I have a business need to monitor 0 kb files. I can get this to work using fschange, however with fschange being deprecated in 5.x this is not a viable option. I would prefer using monitor rather than a script, and only want to index new files, with the system time being used as timestamp (DATETIME_CONFIG=CURRENT). Any ideas? ... View more

I have several dashboards that I use the Sideview Utils Pulldown module on. The pulldowns grab a list of industries and customers out of our customer data, and then pass these values on to downstream searches. This works all without a problem, however when the Pulldowns are populated, they kick off the downstream searches automatically, causing all downstream searches to display data for All customers on page load. What I want them to do is load the pulldown values on page load, but not autoRun the searches downstream -- I want a submit button or similar so I can first select my desired pulldown combination before kicking off the downstream searches. I have tried SubmitButton and different autoRun=true/false combinations to no avail. Dashboard code: <view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False"> <label>My label</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.error</param> <param name="maxSize">1</param> <param name="clearOnJobDispatch">False</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="Search" layoutPanel="panel_row1_col1" group="" autoRun="true"> <param name="search">| inputlookup host_customer_lookup | where host!="" | dedup industry | fields industry</param> <param name="earliest">-60d@d</param> <param name="latest">now</param> <module name="Pulldown"> <param name="searchFieldsToDisplay"> <list> <param name="value">industry</param> <param name="label">Industry</param> </list> </param> <param name="name">selectedIndustry</param> <param name="label">Industry</param> <module name="Search" layoutPanel="panel_row1_col1" group="" autoRun="true"> <param name="search">| inputlookup host_customer_lookup | where host!="" | search industry="$selectedIndustry$" | dedup customer | fields customer</param> <param name="earliest">-60d@d</param> <param name="latest">now</param> <module name="Pulldown"> <param name="searchFieldsToDisplay"> <list> <param name="value">customer</param> <param name="label">Customer</param> </list> </param> <param name="name">selectedCustomer</param> <param name="label">Customer</param> <module name="TimeRangePicker"> <param name="default">-60d@d</param> <module name="Search" layoutPanel="panel_row2_col1" group="" autoRun="false"> <param name="search">some search industry="$selectedIndustry$" customer="$selectedCustomer$" | timechart avg(somevalue) by customer</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="legend.placement">right</param> <param name="chart.nullValueMode">zero</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Hours Mined</param> <module name="JSChart"> <param name="width">100%</param> </module> </module> </module> </module> <!-- end timepicker--> <module name="Search" layoutPanel="panel_row3_col1" group="" autoRun="false"> <param name="search">some otgher search industry="$selectedIndustry$" customer="$selectedCustomer$" </param> <module name="SimpleResultsTable"> <param name="count">30</param> <param name="displayRowNumbers">False</param> <param name="drilldown">none</param> </module> </module> </module> </module> </module> </module> </view> ... View more