Thanks @akkoem - I will test some of these suggestions tomorrow and update.   ... View more

Hi @akkoem - I am just using some sample data for setting this up and I am creating that with this SPL: | makeresults format=csv data="Date,Branch,\"FileName\",\"ErrorReason\" \"2025-10-13T21:23:31.257+13:00\",Waikato,\"G00027_.Progress_Note.PDF\",\"Matching of files into pairs was unsuccessful within threshold period. Missing XML file.\" \"2025-10-13T09:04:43.479+13:00\",Taranaki,\"G00030_202510130Silent_Documents.xml\",\"Access is denied\" \"2025-10-13T10:44:00.788+13:00\",Waikato,\"G00027_Active_R.PDF\",\"Matching of files into pairs was unsuccessful within threshold period. Missing XML file.\" \"2025-10-13T10:02:04.579+13:00\",Waikato,\"G00027_Sales_Department.PDF\",\"Matching of files into pairs was unsuccessful within threshold period. Missing XML file.\" \"2025-10-11T08:00:16.858+13:00\",Waikato,\"G00027_Progress_Note_2.PDF\",\"Matching of files into pairs was unsuccessful within threshold period. Missing XML file.\" \"2025-10-10T12:41:42.938+13:00\",Waikato,\"G00027_Progress_Note_3.PDF\",\"Matching of files into pairs was unsuccessful within threshold period. Missing XML file.\" \"2025-10-10T16:20:55.225+13:00\",Waikato,\"G00027_Trail_balance.XML\",\"Access is denied\" \"2025-10-09T12:00:02.921+13:00\",BOP,\"G00031_Control_totals.xml\",\"Access is denied\" " In the alert I am using the Trigger Condition Once and if I use the alert action Send Email I can simply specify Attach CSV or Inline Table and the 8 rows of data will arrive. But in the action ServiceNow Incident Integration there is no such option and specifying the fields in Custom Fields only results in one of the rows of data values. These are the settings in the Alert Action: Using the Custom Fields I can set comments to FileName but only the last gets sent through and ideally I would want a table created in the ServiceNow ticket. Is this possible? Thanks     ... View more

Thank Kiran - do you agree it should work this way? ... View more

Thanks - will be interesting to see what others think. ... View more

FYI - I got the same problem installing on a ubuntu 22.04 VM. Splunkd is up and running though so perhaps, as suggested above, this is a red herring?   ... View more

Further Update:  Splunk fixed the bug and expect it to be released to Splunk Cloud in the next couple of weeks. ... View more

UPDATE:  I pursued this via another angle and have had agreement from Splunk that this seems to be a bug and that they will put some work into it though I dont have any reference number or ETA as yet. In the meantime I am use the rex command with mode=sed to achieve something acceptable but not as good as I would have liked. ... View more

Hi Bowesmana, I tried that too but the editor wont even let me save it that way: Also note that while this simple example illustrates the problem the real data is extracted by  previous rex command so my ability to manipulate it is limited. Thanks ... View more

Oh for some reason the image of the SPL2 result didnt post so here it is: ... View more

We have also applied the same work around and will advise in a couple of days if things are looking better. ... View more

Hi, I support two customers who are both running Splunk on Windows and after upgrades this year are experiencing very similar problems.  I use this to monitoring the swap memory usage: index=_introspection swap component=Hostwide | timechart avg(data.swap_used) span=1h and as it increases we then start seeing dumps which I can also graph with this: index=_internal sourcetype=splunkd_crash_log "Crash dump written to:" | timechart count Like you this has been logged with Splunk for some time but no fix yet - though they did just say there is an internal case looking into it. For my customers the problem builds up more slowly so as long as they restart Splunk twice a week they have no problems.  Sounds like that wont help you.   Its nice to know there are others with the same issue.  Thanks for all your detail especially re rammap.exe. Good Luck ... View more

Ah that makes sense - thanks @manjunathmeti  I will hassle my servicenow contact and see if I can understand what he has done ... View more

Hi @manjunathmeti  thanks for the suggestion but why would I do that.  The link you sent relates to app the "Splunk Add-on for ServiceNow" whereas I am using the app "ServiceNow Security Operations Event Ingestion Addon for Splunk Enterprise" Thanks ... View more

Can anyone point me to where this escaping is documented in the Splunk manuals? I can across it in a dashboard today and have not been able to track it down - very confusing until a colleague told me what it did. ... View more

FYI and perhaps this will be helpful to others. I was getting all the same errors and finding little of use in the log files. In my case the problem was that something had deleted these files: C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\dbxquery.exe C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\server.exe Files of the same name still existed under: ...\windows_x86\bin ...\linux_x86\bin ...\linux_x86_64\bin So we suspect some antivirus or similar must have deleted them for some reason. As soon as I put them back DB Connect was fine. ... View more

Hi Kamlesh, Thanks for the suggestion.  I ran what you sent but it shows the field values as 1 byte long.   So its not htat.   ... View more

Oh - I am running Enterprise version 8.2.4 ... View more