I have a number of hosts sending logs "in the future". I've configured my indexer's props.conf to adjust the TZ for the select few problem children and restarted the indexer. How can I immediately verify my changes have put these host's new events in the correct TZ (meaning, no longer in the future) Basically the existing "future events" are making the timeline noisy and I can't see where (or perhaps *when*) new events are coming in. I could wait several hours for them to clear out, but that's not ideal. ... View more

I have several fields I want to lump into 1 multivalue field and remove blanks. At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#.  If it is an internal IP, then the external_src_ip# will be "-", i.e. blank. If I run      | eval OriginIP2 = mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ) | eval OriginIP2 = mvfilter( match( OriginIP2, "^(?!-)" ) )     I get exactly what I want. A multivalue list in the field "OriginIP2" with "-" removed. However putting it together in 1 line (to automate as a Calculated Field) gives me an error.     | eval OriginIP2 = mvfilter( match( mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ), "^(?!-)") ) Error in 'eval' command: The arguments to the 'mvfilter' function are invalid.     As I read the docs, mvappend() should be returning a single mv field for match() to operate on, and then for match() to send to mvfilter().   What am I missing? ... View more

We have a large csv file that a user is using with a automatic lookup. The lookup needs only to be stored and searched locally on the single searchhead, but we're getting errors from distributed searchheads about being unable to load the lookup (since it doesn't exist there).   In search, you can add local=true which resolves this issue. Is it possible to add this for automatic lookups? I see nothing mentioning it in docs, and the only other community question about this is from 2012 where they say it's not supported... hoping that's changed since then?...   If not, what other options do I have? ... View more