Hi Phil219, you can do something like this: tag::cool OR tag::uncool | stats count(eval(tag="cool")) AS cool count(eval(tag="uncool")) AS uncool count AS total to get a count of cool things, uncool things and a total count of both events. Update Just in case there is no tag::uncool you can use this search: tag::* OR NOT tag::* | stats count(eval(tag="cool")) AS cool sum(eval(if(isnull(tag), 1, 0))) AS uncool count AS total Hope this helps ... cheers, MuS ... View more

Hi michael_lee, this is not a Splunk problem, this is based on the so called privileged ports. The TCP/IP port numbers below 1024 are special in that normal users are not allowed to run servers on them. This is a security feature of your OS, in that if you connect to a service on one of these ports you can be fairly sure that you have the real thing, and not a fake which some hacker has put up for you. If you want to use the port 800 with Splunk inputs, create a new Splunk tcp input on port 1800 and use a iptables rule to route input for port 800 to the Splunk port 1800: /usr/sbin/iptables -t nat -A PREROUTING -m tcp -p tcp --dport 800 -j REDIRECT --to-ports 1800 Your Sysadmin can do this for you. Hope this helps ... cheers, MuS ... View more

Hi michael_lee, take a look at the DB connect App https://splunkbase.splunk.com/app/2686/ which enables Splunk to connect to various DB's and poll all kind of information from the DB. Hope this helps ... cheers, MuS ... View more

Hi pepper_seattle, This is hard to tell, because what if your lookup is setup as automatic lookup on a sourcetype? Then you would have to check all searches and see if they use the lookup by searching for events for this sourcetype. For example, of these searches which one makes use of a user-to-location lookup on sourcetype=bar? sourcetype=b* | table * sourcetype=foo | stats count by location index=baz | stats count by location Search 1 may return events matching the stanza, but there's no indication that it returns the location field Search 2 obviously uses the location field but can't return events matching the sourcetype Search 3 may or may not even have matching events in that index One other thing would be if all search uses inputlookup or lookup which will be much easier to tell by looking at the searches. Hope this helps ... cheers, MuS ... View more