So I have a search which produces a table like this: index=* source=/var/log/secure | table Loggedin_user, host_ip, timestamp | sort by Loggedin_user | WHERE timestamp NOT NULL | WHERE host_ip NOT NULL | append[dbxquery connection=splunkdb query=SELECT%20name%20FROM%20users]| fields - _raw, _time | rename "(001) users.name.VARCHAR" as "username" Output Loggedin_user host_ip timestamp username admin 192.168.1.10 Aug 18 09:36:08 root 192.168.1.105 Aug 18 08:58:3 admin adam test root What I'm looking to do is use the username column to verify whether the user logged in has been pre-authorized so I would have an output like such: Loggedin_user host_ip timestamp pre-authorized admin 192.168.1.1 Aug 18 yes root 192.168.1.1 Aug 18 yes user 192.168.1.1 Aug 18 no Is there a way I can go through the username column comparing each field to the whole Loggedin_user column? ... View more

Hi, I created a search which provides me with the usernames of all user which have logged on, i have another column right now which is from a database containing all the authenticated usernames. I want to check that all usernames in the first column are in the database. I tried using: eval Results=if(match(Loggedin_user,username), "yes","no" but doesnt work. I need a way to loop through the Loggedin_user column verifying that the username is in the username column. Any suggestion on how to do this? ... View more

So I have managed to create a connection to my database using DB Connect and now I want to index the data from the database. I have tried creating inputs from the Operations tab, but I haven't had any luck with this. Am I going in the right direction here? Can someone point out any straight forward steps to doing this as I've been following the documentation, but failing. ... View more

So far I have an Fowarder feeding data into my Indexer where I have a search head setup to search the indexes. If i wanted to set up a Deployment Manager to look after my indexer and search head how would i go about configuring this setup?? Im so lost and confused right now. ... View more

I am looking to configure a single search head and indexer for testing purposes, however i cant seem to find any clear documentation to help me as everything seems to be related to clusters. How do i go about configuring single instances? What do i use a master_uri? ... View more

Hi, I'm trying to forward /var/log/anaconda/syslog from my linux machine to my splunk indexer, but it's not coming through for some reason. I have the following configurations: inputs.conf - on indexer machine [monitor:///var/log/anaconda/syslog] index=syslog disabled=false sourcetype = syslog props.conf [monitor::/var/log/anaconda/syslog sourcetype=syslog index=syslog crcSalt=<SOURCE> Can anyone suggest anything wrong with my configuration?? ... View more

I am trying to set up searchable scripts however when i am on my indexer and go to add data and select forwarders it says no There are currently no forwarders configured as deployment clients to this instance. However im currently monitoring log files from my indexer on my forwarder. Can anyone suggest a reason why this is doing this? Or is there another way to run a script of my linux machine and get the output in splunk on my indexer thanks for any help steve. ... View more

I'm struggling to understand how I would get the output of a linux command such as vmstat or iostat into splunk where i can use the output to create a time graph. Can someone point me in the right direction at all? Thanks Steve. ... View more