echo '/splunk/is/not/easy/' | sed -E 's#(.*)/.+/?#\1#' ... View more

@kotak86 I dont think there is an existing feature or custom app for this kind of use case. You can either submit and idea on ideas.splunk.com or build your own Custom Alert Action for this feature. ... View more

I am not getting consistent result - it looks very weird... sending time in epoch ("1566872999.000000")as well date string (""08/27/2019:07:59:59","%m/%d/%Y:%H:%M:%S") works but I am getting different start boundary (means in both file log start from different time) for the following two example. {'search': 'search source=*kong_access* earliest=08/01/2019:0:0:0 latest=08/01/2019:23:59:59 http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv'} {'search': 'search source=*kong_access* earliest=08/01/2019:0:0:0 latest=08/08/2019:23:59:59 http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv'} ... View more