Ok, found it: https://www.splunk.com/page/previous_releases#x86_64linux ... View more

One tip: I nearly always use a view when I get into a SQL Query this complex. Create your view that does all your joins and any field cast/convert or formatting you need, then use DB connect to just SELECT ... FROM vw_MyViewName . For your specific problem, you seem to have the record id in there ( SELECT AdditionDate, DLAuditLog.RecordId AS record_ID, DLUsers.UserName ... but it's named differently. You should be able to treat it exactly the same as your test: ... INNER JOIN DLShadowFiles ON DLShadowFiles.ShadowId = DLShadowFiles_Users.ShadowId WHERE record_id > ? ORDER BY RecordId,compID_2,NetworkAddr,userID_2 ... NOTE I don't know what DB you are using so I don't know if you need record_id or DLAuditLog.RecordId in there (e.g. I don't know if your DBMS allows aliases there or not). If that doesn't get you sorted out, the next steps are to run the SQL query in whatever your DMBS uses as a console and get it working the way you want first. Once working you could create a view out of it or even just paste it into Splunk and add the one little line for your WHERE clause. Happy Splunking! -Rich ... View more

little update. After connect to db i go to Operation, create new DB inputs and open Advanced input type and in first line use this command: OPEN SYMMETRIC KEY DLKey DECRYPTION BY CERTIFICATE DLCertificate ... View more

Probably have found the answer in this post - http://answers.splunk.com/answers/28217/ssl-on-universal-heavy-and-splunk-server.html ... View more

Hello, colleagues! Found simply irreplaceable application and creat a sourcetype. Called - Universal Field Extractor ... View more

You could check the metrics logs. index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series ... View more