I've got a CSV file with four columns, something similar to below: dc_index,dc_name,dc_snow,dc_int,dc_int_speed dc_anchorage,Anchorage,APG ANC *,41544000 dc_albany,Albany,APG ALB *,31544000 dc_albuquerque,Albuquerque,APG ALQ *,153072000 dc_altoona,Altoona,APG ALT *,31544000 dc_atlanta,Atlanta,APG ATL *,103072000 dc_billings,Billings,APG BIL *,111536000 I'm looking for a way to capture the values of all columns when a single row is selected. For example, say on the form I have a dropdown for "dc_name". When Anchorage is selected, I need it as well as the other three columns to be captured in tokens and passed on to charts within the form. I've got it working with multiple dropdowns on the form. When you choose the first option it does an inputlookup and the other inputs are populated with the values of the row, however I don't want 4 separate dropdowns on the form. Is there a way to accomplish this? This is what I have today, but my preference would be to have just two dropdowns; a time picker and DC Name. <form> <label>DC View</label> <fieldset submitButton="false" autoRun="true"> <input type="time" searchWhenChanged="true"> <label>Choose time range:</label> <default> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> </default> </input> <input type="dropdown" searchWhenChanged="true" token="dc_index"> <label>Choose DC:</label> <selectFirstChoice>false</selectFirstChoice> <populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="dc_name" fieldForValue="dc_index"> <![CDATA[ | inputlookup dc_info.csv | table dc_index dc_name]]> </populatingSearch> <change> <unset token="form.dc_snow"></unset> <unset token="dc_snow"></unset> </change> </input> <input type="dropdown" searchWhenChanged="true" token="dc_snow"> <label>DC SNOW ID:</label> <selectFirstChoice>true</selectFirstChoice> <populatingSearch earliest="0" latest="now" fieldForLabel="dc_snow" fieldForValue="dc_snow"> <![CDATA[ | inputlookup dc_info.csv | search dc_index="$dc_index$" | table dc_snow]]> </populatingSearch> </input> </fieldset> ... View more

We are preparing to roll out the Universal Forwarder to a pilot group of 50 Solaris servers before deploying to the entire 6000 server environment. During testing of our installation script, we're running into a problem where Splunk is prompting for credentials when trying to start the service: Starting splunk server daemon (splunkd)... Done Init script installed at /etc/init.d/splunk. Init script is configured to run at boot. Splunk username: We can manually enter the default Splunk credentials (admin/changeme) and it will start, however this defeats the purpose of an automated rollout. We've installed as root but this may change in the actual deployment. The script runs through the installation steps in the following order: /usr/splunkforwarder/bin/splunk start --accept-license --no-prompt --answer-yes * */usr/splunkforwarder/bin/splunk enable boot-start /usr/splunkforwarder/bin/splunk set deploy-poll splunk-ds.xyz.net:8089 Can anyone tell me if this is the default behavior of the UF on Solaris, or if we've done something wrong with the install? ... View more