Hello,  I get Splunk Enterprise 6-month 10gb licenses., for free home use, as I use Splunk heavily at work, and try things in my home lab first. I was on vacation for some time, and let my license lapse. This caused multiple items to stop working, primarily the search feature. I added a new license this morning, but search is still restricted.  I have tried searching to request a reset license, calling to get a reset license, and submitting a support ticket for a reset license. Because I'm on a free account, nothing will allow me to actually request a reset license.  For free personal use enterprise licenses, can anyone share how to request a reset license so I can resume searching function? ... View more

Hello;  I understand joins are expensive in Splunk. When I have a query that has two joins, which query executes first? Asking because I want the most limiting subsearch to execute, followed by a second subsearch, then the main search.  Ex.  index=app host=foo Dataquery1 | join type=inner  [ search index=app host=foo | table Dataquery2.Result1] | join type=inner  [search index=app host=foo | table Dataquery2.Result1, Dataquery3.Result1] |  table Dataquery1.Result, Dataquery2.Result1, Dataquery3.Result1 ... View more

I am trying to find missing stores from query 2 in the below script. However, it returns no results, or all results depending on the search. For the purposes of my search, I know the correct result is one. Can you please assist me in my evaluations to get what I'm seeking? I've beeing trying this for days now. host=s*0009 Type=Information EventCodeDescription="A new process has been created" New_Process_Name="D:\\Program\\Bin\\potato.exe" | dedup host | eval StoreCallEDW=substr(ComputerName,2,4) | search [ search index=mainframe host=MVSB* MFSOURCETYPE=SMF080 *CFT* DEFINE_RESOURCE="SUCCESSFUL_DEFINITION" | spath RESOURCE_NAME | search RESOURCE_NAME="EDWABP.V15.TLOG.DATA.*" | eval StoreonMainframe=substr(RESOURCE_NAME,29,4)] | table nodiff StoreEDWFile StoreonMainframe ... View more

I am trying to perform a search to return only results that are "Broke". Broke means Event 7000 with a specific Message, happened and there has not been a reboot since. If it's "fine", Event 7000 happens, but so did another event, like 1074 (ID for event starting) for instance. I'm evaluating this in the original results. However, when I search for my "fine" results, I get none returned even though there should be more than 300 results. This led me to think that my "Broke" results are not accurate, but they are. Can you please guide me on what I'm doing wrong? host = "something" source="WinEventLog:*" (EventCode=7000 AND Message="*notimportant*") | regex host="S[0-9][0-9][0-9][0-9]01[0-9][1-9]" | dedup host |eval status=if((EventCODE== 7000 AND Message=="*notimportantt*" AND EventCode==6005) OR (EventCode==7000 AND Message=="*notimportant*"), "fine", "Broke") |stats latest(status) as current_status latest(EventTime) as LastEvent by host | Where current_status=="fine" ... View more