I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:     | multisearch [search index="sli-index" | eval testtype="endp-health" | head 3] [search index="sli-index" | eval testtype="enp-system" | head 6]      This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command).... Any idea how this can be achieved? ... View more

I have troubles using Splunks role management in combination with search restrictions. My setup is straightforward: A user with two roles, whereby the 1st role is restricting the user on one index. User A Role A Restricted search: "Properties.auth"="5a004" Restricted to index: A Role B Restricted search: "" Restricted to index: B Now, when this user tries to search on index B, no event are returned?! e.g.: index="B" Expected behavior: User should see all events from Index B Actual behavior: No events are shown When I remove role A from this user, all events are shown. When I remove search restriction on Role A everything is shown. What do I miss in this role management? I would have expected, that Splunk iterates over all user roles and evaulates them individually. ... View more

Hi Folks, I'm still new to Splunk queries. I'm struggling with the following (simple) table transformation: All values from a column should be added as a new column Values for this new column should be taken from a specific column Best to show as example. Here is my input: status stage count -------------------- FAIL dev 12 OK dev 14 FAIL prod 13 OK prod 34 FAIL prev 78 OK prev 23 Which I would like to transform to this: stage OK FAIL ----------------- dev 14 12 prev 23 78 prod 34 13 Help appreciated & Thanks! ... View more