I have since changed jobs, and I had opened a support case. Nothing concrete from before I left there. ... View more

You could increase your timerange and use |head 1 . This returns the most recent in the timerange. You could also use a lookup generator. Run it every hour and then just lookup the host you want from the table. In transforms.conf put: [hardware] filename = hardware.csv Then populate the lookup (Run this as a scheduled search every hour, 30 minutes, 5 minutes, whatever you feel is appropriate to get the required data): sourcetype=hardware | inputlookup hardware append=t | stats latest(*) as * by host | outputlookup hardware Then in your search you can do: your_search | lookup hardware host | do_things_with_hardware Ref: http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Lookup http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup ... View more

If you already have the indexes created, you can just specify index=myindex for each input in inputs.conf on each forwarder. ... View more

That's not quite how this works. You can try this tho: your_search "*LH:" | rex field=_raw "LH:(?<lh_number>\d+)" | stats count by lh_number This will regex your LH and pull out the number, and then count by that number. ... View more

While courageously perusing the forums of Splunktonia, I happened upon writs of such knowledge and depth of understanding, that I, a mere mortal, was astounded and amazed. Having passed through lands of Ciscory and meeting with such as Sir Alto of Palo, I forthwith expanded my visibility into the depths of my subcutaneous membrane, with nary more than a construct of SPL. Hark! Heed my words, and learn this language of such magnitude and importance! It shall change your life forever, as mine surely has been touched. ... View more