Hello, I have a problem about Data Input that is uploaded from my computer. I upload a CSV file and index the file into "indexFoo2". When I complete the "add data" stage, I can search and reach the CSV data in "indexFoo2". However, if I use the search below, all the CSV data is removed from "indexFoo2". How to overcome this issue? index="indexFoo1" | rex field=_raw "(?\S+)"|rex field=_raw "(\S(?\S+))\S+"|eval Foo2=upper(Foo2) | eval Foo2=replace(Foo2, "\.", "") |eval Foo3=Foo3x|fields Foo1,Foo3,Foo2| join type=left Foo3[search index="indexFoo2" |eval Foo3 =Foo3y|fields Foo1,Foo3,Foo2,Foo4]| eval Time=strftime(_time, "%H:%M:%S %d/%m/%y")| join type=left Foo2 [search "indexFoo3" earliest=-30d | eval Foo2=upper('Foo2x') | stats count by Foo2|fields Foo1,Foo3,Foo2,Foo4 ]| eval Foo2=tostring(Foo2)| eval Foo2 = substr(Foo2,0,2).":".substr(Foo2,3,2).":".substr(Foo2,5,2).":".substr(Foo2,7,2).":".substr(Foo2,9,2).":".substr(Foo2,11,2)| search NOT count>0| table Foo3,Foo1,Foo4,Foo2 ... View more

We experienced an issue regarding connecting splunk with mssql databases. When we try to add a mssql database, the external database adding page gets irresponsive and gives a message at the top of this page like "splunk server may be down". Do we have to have a mixed account to be able to connect to an external MSSQL database? ... View more