Hi, I have a little bit of experience working with Splunk in a Windows environment. I have been tasked with identifying what the product can do it in a Linux Environment. A cursory search revealed 3 apps/add-ons: 1) Splunk App for Unix and Linux 2) Splunk Add on for Unix and Linux 3) NMON Performance Monitor for Unix and Linux Systems I also have very little practical experience with Linux. Could you tell me which I might want to use with Splunk? My audience wants to know the potential of Splunk to monitor Linux systems in terms of Dashboards and I don't know where to start. I have one Ubuntu Linux VM to play with. Thanks!! ... View more

Hi, I'd like to have Splunk display only matching names from my .csv data source which has 2 fields. I'd like to display only the names that are common from either field. This is what I have and I am lost after this: source="some.csv" host="somehost" sourcetype="csv" | I guess that the fields command might help, but I don't know where to begin. So you understand what I am trying to do, I have a relative who is related to a bunch of people. Field A shows all the people she is related to. Field B is a list of all of my relatives. Whatever relative names match will help us find the common tie. Thank you very much in advance!! ... View more

Hi, I need to be able to change the _time column header to something else instead of just saying _time (I guess that you call it field?) I have been trying to change it, but when I do I end up with missing data below the _time header or it reverts to a timestamp that isn't useable to the average human . I know that you all might want to alter the existing search, but I am not permitted to change the search very much at all for reasons beyond the scope of this post. Here is what I have: somecoolmacro sourcetype="123_blabla" | rex field=source "someplace\(?[\w\s-]*)" | dedup temp | table temp _time | rename temp as "Date of what I need to know" | fieldformat _time = strftime(_time, "%b %d, %Y") Thanks in advance!! P.S. The first part of the search was intended to be accent grave then somecoolmacro then accent grave I am not sure why it did that. ... View more

Hello, I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out. Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report? Thanks! ... View more