As my original subject led to some weird error message about message flooding - here it is again:
Subject: Invalid key in stanza - splunk_instrumentation - savedseaches.conf v8.2.9
Version 8.2.9 ...
...enerating command.. one thing i found is that if I act on the field with mvcombine the functions tojson and makejson seems to realize how to covert it.. but if I do that on fields that are multiple value it m...
I am looking to compare two events in same index and sourcetype differentiated by snapshot id's, the main task is to compare the "instance_list" field between latest and last event and send an alert ...