Try like this ....| eval new=_raw | eval new=split(new,"\\n") |mvexpand new OR (if above doesn't work) --- | eval new=replace(_raw,"[\r\n]+","##LBreak##") | makemv new delim="##LBreak##" | mvexpand new ... View more

Do it like this: YOUR SEARCH HERE | appendpipe [ |inputlookup YourLookupHere ] | dedup computernames | outputlookup YourLookupHere This will take the new stuff in preference over the old stuff if both exist, but keep the old stuff if nothing new is found in the search. ... View more

It worked, thank you for your help. ... View more

I am getting the same error on Windows. ... View more

This error is likely due to Splunk being unable to talk to itself. It's a known issue with Windows, see: http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/WorkaroundfornetworkaccessibilityissuesonSplunkWindowssystems This answer has the most detailed information, in terms of users' experience. http://answers.splunk.com/answers/68368/splunk-web-throws-responsenotready-error ... View more