I opened a case and it's confirmed, that the ER was not implemented by now. Our need is now added to ER SPL-175134, but no big hope for having this implemented soon. ... View more

Have you tried the proposition from "somesoni2" ? can you try adding following to the end of your search | rtorder discard=t ... View more

I'm struggling with this also! ... View more

thanks pal, this solved precisely my issue 🙂 ... View more

I don't think it's a join, it's more of a loop - you're specifying "source=web_logs" (or whatever your web log source is). the "[|inputlookup ..." section is a subsearch that returns a cs_uri_stem in which to search your web logs for.. ... View more

If it is on a shared filesystem, why not set up one machine to read all three files, or even set up a dedicated forwarder to monitor the shared file system? ... View more

Thanks. I have this configured but it is not working. How can I confirm or debug splunk calling the command line? It works outside splunk, but not inside it. ... View more

Try this:- "[a-zA-Z]:(?:(?:\\[a-zA-Z]){5}\\)(?P[a-zA-Z].\w+)" ... View more

modify your local/alert_actions.conf to add hostname = http://dtsplunk1.mydomain.mycom see : http://www.splunk.com/base/Documentation/latest/Admin/Alertactionsconf ... View more

You could simply edit or copy and edit the fill_summary_index.py script by hand. However, you will still be limited by settings for the max number of concurrent search jobs in the Splunk server set in limits.conf. These vary depending on the number of CPU cores you have and by default is 4+(4*n_cores), but you can edit these parameters as well. If your machine has More than 16 CPU cores, and Pretty high disk IOPs you can get through the jobs faster. Otherwise, you'll bottleneck on one of these resources. ... View more

Assuming single-line events, eval can do it: | eval line_length=len(_raw) ... View more