Try the code below to change the selection of your input. function unsetToken(name) { defaultTokenModelun.unset(name); submittedTokenModelun.unset(name); } unsetToken("form.TEXT_FIELD") ... View more

I saw a similar message below [splunk-idx1] Failed to parse templatized search for field 'tag::eventtype' This error was caused by following forearch command. | foreach * [ eval <<FIELD>> = if(isnull(<<FIELD>>),"",<<FIELD>>)] I think the <> template cannot handle fields contains special characters. I worked around this by adding | fields - tag::eventtype just before the foreach. You can probably work around by adding | fields - 'clientHeaders.test-client-device-id{}' ... View more

There are several options for you. Please see below link for more detail. https://splunk.box.com/v/dataoffload The quick win is the TSIDX reduction. https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage Hadoop data roll would be the next when you have any Hadoop storage space. https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop I hope this helps. ... View more

maybe the disk quota if you see the error for specific user roles. ... View more

Right this one easier and quickly too...!! thanks 🙂 ... View more