Nice workaround. ... View more

FYI, this SPL has an erroneous space in the 2nd line: index=_internal sourcetype=splunkd group=bundles_uploads search_group=dmc_group_search_head | eval baseline_bundle_size_mb=round((average_baseline_bundle_byte s/1024)/1024,1) | chart max(baseline_bundle_size_mb) AS Max_bundle_size by host | eval Max_bundle_size=Max_bundle_size . "M"   average_baseline_bundle_byte s should be average_baseline_bundle_bytes ... View more

I noticed Splunk isn't consistently extracting the search field for all events in the _audit index, so here's the syntax to just search _raw with regex : index=_audit | regex _raw="\|\s*delete" ... View more