Many thanks - good point. I will check the attributes and see if I can produce the desired outcome 🙂 ... View more

Try to use a versión of splunk before 6. Its looks like there is a problem with the phyton version includen in versión 6. ... View more

I have same problem. Plz let's show me how do you fix it. thanks ... View more

It is useful to forward from UF through HF when index-time parsing is required or when network security requires configuration to allow connections to indexers (firewall). ... View more

The documentation for mvfilter seems to be incorrrect. I get the same error message as the original poster: Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. when I use mvfilter like this: | eval SessionEndTime = mvfilter (SessionEndTime != NULL) Using null() instead of NULL does not work either; it gives me the error: Error in 'eval' command: Typechecking failed. The '!=' operator received different types. What does seem to work is putting NULL in quotes like this: | eval SessionEndTime = mvfilter (SessionEndTime != "NULL") ... View more

Thanks I will ... View more