Hi guys, I'm using a Universal Forwarder in a remote location (different network) to try and get data into my Splunk instance. Both machines are Windows.  The necessary firewall rules are in place and the Universal Forwarder logs show that the UF is connected to my server. However, when I look at the logs on my Splunk server, I can see the 800706BA error 'The RPC server is unavailable'  How might I solve this problem? Both networks are independent of one another, so I'm not sure if this is an authentication issue or not. Any tips of one the next steps might be would be great appreciated. Many thanks! ... View more

Hi guys, I'd like to be able to allow 'insecure' logins for my dashboards to be used with an internal signage solution. I have changed the value of  'enable_insecure_login = False' to 'True' within var\run\splunk\merged\web.conf. I can save, close, then reopen the file and the value is still set as 'True'. HOWEVER... If I restart my Splunk server (to pick up the new change), the value reverts back to 'False' and I'm unable to access the dashboard using the insecure URL. Does anyone know why the 'web.conf' file may reset the change I made after a restart? Thanks for your help! Best wishes, D ... View more

Hi everyone, I'd be eternally grateful if someone could help point me in the right direction here. I'm trying to output a table with merged results from two different indexes.  There are two events: Index A:   time="12th April, 19:07:32", name="Bob", ip="192.168.0.45", searched="how do I tie my laces", mac="00:1B:44:11:3A:B7"   Index B:   the_time="12-04-20-190702", username="Bob", ipaddress="192.168.0.45", location="Home", macaddress="00:1B:44:11:3A:B7"   As you can see in both indexes there are common fields - IP address and MAC address, however the timestamps differ slightly.  I would like to output a table that contained all of the fields e.g. Time, Name, IP address, Searched, Location, MAC Address however I'm not entirely sure how I would construct the search.  Is there a way that I can make the table work even though the timestamp is out slightly? Any help would be amazing, thank you! Best wishes, D     ... View more

Hi guys, I'm having trouble making a simple subtraction (well, I thought it would be simple!). Field1 is a number in string format, Field2 is a count of events. What am I doing wrong? index=index_name | convert num(Field1) as Field1Total | stats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference Thanks for your help! ... View more

Apologies if the title of the question is a bit vague! I have search that is creating a table based on events that contain a word in a lookup CSV file. This works well, however I'm trying to prevent 'words within words' appearing in the output. For example, if my lookup file contains the word 'kill', I do no want to see the word 'skills' in my results. The field name in the CSV is 'HighRiskWords'. Here's what Im working with so far: index=web_filter [| inputlookup highriskwords.csv | eval HighRiskWords="*"+HighRiskWords+"*" | rename HighRiskWords as web_HighRisk] If I use: eval HighRiskWords=HighRiskWords I get results that offer an exact match. If I use eval HighRiskWords=""+HighRiskWords+"*"* I get all matches plus any other text string surrounding the matching word, e.g: skills. It would be wonderful to put a space in at the end of the eval command like: eval HighRiskWords=HighRiskWords+" " however this does not work. Would anyone be able to show me how to add a space to the end of the lookup field so that I do not get 'word within words'. I want to see results like: 'biggest kill' or 'kill time', not 'top 10 skills'. Hopefully that makes sense! Thanks for your help! ... View more

Hi all, I have a search that filters results based on a lookup file. Is there a simple way that I can add the match from the lookup file to the table/results? index=web[| inputlookup HighRiskWords.csv | eval HighRiskWords="*"+HighRiskWords+"*" | rename HighRiskWords as web_Search] | stats count by web_Search, web_User, _time It would be great to have the final piece of the search to be: Web_Search, {web_MatchingLookup}, web_user, _time Thanks! ... View more

Hi all, I have a CSV file that contains 8 columns and 3 of the row entries contain time/date fields. Two are not appearing in the raw event data within Splunk. (I'm using RegEx to create fields and my RegEx no longer works because the data is missing from each event). Example row from CSV file: 12-20-2019 09:16, text1, text2, 01-03-2020 14:09, text3, text4, text5, 01-03-2020 14:09 What I see in raw Splunk Event data: text1, text2, ****01-03-2020 14:09**,** text3, text4, text5 The first date/time field, although missing from raw data, is being used to set the event time. The second entry is there. The third entry has been removed completely. Could anyone please offer an explanation as to why two of the fields are missing when indexed? Thanks for your help! [Splunk version: 8.0.0] EDIT: Here's a screenshot of the raw data in Splunk. As you can see, the last column has been removed upon being indexed but exists in the CSV file. However today, for some reason, the first column is now being indexed again! I'm very confused! ... View more