A better regular expression is: |regex _raw!="(?m)^[^\r\n]{512,}" ... for the case where the long line isn't the first line. If you don't know the (?m) flag search for PCRE flags. Or alternative ignore the anchor altogether (but this may be less performant): |regex _raw!="[^\r\n]{512,}" Up to you which you choose. ... View more

It can be done. The way it is done is kind of convoluted. I've never used it myself, but here is a very similar example where it was successfully done: https://answers.splunk.com/answers/136791/use-a-subsearch-to-define-earliest-and-latest-for-main-search.html You could use this example and build your query off of it to pass the time range from the subsearch to the outer search. I tested the example and it does sucessfully substitute the Outer and Sub search time ranges. ... View more

Have to agree that ISO date format (2018-05-12) is better because it cannot be misinterpreted. The word "logically" doesn't really come into it... MM/DD/YYYY and DD/MM/YYYY are mere competing cultural/historical standards that are both silly as well as ambiguous. medium-small-large or small-medium-large both make no sense in terms of modern usage. ... View more