That did it! Thanks. I'm not clear what that function is supposed to do... ... View more

Many thanks for the answer. The maintenance of files within a splunk app doesn't seem the right thing to do since you will have to deal with documentation, handover and other operational questions to let everyone know.. I have tried to handle same within the dsa app and wrote two little queries using inputlookup and outputlookup, saved them as reports and configured a monthly schedule. The first query takes the content of the sonicwall_http_session_id.csv file and outputs the same into sonicwall_http_session_id.bak.csv | inputlookup sonicwall_http_session_id.csv | outputlookup sonicwall_http_session_id.bak.csv The second query then reads the file sonicwall_http_session_id.csv, keeps the first 15'000'000 entries (about what we have for a month) and writes the content into same file again. | inputlookup sonicwall_http_session_id.csv | head 15000000 | outputlookup sonicwall_http_session_id.csv With this setup, we retain the information of this file for 2 months in the system. Optionally, you can replace the .bak. from first query with todays date and keep the rotated files on the filesystem as long as you like. Both reports are scheduled to run once a month where second is setup to run 15 minutes after the first one. This setup has done fine for us so far. Any better idea to deal with this issue is most welcome. Currently we do above rotation with the *session_id.csv only because it's the fastest growing. But a more 'standardized' way of doing it would be more favorable. ... View more

how about this? ※Please change maxsearches as there are search counts that can be executed. |inputlookup lookupfile |map search="search index=XXX $keyword$ |eval keyword=$keyword$,Database=$Database$" ... View more

Heh. Glad it worked out for you. I assume that code is somewhere in the splunk soup version? By the way, that code is equivalent to... | eval mac3=coalesce(mac,macAddress) With only one field value in question, the if(isnull(A),B,A) is almost as easy to read as coalesce(A,B) , but as soon as you get a third potential place to go for non-null data, coalesce is much cleaner code. Please accept an answer so that readers will know your issue is handled. It's okay to accept your own, but if you do, please make sure to explain what part of your question that answer is the answer to, since a single line of code is not very specific. ... View more