Following as I have the same question and actually my power users can't upload images either even though documentation says they can. ... View more

Update:  What I had responded is actually incorrect, in that it's not a feature change but actually a bug.  The bug showed up in 8.1.x and fixed in 8.1.6 and apparently in 9.0.x.  But in 8.2.5 and potentially any 8.2.x (have a case currently open as of today 7/18/2022) to make that determination.  So my apologies in the haste of that response as what research I had done in docs and what we were seeing it appeared the functionality had changed. Leaving the below here as to context of my correction.   I believe this behavior changes with 8.2.  The host is no longer being stored on ftr, and if you have host coded in your inputs.conf from prior releases. The clone-prep-clear-config command will not clean out that file in the 8.2.x releases, at least not in 8.2.5 that we are on.  We just ran up on this issue as we have images that our servers are created from and the steps have been to run the clone-prep-clear-config to reset the inputs.conf host values and the guid.  But it no longer clears out the host name from inputs.conf.  So we have had to change our steps as we were not having data come into Splunk under the proper host name.  So now we remove the inputs.conf as well as run the clone-prep-clear-config to reset our servers. ... View more

why did they bring it back in 8.2? But not retro back to 8.0 and 8.1? ... View more

Workaround 2 that is. We are cloud so Workaround 1 would be a pain. ... View more

This worked for me as well as we started experiencing it when moving to 7.2.6. Thanks for having the answer out here!! ... View more

I get the same thing but not just for speed. duplex and docker0 ... View more

hey that worked!!! Thank you that's perfect! ... View more

hmmm ok so a little confused you are still using the actual saved search name in the map. My example I provided was not very well expressed my apologies. Let me go about it like this. index=testindex |stats count by fielda|eval search_name=if(fielda=="John","John Alert","EveryoneElse Alert") |map $search_name$ So if I get 2 rows back fielda=john saved_search="John Alert" fieldb=joan saved_search="EveroneElse Alert" Then I get John Alert executed for the first row. Then EveryoneElse Alert for the second row. ... View more

I have had Support open a ticket and it is fairly painless besides waiting on them to do it. We were able to send data immediately. The docs didn't used to tell you to open a ticket. We tried to create ourselves, but as mentioned before, there is the bug that it doesn't create the collector on the indexer so it won't work. That's why they have to create it. Not sure if that is fixed in 6.5, we are 6.4.1.2. ... View more

It removes my xml formatting when I paste it in. the TransactiondataXML is the field where the data would be. ... View more

I will check it out. I tried to give a snippet of the code but it removed all formatting. I will give it another try. {"LogName":"ExampleLog","CorrelationId":"f879095a-0109-4235-8ba8-218f43f27220","LoggingLevel":"All","ThreadId":"9","LocalTimeStamp":"2016-01-28T14:38:36.748986-05:00","AccessModeName":"ABC","AgentCode":"00000","AgentPrefixCode":"CA","ApplicationName":"UQ","ChannelCode":"DI","CIFCommonSchemaVersionNbr":"V0200","CIFGeneratedSchemaId":"05c0b8a4-2954-4fb7-a6ae-def569bd4b63","CIFSoftwareVersionNbr":"1.2","DataCenterLocationText":"None","InstrumentationLogDateTime":"/Date(1454070556298)/","LoggingComputerSystemName":"mycomputer","LoggingLevelName":"Critical","MessageText":"Hello world","OperatingEnvironmentName":"Development","PartyLogonIdTypeName":"None","TransactionDataXML":"application0091ef6c7-7d6b-4374-ac6b-8ec67abc6a9630080serverapplication","TransactionDateTime":"2016-01-28T14:38:36.729986-05:00","CIFSchemaValidationErrors":["AccessModeName should be 10 characters"],"CIFSchemaValidated":true,"Custom1":"Custom1Value","EventId":0,"CIFUniqueMessageId":"f879095a-0109-4235-8ba8-218f43f27220"} ... View more