If a DHCP is assigning IP address to your Splunk server, do not go for this.  You will also need to add the following line to /etc/system/local/web.conf  [settings] mgmtHostPort = 10.10.x.x:8089 _______________________________________________________________ Otherwise, splunk default stanza (below) will look for splunkd at its loopback address.  /opt/splunk/etc/system/default/web.conf mgmtHostPort = 127.0.0.1:8089 ... View more

Oh, you just rename the field, easy. System=Shark | head 1 | table Pid | rename Pid as ParentPid ... View more

Thanks for the reply. When I click the create dropdown button I don't get the option to create an alert. I'm gathering that means it has been locked down by an administrator? ... View more