Hi, looks nice, thanks. ... View more

It helps you plenty. If you are running a Splunk CLI search via the Windows CMD prompt, then you need to understand the quoting rules IT uses. It's the same thing, only different. When you're using a command line shell to run a command - regardless of what the command line shell is - you are subject to how IT interprets and quotes input before it passes it along to the child process it is starting on your behalf. If you are not using CMD, but using PowerShell instead - it may have different quoting rules that you have to account for. A quick google search of "windows command prompt quoting rules" brings these resources: http://ss64.com/nt/syntax-esc.html https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/ http://stackoverflow.com/questions/7760545/escape-double-quotes-in-parameter http://stackoverflow.com/questions/24173825/what-does-single-quote-do-in-windows-batch-files ... View more

Another fantastic answer by duckfez! ... View more

Several working answers have been given; you should pick the best one and click "Accept" to close the question. ... View more

Great! Glad it worked for you. ... View more

After the collect command, the sourcetype is changed to stash. I don't think this is the right way to move data between indexes. First, you should modify your data input configurations (inputs.conf) on forwarders/data source to use index=Medium instead of index=High. This should make all the real-time/latest data to go to index=Medium. Then, for moving historical data, easy option would be create an eventtype/macro which will collect data from both the indexes (high and Medium). Once all the data in index=high is retired (based on retention policy set), you can update the macro/eventtype to just use index=Medium. OR follow method described here https://answers.splunk.com/answers/32176/is-it-possible-to-migrate-indexed-buckets-to-a-different-index-on-a-new-machine.html ... View more

I can index the individual file under that appy directory but not entire appy directory. Wondering why its not indexing because the logs in appy are similar to other folder logs but different application. ... View more

for some reason, I cannot put in the exact search string ... use your search and pipe it to rex as described here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex Look at example 1. You are looking to create a single field, so use the first part of example 1. i got it to work, but for some reason, when I post my exact search string, it gets mashed up upon post. ... View more

my bad. I couldn't find link to these instructions so I copy pasted from README.md file from python SDK. Any ways now I have given the link to github page. Please feel free to provide splunk docs link, I did not find it. ... View more