if i wnated to the same only < 100 how to i force the stats count to count 0? ... View more

I know this is a very old question, but I'm encountering the same issue with Splunk Enterprise 7.2.0. @rgisrael's question describes exactly what I'm struggling with. @ewoo's answer seems to be for a *nix environment. Is there a similar bug/solution for Windows environment? ... View more

Has no effect... no error messages on restart saying they were read and were improper, no visible change to log messages to suggest it worked. props.conf: [syslog] pulldown_type = true maxDist = 3 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 32 TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False lookup_orblookup = orblookup Hostname OUTPUTNEW OrganizationCode transforms.conf: [orblookup] filename = ol1.csv head apps/lookups/ol1.csv ... View more