Hi Community, can someone please help me by using stats instead of join for this search? | rest /services/authentication/users splunk_server=local | search type=SAML | fields title | rename title AS User | search [| inputlookup 12k_line.csv | fields User ] | join type=inner User [| rest /servicesNS/-/-/directory | fields author | dedup author | sort author | rename author AS User ] ... View more

Hi community, When using datamodels, is it possible to remove/exclude the portion of the autoextractSearch: | search (index=* OR index=_*)  ... View more

Hi Community! I'm hoping someone can set my head straight.  I have two app inputs. One that I push to all *NIX servers (Splunk_TA_nix), and one additional app that I want to push to one specific server, serverXX (Splunk_TA_nix_serverXX_inputs). For serverXX, I want it to have an additional blacklist entry to exclude all files named /var/log/syslog/XYZ.* Splunk_TA_nix/local/inputs.conf    (other stanzas exist but have been removed for this example) [monitor:///var/log] whitelist = kern*|syslog$ blacklist=(lastlog|cron|FILES.*$) disabled = 0 index = nix sourcetype = syslog Splunk_TA_nix_serverXX_inputs/local/inputs.conf    (the app just contains this stanza) [monitor:///var/log] whitelist = kern*|syslog$ blacklist=(lastlog|cron|FILES.*$|XYZ\.) disabled = 0 index = nix sourcetype = syslog I tried this method of pushing the 2 apps to serverXX, and btool is showing that it's picking up the blacklist from the Splunk_TA_nix (not the one with the XYZ), so I guess I'm doing this all wrong! What should be the correct way to exclude XYZ files for only serverXX while deploying to all *NIX hosts?     ... View more

Hi Community, Does anyone know if the 14 day Splunk Cloud Platform Trial allows you to create multiple users and roles?  I need to test some capabilities. Thank you. ... View more

Hi Community, I have a inputs.conf monitor that looks like this [monitor:///var/log/logfiles/.../app.log] index=englogs sourcetype=eng:custom The above monitor will cover these paths to the app.log files /var/log/logfiles/database/eng/comm/surface/app.log /var/log/logfiles/trunk/sec/comm/water/app.log /var/log/logfiles/other/fin/app.log And many, many more... I have a file that I want to sourcetype as access_combined (not eng:custom). /var/log/logfiles/scapes/web01/app.log This path falls within the scope of the above monitored stanza. What is the best way to accomplish this? Do I use a blacklist in the .../app.log eng:custom monitor and then create another monitor stanza for the web01/app.log access_combined that immediately follows this? Thank you ... View more

Hi community, I want to hide an add-on from users navigation bar but want them to be able to use (not modify) the knowledge objects. Do I hide the add-on and grant everyone read permissions to the add-on? I have seen that sometimes un-hiding/hiding an add-on asks for a restart of splunk. Why does this happen? It is not easy for us get ok to randomly restart splunk. ... View more

Hi. Please I need some help. Different devices, all with different port numbers. How to create a single search that will use lookup table to check multiple devices and different portid with notes? device,portid,notes device1,2,cube1 device1,4,cube7 device1,6,cube8 device2,5,cube3 device2,6,cube2 device3,1,cube6 device3,5,cube9 device3,7,cube4 This is a search for one device (device1) and it's ports. But now I have many more devices all with different ports. index=myindex device=device1 type=port speed=1Gfdx state=down | where in(portid,2,4,6) | table device, portid, state Thank you. Hank ... View more