 Sample Subject : ABC Application Monthly Revision Report - June 2023 in the above as of now am editing month manually. Need to find a way to take on its own? Is this possible. any inputs? ... View more

I am trying to define various functions for each component level. However I am having multiple Splunk environments and I wanted to split Indexer group by different region. Say I have 2 Indexers in A region and 5 in B region and 1 in C region. Apart from splunk_server_group=dmc_group_indexers can I call custom group in my REST query to fetch particular indexers in that region? Or is that possible to call via custom macro? Please throw some light on this ... View more