Ok try this and let me know what you get. I'm assuming you have a field extracted for the nameX value called name. <your search>| eventstats latest(name) by _time, name | dedup name | table name, _raw, _time This will show the latest individual values for each 'name' field value you have. You can do whatever you want with the table to show whatever fields you want later. Take out the dedup and you'll be able to see all records and make sure that you are in fact getting the latest one. Pick a set period of time by using earliest=-10m latest=-5min before the first pipe in your search. I'm still trying to play with it still to see how to do this in a cleaner way without dedup. ... View more

You can use DB Connect on a heavy forwarder (UF is not supported). http://answers.splunk.com/answers/91906/best-practice-to-installconfigure-db-connect-in-a-distributed-environment ... View more

I believe the best solution for you in this case would be as you said, edit the polling logs so they are easier to interpret and therefore easier for you to maintain and query with Splunk going forward. ... View more

Assuming you are using Splunk 6, if you go to the menu Settings->Fields->Field Extractions and then select your app context to find your extraction, you'll most likely need to enable permissions on that field. Then when you go back to look at that sourcetype again the field should appear. You may need to click on the bottom of that list where is say 'X more fields' to see it and add it to your selected Fields. ... View more

If you navigate to the app page on apps.splunk.com you'll see if the app has the Splunk 6 compatible icon. If it isn't there yet you can always subscribe to the app so that you'll get updated when it's available on Splunk v6. ... View more

You'll want to read this first to understand our data lifecycle and your options. Let us know if you have questions after looking at this. http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Backupindexeddata ... View more