I have a file: racf_username.csv located in /opt/splunk/etc/system/lookups which looks like; racf,username A123456,A Name B123456, Another Name . . As regards permissions, the table is updated nightly from a server and shows No Owner and the app being System. Everyone can read but only admin can write. In transforms.conf located in /opt/splunk/etc/system/local is the following: [racf_username] filename=racf_username.csv max_matches=1 min_matches=1 default_match=Unknown In props.conf located in /opt/splunk/etc/system/local is the following: [sourcetype::MySourceType] LOOKUP_racftousernames = racf_username racf OUTPUT username However, a simple search such as: sourcetype="MySourceType" | table racf, username does not display any usernames If instead I use: sourcetype="MySourceType" | lookup racf_username racf OUTPUT username | table racf, username then everything works fine. I just don't get the automatically filled in username field. Any idea how to get this to work automatically? ... View more

I would like to create a table similar to the following: Of Reports Created Users % >10 23 3 10 4 1 9 3 0 8 3 0 . . . 1 433 57 The search is only: sourcetype="xyz" host=MA* Mthd="CreateReport" So, want to know how many users created 1 report, 2 reports, ...., 10 reports, and more than 10. ... View more

What is the best way to index a file (user application file) or two for a one time analysis? Should I create a new index, use a new source type, copy the file(s) into a directory on the server and then use the Web based data upload? Then just delete everything afterwards? ... View more

I can't seem to find any correct syntax to extract data between two strings when attempting to do it in a search string within a form. There must be some special syntax. Is mode=sed required for some reason? ... View more

Can the same data returned from a search be used to populate both a table and a graph? ... View more

I have an odd situation where the "endswith" transaction is not always being written out by the application so that it can later be paired up with the "startswith" transaction. That means that a given "startswith" transaction is being married up with the wrong unhandled exception. I can get around the problem if I can read the data backwards. That way I could ensure that I would create a correct transaction with an "endswith" and "startswith" pair. This pair would be ignored and what would be left would be an unhandled exception paired with the correct beginning of the transaction. To do this I need to be able to read the data backwards. Can this be done? ... View more

I have a form with date, chart, table and event data, with each passing data to the next. How do I clear the screen of old values when the user selects a new date? At the moment, the old chart values remain as well as the old table and event data. If the user selects a new date, the chart will refresh, but the table and event data will still display data from the previous search. ... View more