If you didn't want multiple lines. This is how I would accomplish the same thing. | sort -elapseJobTime | stats list(eval(myindex(JOBNAME,0,2))) as JOBNAME list(eval(mvindex(JOBID,0,2))) as JOBID list(eval(myindex(elapseJobTime,0,2))) as elapseJobTime by desc   ... View more

Really help out! Thanks! ... View more

Thanks for the great explanation. This worked for me as well. We are on DBX 3.3.0. "Re-saving" the input worked and the "cached" table got reset and the records got ingested correctly. ... View more

Creative solution to make your search a lot less cluttered. ... View more

The link below explains how to configure Checkpoint OPSEC Lea. http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup#Create_the_OPSEC_application_certificate ... View more

On the searchhead it is reverse ascii order! Try ZZ-ta.... ... View more

Figured out why it isn't working. The props.conf documentation states: "Splunk processes calculated fields after field extraction and field aliasing but before lookups. This means that: You can use a field alias in the eval statement for a calculated field. You cannot use a field added through a lookup in an eval statement for a calculated field." Had to create fields.conf. Details in accepted answer below. ... View more

it worked. Thanks! I created the fields.conf and hex works as well. [myfield] TOKENIZER = ([^\x7c]+) ... View more

Figured out why it isn't working. The props.conf documentation states: "Splunk processes calculated fields after field extraction and field aliasing but before lookups. This means that: * You can use a field alias in the eval statement for a calculated field. * You cannot use a field added through a lookup in an eval statement for a calculated field." and my input within my EVAL command was set by a lookup. So thats the reason it doesn't work 😕 ... View more

it is.... EVAL- = split(,"|") is the entry in the props.conf file after I created it in from the UI and didn't work.... I also have field alias and lookups in the props.conf file ... View more

yes as the props.conf has other stanzas which work fine.... just want to add the eval split command. And the UI didn't work either... there has to be some documentation on the syntax used in .conf files for calculated commands. ... View more

Yes I restarted splunk after adding it to the props.conf and it still didn't work. I am not sure what the local.meta entry would be or used? different variations I have tried: EVAL-YourFieldName = split(YourFieldName,"|") EVAL-YourFieldName YourFieldName = split(YourFieldName,"|") EVAL-YourFieldName = YourFieldName = split(YourFieldName,"|") Maybe an extra set of qoutes may do it ... View more

I followed the syntax and it didn't work but does work in the search bar but i guess the .conf syntax is wrong? ... View more