Thank you, very appreciated! ... View more

To solve this, I append the timestamp (day and month) with a script before index it. ... View more

Hi @cboonyan , Try include predefined tokens in your report without use options form. Token $search$ contains the search. Find more info and full token list on doc: http://docs.splunk.com/Documentation/Splunk/7.1.2/AdvancedDev/ModAlertsLog Greetings. jvardev. ... View more

Very useful facts about tstats. Thank you. ... View more

Hi zongwei, You can catch the field what you want. Use predefined tokens like $click.<field_name>$ to take'em. If you want catch a value from field named foo , declare in your timechart drilldown tag. The same name field for you chart overlay in your case. <drilldown> <set token="clickedFooValueToken">$row.foo$</set> </drilldown> Token clickedFooValueToken will content the value from clicked field foo You can find more info: http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/ContextualDrilldown http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/tokens Greetings. jvardev. ... View more

I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time ... View more

yes, is delimited by pipes and I have the name fields name1|name2|... value1|value2|.... ... View more

You can index it, but wont see nothing at search time. I have imported a file with header and without data with Splunk Enterprise 7.0.3. ... View more

Hi. I'm not sure if you can make this at index time, but can you create a script to treat logs before index them? ... View more