I have an app that configures data inputs with columns for "Name" and "Destination".  Once there is data in the sourcetype is it possible to know which "Name" it belongs to?  Hope that makes sense.   Thanks! David ... View more

Hello,    I am trying to figure out which Role Capability controls being able to use a lookup in a query.  If I select all the capabilities then the role certainly can query a lookup.  However if I select only the capabilities that I want the role to have, they lose the ability to query the lookup.  Looking at the documentation (https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/Rolesandcapabilities) it does not specify which capability allows for the querying of a lookup. Thanks! David ... View more

I have a csv lookup that has a column with numerical data (specifically integers).  When I do the lookup, splunk is treating it as string data.  For example if I use this column to sort the numbers 1,2,3,10,11 it sorts as 1,10,11,2,3. Any help is appreciated. ... View more

My Splunk Infrastructure is ALL Windows.  And every Server/Workstation is windows with the exception of one Server which is Linux.  I was able to deploy the universal forwarder to the Linux Server and I have began receiving data at my Splunk Indexer.  My question is:   Is there an app similar to the App for Windows Infrastructure with built in dashboards for Linux that I can install on my Indexer/Search head (Which is windows)?   Thanks! ... View more

Hello, I have a file monitor for a log file where I am getting indexed data with multiple lines. Example of one event: 2019-12-30 09:16:41:908: Requestor: IMM_Mobile, IsLocal: False 2019-12-30 09:16:41:908: 637132942019089151: Scanned CID: BARCODE: Now i notice that it is the same time but they should still be separate events. i have read where someone suggested SHOULD_LINEMERGE = false, however if I am reading the documentation correctly, the SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true being the defaults should be processing the above as two separate events. What am I misunderstanding? I am hesitant to configure SHOULD_LINEMERGE = false because I think it may be needed for other events that span multiple lines. only other thing I can think of is possibly my props/transforms might be screwing with the data in some other way. Below are what I think are the relevant portions of my props/transforms: Props: [mySourceType] TRANSFORMS-set= setnull,setparsing TRANSFORMS-sourcetype= setNewSourceType Transforms: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = \b(?:offline|online|\d{4}-d{2}-d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}:\s+\d{18}:\s)\b DESK_KEY = queue FORMAT = indexQueue [setNewSourceType] REGEX = \b(\d{4}-d{2}-d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}:\s+\d{18}:\s) FORMAT = sourcetype::NewSourceType DEST_KEY = MetaData:Sourcetype Thanks for any assistance! David ... View more

Hello, I have a sourcetype which has data telling me if something goes offline and then when it comes online. I am trying to write a search that only shows the most recent offline event where a newer online event has not yet occurred. Any help is appreciated! ... View more