I have a list large list of products. I need to search the list but filtering out some results based on the partial values of the ProdDesc field. Examples of ProdDesc would be something like : MD5864,WINDOWS,PROC1 or MA9874,ANDROID,PROC3, etc. I can use ProdDesc != \*5864\* and ProdDesc != \*ANDROID\*... . The problem is that the list of partial results has 112 items. When I add ProdDesc != \*[partial value]\* more than 26 times, the query returns no result at all. There seems to be a limitation of how many times I can use !=\*[partial value]\* . I'm using Splunk Enterprise version 6.5.3 and I'm an end user, not an Admin. I wold appreciate any help provided. Thank you. ... View more

I have an alert that runs daily at 2:00 am. I need it to run at 2:30 am instead. How do I configure the CRON to run at x minutes past the hour? ... View more

I have a field "Company Name" that is empty on some events, but has a value on others. How do I search for the first occurrence of that field that is not null or empty? sourcetype=[my source] [filter field] = 322799761 | table customer.companyName ... View more