Hello, I have a search with several OR statements in it. Example, Microservice=this OR Microservice=that. When the search runs and emails me an alert, I currently have it set to "$result.Microservice$ with $job.resultCount$ alerts". In the text of the email, it only returned the name of the first Microservice, but gave me a total count of both This and That's events. I would like it to give me: "This" had x alerts "That" had y alerts Any suggestions to how I can have the email alert give me totals for each Microservice? I actually have a few more Microservices in my real search, I only listed 2 above. Thanks. ... View more

Hello, All our servers should have more than 2 apps installed. We run this report for a list of systems missing apps: | rest /services/deployment/server/clients splunk_server=local| table hostname applications*.stateOnClient | untable hostname applications value | stats count by hostname | where count < 3 However, I would also like to include the host's IP address in this, but I can't figure out how to include it. Any pointers or better ways to go about this? ... View more

I would like to see what role has access to each index without clicking through each role. Is there a search that can do this for me, or some other way to see all the roles assigned to each index? ... View more

If I need to build a heavy forwarder in Azure, is it better to do it from scratch or use the Azure Marketplace BYOL option? ... View more