|spath handles both JSON and XML. |makeresults |eval _raw="<a>1</a><a>2</a><a>3</a>" |spath path=a output=a ...or just |makeresults |eval _raw="<a>1</a><a>2</a><a>3</a>" |spath   ... View more

In general, you can use the offset parameter to get the next offset of results. So in your case, you'd pass in offset=30 . ... View more

I figured out what was causing my issue. While I would create the extraction in an application and set it to all applications & give read only to everyone; the user also needs to have at least read only access to the application that the extraction is in. So I usually create all global objects in the Search application because Splunk 4.1.6 beta has a lot of references to this application so I've had nothing but issues with disabling this app anyway. Then I give all roles at least read only access to the search application. Another option is to add these to the system app. ... View more