That is very helpful, saves us all the time in trying that as a workaround. Thank you! ... View more

This is the answer. What version of Splunk was this feature implemented? ... View more

Just hit this issue, did you find a solution? ... View more

Run "Repair' or reinstall the Splunk Application ... View more

Found a way to spot the troublesome csv.  (worked for me, anyway)  requires CLI. The grep looks for special characters in the file. find $SPLUNK_HOME/etc -name "transforms.conf" | xargs grep -l -P -n "[\x80-\xFF]" find $SPLUNK_HOME/etc -name "*.csv" | xargs grep -l -P -n "[\x80-\xFF]"   Another thing that helped track down the issue was run the rest call as a Splunk search, then look at the search.log | rest /services/data/transforms/lookups ... View more

Are these DEBUG settings to be done on the UF on the windows host? How does the manifest file get installed to resolve this? ... View more

The transaction_uuid field added to the results works for bolt task, I haven't figured out how any of the other alert actions are to be used ... View more

It appears transaction_uuid is required.  Not sure if this is supposed to come from alert metadata, but adding it to Splunk results e.g. | eval transaction_uuid="bolttest_" . host . "_" .strftime(now(),"%s") seems to work ... View more

Is there a workaround for this? ... View more

Are you using AWS Cloudwatch agent to forward application logs to the centralized location? ... View more

You can override the Host override in transforms.conf to force a domain suffix Beware: You may need to adjust the REGEX to remove any existing domain suffix prior to forcing one on this way. local/transforms.conf [nmon_data_hostoverride] FORMAT = host::$1.yourdomain.com ... View more

The '|rest' command is part of SPL, it is a generating command. You do not need to be remote, it is used in the UI. ... View more