Hello! I am trying to make a dashboard with fields from 2 indexes using the command "join". I wrote a search source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [index=anotherindex employeeID=*] | table _time, user, employeeID But column employeeID is empty. What did I do wrong? ... View more

Hello! I have logs from Domain Controller Active Directory in Splunk and try to configure monitoring of user logons (EventCode=4624). Unfortunately, there are two fields with a name "Account Name": NAMEOFPC$ and USERACCOUNT. I`d like to make two different fields for NAMEOFPC$ and USERACCOUNT. How can I separate them? Thank you! ... View more

Hello! I upgraded splunk 6.1 to 6.2, tried to start new version but received a error: Checking kvstore port [3433593128]: invalid; must be between 1 and 65535 Would you like to change ports? [y/n]: y Enter a new kvstore port: 54321 Setting kvstore to port: 54321 Did not find "disabled" setting of "kvstore" stanza in server bundle. Error changing port, exiting Could you advice me anything, please? ... View more