Hi so why not just put the whole search as a saved search: the search part with the subsearch. It is simpler. Then run the saved search as i suggested  | savedsearch "mysaved_search_name" Don't put search at the beginning.   ... View more

If I try searching for a lookup that can't be found I get   ERROR SearchMessages - orig_component="SearchOperator:inputcsv" app="search" sid="1692127130.1422" message_key="INPUT_CSV:INVALID_LOOKUP_TABLE_TYPE" message=The lookup table 'maintenance_window.csv' requires a .csv or KV store lookup definition.  this in /opt/splunk/var/log/splunk/search_messages.log ... View more

Maybe the inputlookup is restricted to permission in a given app. You are using that app in your splunk search via the web. The api is running the search app? Just an idea. ... View more

Hi. Sorry I missed that you had passed in earliest and latest. A few ideas 1) can you create a saved search and then run that. e.g. savedsearch "mysavedsearch" 2) is the splunk search you are running with username and password got the permission to view the lookup table? 3) break down the search to find the issue e.g. maybe just run the inputlookup with a | stats count to make sure that part is working? 4) if you are an admin, you could look in the audit log to find out the number of results returning from your search ... View more

Hi.  Isn't this saying  indexer inputs1.XXXX.splunkcloud.com has full queues? Can you look at the queues there? Messages? ... View more

Hi.  So when you test you are specifying a time range, I assume (not all time). But for the python api search if you don't pass in earliest and latest, wouldn't it do an all time search? ... View more

I am not expert on this but I guess one thing is to run btool and make sure you are getting the settings that you think you are. A few months ago I did a quick test to remove double quotes in order that I could use tstats. props.conf [my_sourcetype] SEGMENTATION = no_double_quotes   segmenters.conf [no_double_quotes] MAJOR = [ ] < > ( ) { } | ! ; , ' * \n \r \s \t & ? + %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29  Then I could search with tstats where I had myfield="123" | tstats count where index=myindex by PREFIX(myfield=)   ... View more

hi @rrovers What version of Splunk did you hit this bug with long search name and you couldn't view the search ... View more

hi @rain Thanks for the very thorough testing and screenshot. So I looked at my test instance and actually I do see what you are seeing when you hover over a lookup: the root endpoint "/splunk" is not there BUT when I click on the csv in the lookup editor, I am able to edit the lookup.  Did you try to edit a lookup? I don't get an error at all and things do seem to work.   ... View more

Hi. I am not seeing this issue. Here's the output from btool to show the root_endpoint is splunk   /opt/splunk/bin/splunk btool web list --debug | grep root /opt/splunk/etc/system/local/web.conf root_endpoint = /splunk     If I click on the lookup editor I see this URL https://server:port/splunk/en-US/app/lookup_editor/lookup_list   So /splunk is there in the URL and the lookup editor works. Debugging ideas 1) run btool to make sure you have the endpoint setup as expected 2) possibly look in your logs for errors   ... View more

Hi @rain  I did a quick experiment as follows and did not have an issue with the lookup editor. 4.0 The path was correct as expected (/splunk was added).   /opt/splunk/etc/system/local/web.conf root_endpoint = /splunk   ... View more

Hi. Can you file a case with splunk support about this? ... View more

So in your query where you show the events, can you display the _time as well? ... View more

Hello. We can't see what time Splunk thinks those events arrived in. Do you have a props.conf for that sourcetype/source to tell the Splunk indexer which field you are using as the actual event time? https://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf Something like TIME_FORMAT=%s    (for unixtime format) TIME_PREFIX = time\":\s*\"     ... View more

Did anything change on your servers running Splunk? What version are you running? ... View more

Hi @siddharthprabhu  Whoever in your organization has access to create Splunk Support tickets can follow this https://community.splunk.com/t5/Random/How-do-i-file-a-Splunk-Support-Case-contact-Splunk-Support/td-p/148639 Thanks. ... View more

Hi. It would be great to file a ticket with Splunk Support to make sure they are aware of the bug.     ... View more

Hi what @ITWhisperer meant, I believe, is try the first line of your tstats by itself. If that works dd the second line etc.   What I do is to comment out the lines you don't want to run when three backs ticks. Then I have the query ready to uncomment. ... View more