Hello, I've been trying to figure out the most efficient way to do this and a bit unclear on ingest-time vs automatic lookups or another way of this this.  This is a simple and probably a common use case: Events are coming in with event_id code which is not friendly user.  I want to do a lookup at index time against the event_id code (integer) and add a field called event_id_desc with what that code resolves to in a lookup (e.g. event_id: 5, event_id_desc: user login).  What is the most efficient way of doing this?  There are 1500 static codes in the csv. Thanks!     ... View more

Are subscription and perpetual licenses compatible i.e. can the live on the same license server? Also, is it possible to for an indexer to pull from 2 difference license servers?  This is the scenario.  There is a large pool of indexes drawing from a subscription license.  Our team wants to use the Splunk infrastructure with our own legacy perpetual license.  What is the best way to do it without spinning up a new environment?  Thanks ... View more

Hello, Looking for some advice on a popular topping of non reporting hosts.  Perhaps someone already came across something like this, or has a better way of doing it.  We have device pairs that report differently, and I am looking for a way to alert if a device stops reporting based on expected reporting  cadence for a particular device.  For example, have a CSV with device name/IP and a column for the expected reporting threshold that can be used to generate an alert if it is exceeded. Example: FW1-primary, 2m FW1-secondary, 4h So the search can look at the second column, and if it's been more than 4 hours since FW1-secondary sent an event, an alert can be generated.  TIA!     ... View more

Hi, We are centralizing and collecting logs from various devices via syslog-ng, and sending them to indexers via universal forwarder on the same box. The issue I am running into is that some devices in Asia and other places are on local time zones, so logs are stored in future time. What's a good way to deal with this without changing the local time zone. Perhaps store log time in another field and convert _time to EST? Just curious if anyone found a good way to deal with this. Thanks in advance! ... View more

Hi, We have building access logs in Splunk and I have to generate an attendance report. I can filter based on specific events, like when someone swiped at the turnstile downstairs, but it shows multiple results since people leave/come back to the building several times a day. I need to only show the first result per each day. Example output: 03/05/2014 08:23:16.257432 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith 03/04/2014 15:54:53.062885 - Card Access - Access granted - NY - 10th St - Turnstile 2 - Joe Smith 03/04/2014 15:22:12.837323 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith 03/04/2014 08:46:14.337548 - Card Access - Access granted - NY - 10th St - Turnstile 3 - Joe Smith 03/03/2014 09:10:01.092098 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith 02/28/2014 09:32:04.303305 - Card Access - Access granted - NY - 10th St - Turnstile 2 - Joe Smith 02/27/2014 09:57:45.852013 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith ... I want to filter it out so that it looks like .. 03/05/2014 08:23:16.257432 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith 03/04/2014 08:46:14.337548 - Card Access - Access granted - NY - 10th St - Turnstile 3 - Joe Smith 03/03/2014 09:10:01.092098 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith 02/28/2014 09:32:04.303305 - Card Access - Access granted - NY - 10th St - Turnstile 2 - Joe Smith 02/27/2014 09:57:45.852013 - Card Access - Access granted - NY - 10th St - Turnstile 1 - Joe Smith ... Basically only display a single event for each day that appears first. ... View more