Thank you! Argh, so the permissions setting on the app was the reason why my changes weren't taking effect. Thanks for clearing that up for me. And that's confusing about the INDEXED_EXTRACTION not being able to be modified from the local props.conf. I understand why search time extraction mightbe preferable, but I don't want to create a setup that will break when there's an app update either. ... View more

Great, thanks again! ... View more

I see, as you like. We have been running alerts that periodically check various sourcetypes and notify us if there are zero events found in order to find out if something has broken with logging or indexing and we are missing data my query works for this, I think. If you don't like this, please choose the other. At the point, a missing and the continuing are different,I think. another query and another alert, we need. ... View more

Hi @joemiller, Glad to help you. It seems you did some workarounds with my solutions to get a better result. That's a great thing to learning and improving our knowledge. Keep it up. Happy Splunking ... View more