Based on the documentation: The script must be located in one of two places: $SPLUNK_HOME/etc/searchscripts $SPLUNK_HOME/etc/apps/<app_name>/bin See "More about the external lookup script" for more information about how such scripts work. When I have the script within the apps/<app_name>/bin directory it is never picked up. When I move it to the searchscripts directory it runs just fine. Is the ability to have external lookup scripts within an app not possible? (Splunk 6.3) Here is my transforms.conf: [testLookup] external_cmd=test_lookup.py testField1 testField2 external_type=python fields_list=testField1, testField2 ... View more

Hi, I am wondering if there is any guidelines as to using the "search" or "where" commands within a search query when trying to filter data. It seems that both can be used sort of interchangeably. I am curious if there is any performance impact of using one over the other. Thanks ... View more

I have a base report that pulls together information from multiple events using stats command. I have called the report Completed Events. From this report I have created some other reports to do some summary analysis on those completed events. I have setup report acceleration on the different reports and Splunk properly identifies them as the same base query so puts the report under the same summary. My question is if other reports are created or other search queries are run that use the same search query base as the Completed Events report will those also benefit from the report acceleration summary? I would like for other end users to be able to take the Completed Events report and open it up in the search and build their own summary stats that they want. ... View more