Greetings, I have a query I'm working on using tstats and lookup. My lookup is named hosts_sites and has two columns, hosts and site. My sample query is below;     | tstats latest(_time) as latest where index=main by host | lookup hosts_sites hosts as host OUTPUT site | table host, site, latest     How can I make sure that my table includes non-matches. I want to make sure that hosts in the lookup that were not matched are included in the table so they can be addressed/remediated ... View more

Greetings all, I have several JSON files that were exported from a Splunk instance (using the front end GUI I believe). Would it be possible to somehow index these files into the appropriate indices, sourcetypes, and source hosts that are contained in the JSON files along with the respective fields ? I have confirmed that the files are pure JSON. Any help would be greatly appreciated Thanks ! ... View more

I seem to be having some issues working with AD event ID 4738. Unless I am doing or reading something wrong, one of the attributes clearly has a value in raw AD log yet Splunk does not seem to capture that value. Below is a screenshot of an event 4738. See the "User Account Control" field and how it shows "Account Disabled". Under this screenshot I have included another showing how Splunk displays the returned values for that attribute. I have attempted to use REX but seeing as Splunk doesn't see the value for "User Account Control" it isn't returning anything. My goal is to be able to create a table showing the source, target, the change, and time. I can populate the other columns just fine. Any help is GREATLY appreciated. ... View more

Greetings Splunk Community & Mods, I have a question about the Splunk Dev License. A little more than a year and a half ago I requested and was granted a dev license using my personal email and Splunk account but that has since expired. I recently requested a new Splunk dev license and received an email explaining that my request was denied due to an inability to verify my eligibility, has something changed ? Thanks all ! ... View more

Greetings all, Assuming I have all the appropriate logs ingested and created an alert that triggers when X criteria is met and sends an email to a distlist. Will this alert have a unique ID or tracking # that I can pull up directly in Splunk at a later time to review...or are all the alerts fire-and-forget in Splunk ? Example, if the alert is triggered and my team gets an email will the alert have something like "Alert# 4857" anywhere in the subject or body and if so will I be able to query Splunk for that alert number at a later time ? ... View more