I have a log which is tracking objects as they get moved around by a state machine. The log records a timestamp, the GUID of the object that was moved and the to and from states for the object. When the state machine moves object to state=foo, this is the beginning of the transaction I want to see. Then the object will then cycle between states foo and bar for some time. Eventually they leave state=foo and go to a state other than foo or bar. That is the end of the transaction. This is the search that I wrote. When I look at these transactions I'm not seeing what I expected. Am I doing this correctly? transaction ObjectGUID startswith(ToState=foo AND FromState!=bar) endswith(FromState=foo AND ToState!=bar) ... View more

I have a list of about 400 object GUIDs. I want to filter a log file so that I see only the entries with one of those GUIDs. Is there a way I can do this in Splunk? Thanks for the help. ... View more

I want to run Splunk on an Azure VM and use it from the browser on my desktop PC. In the Azure VM I can get to the login page at mysplunkserver:8000. However, from my desktop I cannot get to mysplunkserver:8000.cloudapp.net. I changed the Splunk web port to 80. Now I can login at mysplunkserver from the VM but I still cannot login from my desktop at mysplunkserver.cloudapp.net. Any ideas what I need to do? ... View more