<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Restrictions for standard mode federated search in Splunk Enterprise</title>
    <link>https://community.splunk.com/t5/Splunk-Enterprise/Restrictions-for-standard-mode-federated-search/m-p/651676#M16893</link>
    <description>&lt;P&gt;&amp;lt;html&amp;gt;&lt;/P&gt;&lt;P&gt;Hello&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;If you look at the search manual, one of the restrictions is the inputlookup command.&lt;/SPAN&gt;&lt;BR /&gt;[Search manual]&lt;/P&gt;&lt;H3&gt;&lt;SPAN class=""&gt;Restrictions for standard mode federated search&lt;/SPAN&gt;&lt;/H3&gt;&lt;P&gt;Standard mode federated search does not support the following:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;&lt;DIV class=""&gt;&lt;STRONG&gt;&lt;A title="Splexicon:Generatingcommand" href="https://docs.splunk.com/Splexicon:Generatingcommand" target="_blank" rel="noopener noreferrer"&gt;Generating commands&lt;/A&gt;&lt;/STRONG&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;other than&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/search" target="_blank" rel="noopener"&gt;search&lt;/A&gt;,&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/From" target="_blank" rel="noopener"&gt;from&lt;/A&gt;,&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Loadjob" target="_blank" rel="noopener"&gt;loadjob&lt;/A&gt;,&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Mstats" target="_blank" rel="noopener"&gt;mstats&lt;/A&gt;, or&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Tstats" target="_blank" rel="noopener"&gt;tstats&lt;/A&gt;. For example, federated searches cannot include the&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/datamodel" target="_blank" rel="noopener"&gt;datamodel&lt;/A&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;or&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/inputlookup" target="_blank" rel="noopener"&gt;inputlookup&lt;/A&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;commands. You can find a list of generating commands in&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Commandsbytype" target="_blank" rel="noopener"&gt;Command types&lt;/A&gt;, in the&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;I&gt;Search Reference&lt;/I&gt;.&lt;/DIV&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;&lt;BR /&gt;&lt;SPAN&gt;Is this inputlookup a constraint on local Splunk? Or is it a remote restriction?&lt;/SPAN&gt;&lt;!--  /data/user/0/com.samsung.android.app.notes/files/clipdata/clipdata_bodytext_230724_155232_289.sdocx  --&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Thank you&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;lt;/html&amp;gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 24 Jul 2023 06:54:53 GMT</pubDate>
    <dc:creator>KwonTaeHoon</dc:creator>
    <dc:date>2023-07-24T06:54:53Z</dc:date>
    <item>
      <title>Restrictions for standard mode federated search</title>
      <link>https://community.splunk.com/t5/Splunk-Enterprise/Restrictions-for-standard-mode-federated-search/m-p/651676#M16893</link>
      <description>&lt;P&gt;&amp;lt;html&amp;gt;&lt;/P&gt;&lt;P&gt;Hello&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;If you look at the search manual, one of the restrictions is the inputlookup command.&lt;/SPAN&gt;&lt;BR /&gt;[Search manual]&lt;/P&gt;&lt;H3&gt;&lt;SPAN class=""&gt;Restrictions for standard mode federated search&lt;/SPAN&gt;&lt;/H3&gt;&lt;P&gt;Standard mode federated search does not support the following:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;&lt;DIV class=""&gt;&lt;STRONG&gt;&lt;A title="Splexicon:Generatingcommand" href="https://docs.splunk.com/Splexicon:Generatingcommand" target="_blank" rel="noopener noreferrer"&gt;Generating commands&lt;/A&gt;&lt;/STRONG&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;other than&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/search" target="_blank" rel="noopener"&gt;search&lt;/A&gt;,&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/From" target="_blank" rel="noopener"&gt;from&lt;/A&gt;,&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Loadjob" target="_blank" rel="noopener"&gt;loadjob&lt;/A&gt;,&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Mstats" target="_blank" rel="noopener"&gt;mstats&lt;/A&gt;, or&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Tstats" target="_blank" rel="noopener"&gt;tstats&lt;/A&gt;. For example, federated searches cannot include the&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/datamodel" target="_blank" rel="noopener"&gt;datamodel&lt;/A&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;or&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/inputlookup" target="_blank" rel="noopener"&gt;inputlookup&lt;/A&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;commands. You can find a list of generating commands in&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;A class="" href="http://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Commandsbytype" target="_blank" rel="noopener"&gt;Command types&lt;/A&gt;, in the&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;I&gt;Search Reference&lt;/I&gt;.&lt;/DIV&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;&lt;BR /&gt;&lt;SPAN&gt;Is this inputlookup a constraint on local Splunk? Or is it a remote restriction?&lt;/SPAN&gt;&lt;!--  /data/user/0/com.samsung.android.app.notes/files/clipdata/clipdata_bodytext_230724_155232_289.sdocx  --&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Thank you&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;lt;/html&amp;gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 24 Jul 2023 06:54:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Enterprise/Restrictions-for-standard-mode-federated-search/m-p/651676#M16893</guid>
      <dc:creator>KwonTaeHoon</dc:creator>
      <dc:date>2023-07-24T06:54:53Z</dc:date>
    </item>
  </channel>
</rss>

