Hi, I am trying to figure out how to create an alert when a specific user appears in the output of the lastlog.sh script. The output is a nicely formatted table as follows: Username From Latest user1 1.1.1.1 fri Mar 4 2:20   I am new to splunk, I cannot figure out how I would create a query that would model something like an object where I can loop through everything under the username column and then do a lookup to see if user1 exists. Any help would be appreciated, the ultimate goal is for the query to show if "user1" appears in the output of: host=our_server sourcetype=lastlog any links to documentation for this would be helpful too  ... View more

Hi, Splunk noob here. I cannot get a deployment client to show up in deployment server. turned DEBUG on splunkd.log and can see that it communicates with the deployment server: DEBUG DC:DeploymentClient - channel=deploymentServer/phoneHome/default Success sending phonehome to DS. I have ran tcpdump on the client and it makes a tcp connection to DS, goes through the TLS handshake fine, and then 30 seconds later, client send a FIN and then RST to the deployment server. I get this freaking thing all the time, which I have googled of course, and the provided answer is worthless: https://community.splunk.com/t5/Monitoring-Splunk/What-does-this-error-message-mean-quot-something-needs-splunkd/m-p/230714 ./splunk display deploy-client Deployment Client is enabled. This command [GET /services/messages/restart_required/] needs splunkd to be up, and splunkd is down.   Are these the normal splunk processes? splunk 7682 1 0 12:47 ? 00:00:08 splunkd -p 8089 restart splunk 7683 7682 0 12:47 ? 00:00:00 [splunkd pid=7682] splunkd -p 8089 restart [process-runner] Any ideas? @gcusello  ... View more

Good Morning, I wanted to ask about something I have read somewhere, but not entirely sure. I am a beginner in Splunk architecture. If our architecture uses a deployment server for configuration of universal forwarders and deployment of apps, what happens if the deployment server is decommissioned (or goes down)? will the universal forwarders lose their configuration? or nothing happens if the deployment server is "removed" from the architecture ... View more