Hi, I want to restore a KVLookup from a backup system , and not from the Splunk backup. Is there a way to restore a KVLookup file in case I don't have the backup set up in Splunk? Or do I have to configure the Splunk backup to restore? If so, where is the KVLookup file that contains the data itself located (beside $SPLUNK_HOME/var/lib/splunk/kvstore that contains collection.conf and transforms.conf)? Appreciate your assistance, Thanks! ... View more

Hi, I'm trying to set a source_type for CSV files that contains headers, and the fields are extracted fine. The problem is that the data is extracted both as fields with the headers and as indexed fields like: field1, field2, etc. My question is: Is it possible to extract only the fields with the headers and not the fields field1, field2? Thanks! ... View more

Hi, Which port does Splunk use for Universal Forwarder monitoring? Thanks! ... View more