Hi All, Help please. Can I get people to agree with me that the following is a bug/design flaw - as my splunk case is getting no where.   Please try this, it only takes a moment, promise... In the splunk gui go to sourcetypes Click New Source Type give it a name - maybe test Click advanced Delete the  LINE_BREAKER setting Add New Setting:   BREAK_ONLY_BEFORE and set value to AAAA Check/Set SHOULD_LINEMERGE is true Save Run this search to confirm your settings look good: | rest /servicesNS/-/-/configs/conf-props| where title = "test" | fields BREAK_ONLY_BEFORE LINE_BREAKER SHOULD_LINEMERGE eai:acl.removable eai:acl.sharing eai:appName title​ In the search results confirm values have been saved as expected Re-edit the source type in the gui Click Advanced Notice that SHOULD_LINEMERGE has been changed to false and LINE_BREAKER has been returned and set to AAAA So the GUI is changing settings when a user re-edits the sourcetype.  Perhaps the user just wanted to changed the sourcetype descriptions and they saved that would mean the sourectype no longer works. I reckon this is a bug or design flaw but Splunk Support are trying to say it is expected behaviour. Please feel free to agree with Splunk Support if you think I am missing something. Thanks, Keith   ... View more

Hi, I just wanted to mention that recently I have tried logging a couple of questions and have had big difficulty entering questions into the "Body" section - this section. AS soon as I tried to add more than one code block or screen shot it would start glitching with pictures repeated or lost entirely. I am using Chrome - perhaps it works better with some other browser??? Just letting you know    thanks  ... View more

Hi, I am having trouble getting replace to work correctly in Ingest Processor and have this example. In SPL I can run this search:     | makeresults | eval test = "AAABBBCCC" | eval text = "\\\"test\\\":\\\"" | eval output = replace(test, "BBB", text)     and I will get this output But if I run this in a Ingest Processor pipeline | eval test = "AAABBBCCC" | eval text = "\\\"test\\\":\\\"" | eval output = replace(test, "BBB", text) The result is:     Note the slashes before the doublequotes have gone. Why have they gone? How do I ensure they are retained by Ingest Processor. This is a simplified example of what I am trying to do but this is the core of the problem I am having. Thanks ... View more

Hi, I have the "Upgrade Readiness App" version 4.1.2 installed on my prod and non-prod splunks. https://splunkbase.splunk.com/app/5483 I had a problem with it so uninstalled it and was going to reinstall it but I see the latest version on splunkbase is now 4.1.1. What happened to 4.1.2 - was it withdrawn?  Is that documented anywhere? Thanks, Keith   ... View more

Hi All, I am doing a very simple search over All Time of:        index=index=orafin sourcetype=ORAFIN2       It returns 26 rows and, as this shows, all have a transaction_type value: If I then select D it adds that to the search but retuns NO rows:   Oddly if I change the search to a double negative  I get my data: Whats going on? Hoping to be enlightened, Keith ... View more