It's a pretty old question, but I managed to create lookup csv files using the REST API by running a search through the API. Let's suppose you need to create a lookup file inside "my_app", named "my_lookup.csv" with fields "myfield1,myfield2,myfield3": The CURL might be something like this: curl -k -u admin:pass https://localhost:8089/servicesNS/admin/my_app/search/jobs search="search | makeresults | eval field1=\"\",field2=\"\",field3=\"\" | table field1 field2 field3 | outputlookup my_lookup.csv create_context=app"     ... View more

Already tried, no success. It would work if the _raw field is recognized as string, but it is not. I've already tried "tostring(_raw)" also. Nothing changes ... View more

This is exactly what I needed. Now the output is in the correct order. Thanks!! ... View more

The problem is that the _time field is exactly the same between events, and there is no way to "sort" it in a logical way. I've created this search as an example: | makeresults | eval _time=now(), broken_message="order, in only one event." | append [ | makeresults | eval _time=now(), broken_message="ge it in the correct" ] | append [ | makeresults | eval _time=now(), broken_message="events, and I need to mer" ] | append [ | makeresults | eval _time=now(), broken_message="in multiple" ] | append [ | makeresults | eval _time=now(), broken_message="is broken" ] | append [ | makeresults | eval _time=now(), broken_message="This message" ] This is the output: _time broken_message 2022-05-06 12:06:04 order, in only one event. 2022-05-06 12:06:04 ge it in the correct 2022-05-06 12:06:04 events, and I need to mer 2022-05-06 12:06:04 in multiple 2022-05-06 12:06:04 is broken 2022-05-06 12:06:04 This message The way I find to merge the message is this: | eventstats values(broken_message) as message by _time | mvcombine delim="" message | table message  And this is the result with the wrong order: message This message events, and I need to mer ge it in the correct in multiple is broken order, in only one event. The output of your suggested method is not exactly the same, but it is also disordered: | sort _time | eventstats list(broken_message) as message by _time | mvcombine delim="" message | table message Note that I needed to add "mvcombine" in order to merge the "list" output in a single line. And here is the output: message order, in only one event. ge it in the correct events, and I need to mer in multiple is broken This message So, there is no logical way to sort it in the correct way. That's why my first question was related to the powershell ERROR output in _internal index. I suppose the same happens in every Splunk instance, is not an isolated error. So, Is this a know issue? and if so, is there a workaround for this? ... View more

This is exactly what i needed. Thanks! ... View more

Hi Soutamo. Thanks for your response. I am populating the new index with a report that extract and process data from another existing index. My search/report looks like the following:   index=OldIndex #SOME OTHER COMMANDS THAT WE NEED TO EXECUTE | eval host = SomeOtherField | fields + host, metric_label, metric_value | collect index=NewIndex   The result event looks exactly as I need: Only 3 fields, and host field populated correctly. I've scheduled it to run every 5 minutes. But then, in the "NewIndex" the data is being populated like "OldIndex": with the same fields and the "host" with the original value. What is the problem? ... View more

Indeed, we have /opt/splunk as a partition mount. Should we add something to the unit file in order to wait for partition's initialization? How can we do that?   ... View more

When you said "SHM" is it the Deployer, the Search Head Captain or the same SH with the issue? ... View more