Hi @Ephrem32, could you share the content of you aliases? you should have: BROWSER AS browser REFERRER AS referrer  REQ AS req REQ_ID AS req_id SRC AS src You can find them in [Settings -- Fields -- Aliases] Ciao. Giuseppe ... View more

Hi @Ephrem32 .. as other reply said, Splunk UBA is a Premium Solution. we got no other free apps/solution which can do the same job of UBA.  the Splunk Training portal got around 5 free courses, in which one course is about UBA. that training will give you more ideas about UBA and its features.  https://education.splunk.com/catalog For your first question, by the "build", i assume you are referring to "open source" tools build/compile/install from the source code. As Splunk itself is a paid tool, we can not get its source code and build it. we can get only executable files, which will only "install"(no build/complie, etc) ... View more

Hi @Ephrem32 ... >>> Can you elaborate your steps regarding  "use another UF with ipv6, let the UF send logs to the dev/test splunk, once these things are done, you will get comfortable with ipv6. Then you can deploy ipv6 for big/full environment" <<< This is a big task.. this is a full Splunk Design and implementation project.  from the Splunk documentation, you should check the UF installation, "getting data in", etc..  Particularly, as this is a ipv6 stuff, you will face some challenges, for sure.  when you go thru each stage, if you are struck at somewhere, you can question here. thanks.  Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated!   ... View more

Check out the mvexpand command. ... View more