Hi, I have been storing two types of log in the same directory. One is ANSI, another is Unicode. I use different definition of file name to distinguish like xxA.csv and xxW.csv. I would like to let the directory as a input and index both of the types. I could use whitelist attributes in inputs.conf to separate them into two sourcetypes. But I cannot figure out how to the merge the following stanzas into one. [monitor://C:\myLog] disabled = false followTail = 0 index = main whitelist = W\.csv sourcetype = myutf16 [monitor://C:\myLog] disabled = false followTail = 0 index = main whitelist = A\.csv sourcetype = myansi Does anyone know how to do this? Thank you! ... View more

According to the Release Note, version of Python in Splunk 5 is 2.7.3. Reference: http://docs.splunk.com/Documentation/Splunk/5.0.2/ReleaseNotes/Python But in Python 2.7.3 downloaded from python.org, msvcr90.dll has been included, not msvcr80.dll. I have tried to use third-part library "pyodbc for Python 2.7" to access MS SQL Server, the library works in Python 2.7.3. In Splunk 5, it does not work since it depends on msvcr90.dll. I still have no idea to use pyodbc in Splunk 5. Can someone help me? ... View more

I have a MS SQL Server that manages some applications' log. I want to transport the log to a Splunk instance. Does the universal forwarder have the ability to do that via just installing it on the machine? Or I have to create my own scripted input to access the SQL Server? Help me please. ... View more

Hi, I have two questions about the dynamic drilldown. Firstly, I tried to pass some Japanese characters in to another views. But the characters were encoded in UTF-16 and the target view cannot work correctly. I have tried ViewRedirector module in Advance XML and I found ViewRedirector module encodes the same character in UTF-8 and it works. Would you give me some ideas on encoding. Secondly, how to popup the target view? <dashboard> <row> <table> <searchString> sourcetype=mylog username="ユ" | table username </searchString> <title>Table Drilldown</title> <drilldown> <link> /app/myApp/newView?q=search username=$row.username$ </link> </drilldown> </table> </row> </dashboard> UTF-16 of ユ： %u30E6 (NG) UTF-8 of ユ：%E3%83%A6 (OK) ... View more

In UI Examples App's Drilldown views-Main, there is a row titled "Custom wiring: using the click arguments in other ways entirely". When I click the left chart to drill down it, the result should be shown in the right chart. But only the title appears. I have tried to replace block with , the table can be shown correctly. Could you give me some ideas to fix it or tell me that is a bug? ... View more

In the "UI Examples" App, the following comment can usually be found. <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> In the next search command, what is the first search clause? index=_internal source=*metrics.log | chart sum(kb) by series | sort -sum(kb) | search series=audit* ... View more