It appears there seems to be a limit of the number of events can be in a transaction. I am doing transactions, and it seems when the number of transactions is over 90 and I export it to CSV, it appears that the multivalued field "breaks" and the rest of the transactions spill out into other cells. Is this an excel issue, or splunk issue? thanks ... View more

here is the scenario: http://tinypic.com/r/1ax08/6 how can i delete the events for which the field is empty? thanks EDIT: btw, i do not want to do the "delete" command which would delete the data from the actual server. I just want it removed from the search result ... View more

Hello Is there any way to get a field that would just be the number of the event? like this? http://tinypic.com/r/2cbuxl/6 thanks ... View more

I have a field called size that takes the form: 1 2 3 4 I want to find someway to evaluate size so that is sums all the numbers. for example, eval totalsize = (size) would evaluate to 10. basically my field size is a collection of sizes, and i want to sum it up for the total size. stats sum is not an option, since it sums it will sum everything over every single event.I need it to sum one event at a time. to be very specific, here is a picture of what i am going for: http://tinypic.com/r/2pru4h0/6 how do i get totalsize? thanks a bunch EDIT: ehh i tried something like that unfortunately my host fields arent unique What im doing is getting file sizes from hosts at different times. So for example, host1 could have a different number of files at each event, and i only want to get the sum at each particular event Is there any other way? ... View more