Hi Splunkers I have 50 dashboards with each dashboard having disk metric panel, Process details, Autosys Job status, Memory Usage details, and Key word monitoring panels. Each dashboard is mapped with a 3 letter appcode. Now I want to have a master dashboard to represent status of all this 50 dashboards in a single place.  If in dashboard-1 for appcode GHI my disk panel or any other panel has a critical warning(Red Colour) the GHI appcode in my master dashboard has to turn Critical(Red Colour) as well. Similar with other panels and other dashboards.   My Master dashboard should look something like this for the appcode status     ... View more

I want to configure alerts in Splunk using REST API. How can I achieve that? I want to send email notifications for the alerts using REST API. Any help would be appreciated. Thanks ... View more

Where should we install IBM Websphere MQ Modular Input for Splunk add-on . Is it to be installed in Heavy Forwarder or Universal Forwarder..??Is there any documentation for this..?? ... View more

I have installed Splunk_TA_nix add-on on my universal forwarder to send Linux logs, What is the difference between forwarding the logs through the add-on and forwarding logs through /etc/system/local/inputs.conf.?Will both does the same thing.?Will the Splunk_TA_nix add-on extract the fields from the linux logs (/var/log/messages,/var/log/maillog) which will be CIM compatible.?  ... View more

I need to write a common regex to match all the below patterns  My regular expression written so far is  (?P<timestamp>\w+\s+\d+\s+\d+:\d+:\d+)\s+(?P<src>\w+)\s+(?P<daemon>\w+):\s+(?P<message>(.*?)$)|(?J)(?P<timestamp>\w+\s+\d+\s+\d+:\d+:\d+)\s+(?P<src>\w+)\s+(?P<daemon>\w+)\[(?P<process_id>\d+)\]:\s+(?P<entry_type>\w+):\s+(?P<service_id>\w+)\s+\w+=((?P<status>0)|(?<pid>\d+))(\s+from=(?P<origin_ip>(.*?)$)) This matches 1st and 2nd pattern in regex101.com but when I put it in splunk it doesn't work matching unintended fields. Please help how to go with this Jul 15 14:01:32 jiufc1fe330 xinetd[82352]: START: nrpe pid=151239 from=::ffff:14.956.44.41 Jul 15 12:30:36 dyue29200 systemd: Removed slice User Slice of root. Jul 15 12:30:21 dtg280419 xinetd[16211]: EXIT: nrpe status=0 pid=8924 duration=0(sec) ... View more

I have installed splunk add-on for tomcat on search head and indexer and by using Universal Forwarder I am sending my Tomcat logs to SH and indexer. I have configure my Tomcat URL under the setup page of add-on and I am able to parse the logs and extract the fields. It is good till here, now I am having multiple Tomcat servers to send the logs. How do I configure the multiple server URL's under the this setup page.? Is it meant for accepting the single URL? ... View more

We have a Tomcat running and to collect JMX logs is it mandatory to have Heavy forwarder installed.?I know we cannot install JMX add-on for UF. Is there any alternative method other than having HF installed.?and catalina,localhost,and manager logs can be collected through UF right.?correct me if I am wrong ... View more

Are there any prerequisites for installing CIM?How can I verify it is installed?Should I make configuration related changes and restart Splunk after installing CIM? ... View more