Define the script as a scripted input (Settings->Data inputs->Scripts). Anything the script writes to stdout will be indexed by Splunk. There are no arguments passed to the script so it must have its own logic to know which log to read. Yes, you can use transforms.conf. Use a REGEX statement to identify the events you want to index and send them to FORMAT = indexQueue ; send the rest to FORMAT = nullQueue . ... View more

DO NOT use transaction ; do it like this: | makeresults | eval raw="time=1/1/19T2:58,state=ON time=1/1/19T11:31,state=OFF time=1/1/19T13:21,state=ON time=1/1/19T17:03,state=OFF time=1/1/19T19:53,state=ON time=1/2/19T5:17,state=OFF" | makemv raw | mvexpand raw | rename raw AS _raw | kv | rename time AS _time | eval _time = strptime(_time, "%m/%d/%yT%H:%M") | sort 0 - _time | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | eval days = _time | bin days span=1d | streamstats count(eval(state="OFF")) AS transactionID | stats values(*) AS * dc(days) AS day_count BY transactionID | search day_count == 1 ... View more

thanks 🙂 ... View more