Hi Splunkers, I'm having issues ingesting Windows DNS Server Analytical logs. What's strange is that I am able to pull Audit logs with the following details in the inputs.conf file: [WinEventLog://Microsoft-Windows-DNSServer/Audit] disabled=0 index=dns When I do the same thing for Analytical it does not work: [WinEventLog://Microsoft-Windows-DNSServer/Analytical] disabled=0 index=dns Has anyone had any luck here?  Thank you! ... View more

How can I compare CSV file test.csv with one column, lets name the column"DNS" to index=myindex with field name "host"? Preferably I'd like to output the results in a pie chart where the indexed data is the total and I can do a dif against the test.csv DNS column. ... View more

I am looking to compare two CSV files to output a change or addition. Example: File 1: User Date Status Dave 1/1 New Linda 1/2 Old Bob 1/3 Old File 2: User Date Status Dave 1/1 Old Dave 1/2 New Linda 1/2 Old Tony 1/8 New If the user from File 1 matches File 2 and either row "date" and "status" have changed then output that information plus any new additions. Expected output User Date Status Dave 1/1 Old Dave 1/2 New Tony 1/8 New ... View more

I am receiving the following errors from my universal forwarder: "Monotonic time source didn't increase; is it stuck?" How do I resolve this? ... View more