Go to the Search Head and search with the below search (Make sure you have rights to see internal indexes data): index=_internal | dedup host | fields host | table host Look in the list to see if your Forwarder’s hostname is in the list, if it is present that means the Forwarder is connected.  ... View more

Go to the Search Head and search with the below search (Make sure you have rights to see internal indexes data): index=_internal | dedup host | fields host | table host Look in the list to see if your Forwarder’s hostname is in the list, if it is present that means the Forwarder is connected.  ... View more

Create a local Splunk user called TZ_London, login as that user and set his Time zone so that Splunk knows how to interpret Timepicker values like Today and Yesterday, etc. by clicking TZ_London -> Settings -> Time zone. Then clone the report so that TZ_London owns it and it runs as him with his Time zone setting. This way Splunk handles Daylight Savings and everything else. https://community.splunk.com/t5/Alerting/How-to-configure-alert-based-on-other-timezones/td-p/450777 Hope this helps !!!   Thanks   ... View more

Does your varlog index has necessary permissions for indexing the data.   Thanks A ... View more

You have a lookup table called "fullusernames.csv", and it contains three columns: username, first_name, and last_name. A sample row from this lookup table contains jsmith, jane, smith - so the username jsmith is mapped to a user whose full name is jane smith. You perform this search: index=web_proxy and it returns events that contain username=jsmith. You can use the lookup to find the user's full name: index=web_proxy | lookup full_user_names.csv username OUTPUTNEW first_name, last_name After the lookup, the event will contain two new fields: first_name=jane and last_name=smith. Now let's imagine you have that same lookup table, but your search returns events that contain local_user=jsmith (note the field name is now local_user, which doesn't match the field name username in your lookup. No problem, you use the AS clause to fix it: index=web_proxy | lookup full_user_names.csv username AS local_user OUTPUTNEW first_name, last_name Again, after the lookup, the event will contain two new fields: first_name=jane and last_name=smith. To make matters even more complicated, now you have the same lookup table, and your search returns events that contain local_user=jsmith, and in order to correlate your events with some other logs, you want the user's first name to be returned into a field named f_name and last name to be returned into a field named l_name. Again, no problem - you solve it with the AS clause again: index=web_proxy | lookup full_user_names.csv username AS local_user OUTPUTNEW first_name AS f_name, last_name AS l_name Now, after the lookup, the event will contain two new fields: f_name=jane and l_name=smith.   Hope this helps !!! ... View more

Put your search query and create an new event type based on your hosts and set the priority so that we will get host highlighted in your search result.  ... View more

it looks like the Splunk DB connect doesn't support temp tables, please have your entire query into an SQL view and then call the view into your Splunk App. Hope this helps. ... View more