1) | makeresults | eval puppy_name = "Scout Windixie Spot Spot" | eval name_count = mvcount(mvdedup(split(puppy_name," "))) 2) it looks like a list in python, I'm not sure splunk has a function that converts a list string directly into a multi-valued field, I recommend parsing it first with a regular expression, like this: | makeresults | eval puppy_name ="['Scout', 'Windixie', 'Spot','Spot']" | rex field=puppy_name "'(?P[^']+)'" max_match=0 | eval name_count = mvcount(mvdedup(name)) Hope that helps ... View more

probably a JDBC driver problem... I would open a support ticket. If you want to keep trying on your own, try switching from jTDS to Microsoft driver ... View more

try to using the no-renaming column ... View more

@kartik1979 - This question is quite old and may not garner any new activity. If you need help on this issue, you should post a new question. Or, if you want to try to get some immediate help for your question, you should join the 1300+ Splunk users in our public Slack chat. People ask each other for immediate help on there daily. You can share your question/link to your post there to see if anyone can take a stab at it. You first have to request access through www.splunk402.com/chat. Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process takes a couple days), you can access Slack.com and ask for help in the #general channel. ... View more

I think splunk doesn't pick the correct timestamp if as you say.Is it because the raw log has the same like string somewhere? You can try to use the TIME_FORMAT property in $SPLUNK_HOME/etc/system/local/props.conf. good luck 🙂 ... View more

For future operation, make sure your indexers are each using more robust HDD configurations such as RAID 1+0. That way you can survive a crashed disk without issue, you just need to replace it soon after failure to avoid multiple failures causing data loss. On top of that, Splunk clustering as recommended by Kristian is a great way of improving availability on top of hardware RAID. ... View more