Hi @burvil , Yes, you can restart your application as long as it is connected with Splunk. You can create an alert and add the custom script. Once your alert is triggered with the help of your script it will pass a command to application for restart. --------------------------------------------------------------------------- If this helps your like would be appreciated. 😀 ... View more

I am assuming that when you say F4 in F5 is about the list of values of the split multi value field. See this example. You can see that split will split the second row values indicating that there is 'nothing' in the F2/F3 place, but as you can see from the count, there are 7 values in each row for the 'split' field. | makeresults | eval f=split("F0,F1,F2,F3,F4,F5,F6:F0,F1,,,F4,F5,F6",":") | mvexpand f | table f | eval split=split(f,",") | eval count_of_split_results=mvcount(split) | eval x=mvmap(split,if(len(split)=0,"-",split)) Note that is uses mvmap, which is a Splunk 8 function. But this simple iterates through the mv field values and changes any length 0 field to a hypen.   ... View more

Hi,   While using split I am facing an issue, in my events I have null values for a filed sometimes. for sexample - f1,f2,f3,f4,f5 - this works perfectly but below data with missing values in few fields giving issues. f1,f2,,,f5 split commands suggests f5 is f4    Can this be handled ?   Thanks in advance!!! ... View more