Thank you fornall the posts. The issue was definitely the Ubuntu installer. I worked the .deb with the CLI just fine. It was recommended in the documentation that the splunk install not be put in root, but some of the add-ons prefer it, i.e homemonitor. If not in root I needed to change syslog port 514 to a highorder port number. Interesting details ... View more

As Google says - ... View more

With the 2.41 version on 6.6.11 I can't load the postgresql driver. with the 3.13 I can't load DB connect RPC connection OK. Some are saying it's OK with MySQL. It's look like it's spend on the driver you need. ... View more

| stats count by host is a way of getting unique hosts (since stats work better than most other resource consuming commands) another option instead of stats could have been | dedup host In my example above I had used | head 1 This one seemed to be the fastest based on your use-case as I understood. Please run Job Inspector and analyze your various search performance prior to choosing any specific approach. ... View more

hi, I tried your appendpipe solution and it didn't work. I only have one inputlookup csv called "data_file.csv". How can the following be corrected to work? index=firewall_juniper sourcetype="juniper:junos:firewall" |dedup src_ip dest_ip | lookup data_file HOST_IP as src_ip output APPLICATION_SERVICE SERVER_IP |search APPLICATION_SERVICE=$param_app$ | inputlookup data_file| appendpipe [ | eval hold=HOST_IP | eval HOST_IP=SERVER_IP | eval SERVER_IP=hold | fields-hold] | dedup HOST_IP SERVER_IP | outputlookup append=f PARITY_SERVER_IP |search APPLICATION_SERVICE=$param_app$ |table src_ip src dest_ip HOSTNAME SERVER_IP ... View more

thank you. I will try today and report the results. Your help has been very valuable and I am learning the flexibility and approach. ... View more

sample output. Trying to append the csv missing row in "pair id" 48 that is out of order and host must be referenced for different purpose pair id host name status 45 bos03 Smith Complete 45 nyc03 Jones Pending 47 bos06 Smith Pending 47 nyc06 Park Complete 48 nyc07 Smith Complete 48 *** MISSSING**** but in csv spreadsheet 49 bos08 Smith Complete 49 nyc08 Smith Pending ... View more

when you open the input to edit it in the dashboard and you click "Run Search" do you see 200+ app_names or just 55? is it because of the dedup? ... View more

If you're including host_ip=* only to get events which non-null value of host_ip, then it's not required as host_ip!=192.168.1.4 will eliminate any event which has host_ip=null. (if you use NOT host_ip=192.168.1.4 then it'll return events with host_ip=null, if any. ... View more

Heh. Two answers in one: No, it can't but you can make humans think it did. The run anywhere sample code looks like this ... | makeresults | eval george = "first one" | eval frank = "second one" | rename frank as " george" | table _time george " george" ... with the resulting output... _time george george 2017-06-18 23:07:44 first one second one You can also just change the capitalization rather than including invisible spaces in the field name. Humans will disregard the difference. ... View more

There are two different things to understand out of this... 1) Uploading a CSV file as lookup 2) Add Data These are two different functions. Add Data will actually allow you to apply a sourcetype, linebreaking, timestamp recognition etc, and then the data will get indexed into the specified index in Splunk. So this is indexing data. Uploading a CSV does not index data, apply sourcetypes, linebreaking etc. It's only applied as a lookup file. For the matter of this article, lookups are not indexed. They are knowledge objects that are available to be applied either as an autolookup per a sourcetype, or for data enrichment via the lookup command. How you would join the indexed data vs a lookup are also different. Which one is best, depends on your use case... Lookups are temporal, so they are easy to update and maintain. When you have a 'lookup' that is indexed, then you have to consider that in your searches for joining on the most recent or accurate data... ... View more

Hi dxw350, what do you mean with "the input is always the first column on the left"? In Splunk you can load a csv as a lookup or manually create a lookup using Lookup Editor App, there isn't any order or key, you can use every column as key in your searches. You have only to create a lookup (I suggest to use Lookup Editor App) and then use it. See at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources how to use lookups. Bye. Giuseppe ... View more

Hi Rich, I am back at this home monitor thing again. It is not easy because it looks like fios traffic input can only be splunked when it is a "root" How do I get my Mac PC to be the "root" and then how do I adjust my splunk settings accordingly. ... View more

Splunk does not care what port you want to monitor - it can be anything. However, Splunk may be restricted because you are running Splunk from a non-privileged account (as you should). On Linux for example, ports under 1024 are considered privileged; a non- root user cannot read these ports. This may be why you can't monitor port 80. There are ways to get around this. I am also concerned when you say "monitor port 80 for traffic." Splunk's network inputs (TCP and UDP) read data from the port and index it; is this what you mean by "monitoring"? I feel like this is not what you want. You might also want to look at the free Splunk App for Stream ... View more