You might want to check out Asset Discovery app.  https://splunkbase.splunk.com/app/662/  Allows for monitoring assets status, and can scan subnets etc. loggin the status in to Splunk so that you can alert on things or review them.  ... View more

| inputlookup filename.csv | stats count BY "Field Name" | sort 0 - count | rename "Field Name" AS field_value | eval field_name = field_value . "(" count . ")" has some eval error. I removed | eval field_name = field_value . "(" count . ")" and it seems to be working now. Go figure? ... View more

I also adjusted the search to include returned results that did not have any spaces, or the / . Still nada ... View more

<label>Field Filter</label> <fieldForLabel>fieldfilter</fieldForLabel> <fieldForValue>fieldfilter</fieldForValue> <search> <query>| inputlookup fielddata.csv | fields "Field Name" | dedup "Field Name" </query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <choice value="*">ALL</choice> <default>*</default> <initialValue>*</initialValue> </input> I've tried "all time" for earliest I verified that both the dashboard and lookup are in search and the lookup has everyone read. Hoping this posts with the xml ... View more